Overview

overview

8

Static

static

3

2026-06-26...ry.exe

windows10-2004-x64

8

2026-06-26...ry.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    87s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/06/2026, 12:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-26_c4236b730a351bdb2a6d98bed7250afc_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
  • Size 37.9MB
  • Sample260629-pp3mpsdv2t
  • SHA256 1f61843573070f357d72650e9e06d22111793616fe3c2cb470ee57cc115443bd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-26_c4236b730a351bdb2a6d98bed7250afc_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-26_c4236b730a351bdb2a6d98bed7250afc_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4836
  • C:\Users\Admin\AppData\Local\Temp\2026-06-26_c4236b730a351bdb2a6d98bed7250afc_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-26_c4236b730a351bdb2a6d98bed7250afc_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1360

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 37.9MB
        • SHA256 1aa961de8752d466951f01c1595f83d09fd9d38168dade7b6205f091714fa16a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 37.9MB
        • SHA256 1f61843573070f357d72650e9e06d22111793616fe3c2cb470ee57cc115443bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 37.9MB
        • SHA256 f934c79d6f50764f78404d505a8502c7944eda8b19646228e92bbe22fdd6761c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 79.9MB
        • SHA256 d3981a5164aa18a87dda5ac515a9cc865b998ff2a28951916af71f5cfec347f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 61.3MB
        • SHA256 e0b20755937d0de82d8f309d30c5b853d6f2cd490dec1eb28ceb44bc3c581c04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 75.9MB
        • SHA256 59241321fb32ce43685f2c4f3ef491bdb00d8795402ebfc0f24631747c0288aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 43.9MB
        • SHA256 1c0dd59ecc79d933a17fe4df881ab5286d2b27c7d3b8cf06ada5844b52d04950
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 66.8MB
        • SHA256 05c366ac37c5714940f59ec89640777978fd994c8c971c70c87359dd2135fabf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 77.5MB
        • SHA256 96590e5e3330d65db6b1a4b721b0ee11d204323ef3a3238d44f0a6ae302ec8be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 79.2MB
        • SHA256 f160dd4cc1efbb69f35228635bcdeceddc6b00b3da039bc790327e17353653d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 78.0MB
        • SHA256 458308986c1dcaac94f4e87e7defab6ee73b63f85312b49a3d2c7aeefb598ae7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 62.6MB
        • SHA256 884f404b657f59c9e080e9c99fccb4ed475544dd9f2e386289b7848167373bfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 61.6MB
        • SHA256 ad510943fcc2582fc184bd1b6690e0b9fdb9248f0a4df2397c4a27d6f7474eda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 58.2MB
        • SHA256 e17b326ea308c86e7567a20b62d6b44309c778dd353775d3543ab54af6cd3d1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 56.8MB
        • SHA256 ca2a8f0e95f52cfb9006adda628a68aa3d81d7ec067d8c9ec989e707f3b8ce7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 52.9MB
        • SHA256 c2923656e298d0f3d4d2a46d81359e06e2e396448d8352427cc78f5318103b08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 52.3MB
        • SHA256 4967379e8400fe8788f5481b69fa71abdd2ac3ec15ca84d132f5d0e853fd07cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 49.4MB
        • SHA256 34f1759797fa71179c937c19ed3cb6e71e6f9cd1e536b1ffb236776bc9f7bb31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 49.5MB
        • SHA256 0dbe8c7810ad400b8187f9e7df87d8cf96d3d9fd4b4f3cf2a4c5deb879c34fa6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 49.2MB
        • SHA256 243964f0221ec621223111cf25a32c77408e198a73f1f49bcc72b48f58cff5b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 48.4MB
        • SHA256 c1db7787a782e9d3e52cd1ccfcd7c211d4fd5185b60969bfab58c220c5412eda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 47.9MB
        • SHA256 3248e8ecbc3eee0a95d633acddb58e5e5ea2bd9e129fa1f5d510cf786dded176
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 46.1MB
        • SHA256 9d25e2e166543cdedf693b9098caedd01838724d8ab0e82a5cf8360c8b820837
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 45.9MB
        • SHA256 4306af4be089b8f9f6553e7d7d709c54f83466f7bbf354e8ca1ebd51816e54b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 45.1MB
        • SHA256 1e1af5131ab1b5ecde0db23b73626b4a7408bf90c9dfdc221fb1c00861dbeb61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 43.8MB
        • SHA256 ad90dc9c1e5b2e67b56522ff5e2bd92cf479c497543bb8ff3ad27963ca0c53a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 43.5MB
        • SHA256 101797a023d6441a4ef04ed20bef7b0afefbd97d885c1b23c4e1e6f552e610ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 42.4MB
        • SHA256 d4cce14065ef77b55f8b20926f4d9a87b7fefd5f51c9514560b06f2c0dddcd4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 42.2MB
        • SHA256 39df331d96175f6b0e413359d555247f6cab2cc8f490b549af1a01e36d635d22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 40.2MB
        • SHA256 cdc15d6cc8dec0bce36e53263666cf360dcd8e4f1643b9437376d180db41d633
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 39.6MB
        • SHA256 366bf12b2aaa9557593290e655504c8a4cad0c8dfce73e0ed87b68b44cf51e76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 39.3MB
        • SHA256 816630b9c9c2cd55c11610549a26e2428015729afd50bacc02143a8110937dcb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 37.8MB
        • SHA256 c04dc80b9955bd2920efe3936118c4b5b0d1d4ae92ab0af12a6451297cba993e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 36.8MB
        • SHA256 cb7f5925cf77578d8117923d07be31018bc1f49ddb9ef3f07a9382a69b5a4d50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 36.7MB
        • SHA256 c07260b028cf9ba47dc068ae0852314c941272590c354373f14d7501af718b89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 34.8MB
        • SHA256 fad202b3a5ea5226cc411b835870a9f958f93282b1c4bf9b3a569b256aa75f43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 75.9MB
        • SHA256 1fa03e804e145368172971dcb84107354670d0376602c85699624724eb9a68a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 75.8MB
        • SHA256 96507101ca09159ae89f9ac3ca5b884bc87a2080f4e650edadb6fcfca7d6e511
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 75.8MB
        • SHA256 851c75b0a30751491b35bdaa937e42e3c21b2ecb0f7a3254c462eac7dc10e2ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 75.8MB
        • SHA256 f84343af10d9e5a8799db46a758212bc71969bde93940296d86689d5fc1e0792
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1360-14-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4836-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4836-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download