Overview

overview

8

Static

static

3

2026-07-16...ry.exe

windows10-2004-x64

8

2026-07-16...ry.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    16/07/2026, 01:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-16_7dcba6a8121b0aef1919aaec472c7529_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
  • Size 12.4MB
  • Sample260716-bgm1dsds91
  • SHA256 3bf24d14cfc5283e1f80920eb59d9452b39739ac2410cb6a5095e5aed668a114
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-16_7dcba6a8121b0aef1919aaec472c7529_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-16_7dcba6a8121b0aef1919aaec472c7529_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4616
  • C:\Users\Admin\AppData\Local\Temp\2026-07-16_7dcba6a8121b0aef1919aaec472c7529_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-16_7dcba6a8121b0aef1919aaec472c7529_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3516

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 13.0MB
        • SHA256 b529076569b7a1667e313ecaea320a6f07ca09a7230b1111abd0cc769b7d67b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 12.6MB
        • SHA256 b385d406fe8c7c20a1f4f6a878c5256de10a67495a455c5ffe9ed15d1d160bab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 35.8MB
        • SHA256 b7e14a3cf81166dcfb4fc015021f4ba5c05a93c84f72d7976cf7ffba5a530843
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 14.5MB
        • SHA256 1ac641efbd40789b869a98ef0eb8d66e08c2041c22c3c6eac2edba724571f2c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 12.5MB
        • SHA256 8aa08122e5f3c066a118ea538944cb6c799c0420121dbb36c22385feb9177cc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 12.4MB
        • SHA256 a7e09f713faaaabfc933011b03ee4a30512e20a858bdfeb75bdb170b17253861
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 12.4MB
        • SHA256 f719a0d02b16905407e1a3986d5cd6bfc1c098d4a0986c4b004f202a31fbbcc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 12.6MB
        • SHA256 aad5629a88e2c579a70229dec26edcb9a31052ffc73f7889d80f876b6f93dd44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 12.4MB
        • SHA256 63348e30e21a966f13f1a625f3567a79dadc91dc550ce97104f4fbe199dee75c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 12.4MB
        • SHA256 e158cd8cc12eeb223bc000ca5ca7812013ccc30e3425aa252ba4cdd2aeafea2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 12.4MB
        • SHA256 13c61b1fdecfce98c23d9b98bc89258ed51b20b28fb421646a0965c87fa59603
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 12.6MB
        • SHA256 389fa6b19387431da4a1972bceeaff5161c56e9b4fc1cf9b5916b6abf3b38feb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 24.7MB
        • SHA256 590381098b6e70aaa369894b979ea132a7c43caa128b0b39e7751c8dc13a8e6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 24.7MB
        • SHA256 ab77dd9ee4b2a50224e4f9f3c3d4ce328f11bd7a554679ac403bcafb0ba42604
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 24.7MB
        • SHA256 60cb71523dc4c6a49df92dbb5925589f8fcf694361d246fdb3e62e29d424f7a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 24.7MB
        • SHA256 94feebb244760a24727577c74f227c7fe5e6ce0f55c311fe926246fd802907a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 24.7MB
        • SHA256 e52633f7eb6ac30efef78e94364075bfb9adfabba37cb9cf5f97177a559effef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 24.7MB
        • SHA256 dfd2978688bb28528f45a1e5b5b210c51fe0010a540747d5b8a2ff011171e64c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 24.7MB
        • SHA256 56e13a0d468a6781d63a6f69017518deabe9ffd91eade52443cb7cfe8f781243
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 24.7MB
        • SHA256 a4b795d1d1d3d65ddb658161f1dc775006ae7954732515050ee18f78357a958f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 24.7MB
        • SHA256 8559eb4325b95f5741a0e098a61ec9c845cb2e9149a1d11ab0aead46e36c18d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 24.7MB
        • SHA256 a6a9e76e5b6b24901692127334f8fa480aeaf49ed227363f55e0b02ea4f88a18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 24.7MB
        • SHA256 793048b89f53802218215bbe36bdab6571a8637f4bc1d412758a52fee045865a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 24.7MB
        • SHA256 99b9a1717ca72e0ad0857d38503b7082698a4f0765296eafd355885273dd3949
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 24.7MB
        • SHA256 9bec90306e7efb139b2ee3328775e26ef941da268c2e849db1f9ddd968350b5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 24.7MB
        • SHA256 a785f1c4677ffb355544a62ec5617648a5aa22720854ee90bc1336a5ed0020a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 24.7MB
        • SHA256 7d77966d58c2a34cc93e993820a519f012952935aabd3b179940ce5eb1a61887
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 24.7MB
        • SHA256 7e0b182cd804d377f8f6e8b1b12a6f4cf8897e37469b4f155b09aeb25e62f664
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 24.7MB
        • SHA256 bb8f7b5be99af7503217b45a34864f1595d9fae3f5e1663b30c1766dc538f70f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 24.7MB
        • SHA256 64a8c51cccdea29f3203d720fae2e1b6114be200c86385f1a407b0cc20c48f2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 24.7MB
        • SHA256 213fa601421f957cb1920a56d3077c45014dac8f882ec8edf2e9dee0e6179eca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 24.7MB
        • SHA256 3f1f0e21027222c49185b27de523de82c3c1be6d0560747c9d8e966d6c704721
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 24.7MB
        • SHA256 8599ada6b6e799ed2703f243541e9a4382633ca8dfeb04b7b13bd4d381442c23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 24.7MB
        • SHA256 c05106587463b932ecd8a370429b39dd058e58029ae1cdfb2216722d2eb83eb9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 24.7MB
        • SHA256 dcf497b612c925c2cad7d6c92104366213d1a204795590f6a1ff05bda980e5bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 24.7MB
        • SHA256 4b48dd6128cd33268a769e88a9cf21cabec90347994ef1d2fad21523debb5774
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 24.7MB
        • SHA256 a08d6803282e93f900c66fc85eaccb3fce4f7e76c4cabdc773822c4d4574e907
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 24.7MB
        • SHA256 5d12a567271852884d75f0da9dc7657b5cae50e18a3b570250bd52b023aad7df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 24.9MB
        • SHA256 b3234221d347564c026fedf14185064d23e38d03429ed3752f572aca9acd8e43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 24.7MB
        • SHA256 ef7613347e5fb715a5d52730e35c455796ca94729b7be4ff353e6009a760255d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 24.7MB
        • SHA256 6298f1b14adf4605650563d905f8332bca7534a5cab3a3ded2ddfb05907ba917
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 24.7MB
        • SHA256 b97704680e4252bda3d0fe1829e9e58e88d25c0d994414d7fb9cdd714595dbe2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 24.8MB
        • SHA256 8958b7d4d2fa4749881e5e106708cab0153ba2a82e50df262725565f299fcbc8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 24.7MB
        • SHA256 a7830be4da12d13a90722d8f1b47de8d075c9e945df222b7bd75e21908dd3963
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 25.0MB
        • SHA256 9390618627467d7c65a11ebd1cfc96d406834619147d38984697deb5d3f231d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 24.8MB
        • SHA256 46d0a0c56e289fb1c5af3693bd0d53d5cd49796815db3d18aa8badb82da1a8b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 25.0MB
        • SHA256 cf9a763eb1f5c8ac3d4470667fd3f5c2237ffe7eac185f809516a7df4198ca8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
        • Size 24.7MB
        • SHA256 f0084b51e1d702878c54cb90fd80723daf4a4731cbcc5b851140fb37a04a3df3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
        • Size 24.9MB
        • SHA256 42b18eacf0ba360ad27a16e0c7418ad9817f1e696de47b772375a49f5c35beb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
        • Size 24.7MB
        • SHA256 d5d638d90b013df792f9f25f94e03f7cb757f877cb173aec1a6e1b0fb13aa767
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
        • Size 24.7MB
        • SHA256 3534645c4f195a52e3e0ba8cfe3864321be452e6bcc0c0cf5c262b73cd8c702b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
        • Size 24.7MB
        • SHA256 3b2184249e2b5cef1d03e81d813029c2cf6db3692a4a204140c4354918d75e73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
        • Size 24.7MB
        • SHA256 509872da39d526a9d4c025c3003b103e4b28cac00f0a319d89445867b126642b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
        • Size 24.7MB
        • SHA256 98a2aa0c106552f5a8c5b92a9784a7188bf75edd55872111be893f7985846960
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe
        • Size 24.7MB
        • SHA256 e2331780432f02e48e1e7ea2ceb426b580aa9c10050bcfb536df15ca34eb7701
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe
        • Size 24.7MB
        • SHA256 1764b20187335026e6160583c7ba356c12501c11156325efe76d84b092d1f6e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 12.4MB
        • SHA256 3bf24d14cfc5283e1f80920eb59d9452b39739ac2410cb6a5095e5aed668a114
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3516-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4616-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4616-4-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download