Overview

overview

7

Static

static

3

2026-07-17...ry.exe

windows10-2004-x64

7

2026-07-17...ry.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    115s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    17/07/2026, 07:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-17_9dbaf3073e0f73ed3378940f9ebf9d9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
  • Size 666KB
  • Sample260717-jf5staet9j
  • SHA256 0825565eb82050b498fa0e5a75ce2d05d4abaf252935381327ddaac47ca92b6b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-17_9dbaf3073e0f73ed3378940f9ebf9d9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-17_9dbaf3073e0f73ed3378940f9ebf9d9f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2648
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5000
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4948
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1944

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 1.2MB
        • SHA256 231ba1d86d281542da76e99ec2ebb3fe27503cb754ad01259ddb0db35c63c098
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 1.6MB
        • SHA256 7e037cd012424fe0deacbcab0dac99a9232a06763a16c46f0a925a0b6182eae6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 1.3MB
        • SHA256 6dd5399c9c705f38f9f8527581ab4f8fb683b21d64121c8388a3bab16ab2f6be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 681KB
        • SHA256 1d066bb4162891b468036e8fbb138cb8bed89b1bfeb1dc465d12f07dfdd8c9ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 6.7MB
        • SHA256 ff82c06303b0cd235a0d04cfc23a0308860b67216534d14aaecdbea201c59f8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 4.1MB
        • SHA256 4362cbabec800c67615739e01018424cbb7d50e2ac0fe51a59083f4baefcd242
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 2.9MB
        • SHA256 880baa18283c0eaacc7952f7a6d46f19aa97af3c853786e33366d610386a4f33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 2.3MB
        • SHA256 4c0483e9bb742182dac5c5fb9c54aab45da529ce0e6b6f2b3824ecbf5ed0f250
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 3.7MB
        • SHA256 85f4e09caa3c48b8c1d5f217968c347ac94422764245265235e115348163eccd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 2.1MB
        • SHA256 5c722e76a46952ce5a37dd86789ab550b8469f40ea545e98a6871e3d6ae91618
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 690KB
        • SHA256 30624a1898d4ba5dfb33d0bda0038439091073616c69bd8f8e634e0555fb0844
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 690KB
        • SHA256 31b72f1b7dc3f8bb41258526267b69842596a85a2bc16af6a9d86e25688414b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 690KB
        • SHA256 daec18a1f3f38eb0d33f827a3805c99c78ad69d0799ed31c46b4014c8199772a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 710KB
        • SHA256 eb6aa05fca944abfbaf196fe0e09334bb857d55637dcaa98b542a77f1df4e739
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 690KB
        • SHA256 f255a095eacf98e5d6a727072e35aa5fba6c064af2492bbb59dc89222913d09a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MountTrace.exe
        • Path C:\Program Files\MountTrace.exe
        • Size 1.2MB
        • SHA256 405dd3564ec4b087485f18ad5f3e4b3a820cdf6fcfec2d493a4ced12d79ab44e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 810KB
        • SHA256 c74d4653f35ecb35aad95c2c20ccc4cb54d8201290491d47ecd7af9cd6d24ab1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 722KB
        • SHA256 6bf33719b1c219e44b148a79824ef858a6d2c30462955f2109308d3c01b8ab87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 730KB
        • SHA256 41881fa2820e8c2473e5aa97b3bbbe7055cf537633d2407c8d1695a32639b648
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 726KB
        • SHA256 5b0d586c916c829c04b255e9a1e7e962e6c22ecc49b2df2b6b3a9285030b5f29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 666KB
        • SHA256 0825565eb82050b498fa0e5a75ce2d05d4abaf252935381327ddaac47ca92b6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 666KB
        • SHA256 72205d79b08f188420caf71b21e9021a47400ebdf6e359b623b12239e078cdda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 666KB
        • SHA256 38dbcf0343cb0ce4cfb8aace9e9487bf03076734a56047f2c516e41d79b19382
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 666KB
        • SHA256 4019c6c1713daab40648bc336c531cdfad6412ed497a465f34a9cfe54cb04a32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 666KB
        • SHA256 3678b40825b38f70a2f9c1ecb0908f35a0696a200391f2d48bc17ece25d89049
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 666KB
        • SHA256 7cd085123987dc2d8fa9f9124260f249f9d42a4df46ae4af850eb5ce46bdd912
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 666KB
        • SHA256 5b8d5b4300574754db98a177e38936ffac703373b493aad0943850d312c4d499
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 666KB
        • SHA256 94b255be33bac22d6942cdc25a4fe1ec4d19d989defc6d28ac212d60ff3abcbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 666KB
        • SHA256 2ea3549e513f9a2f3e45a28d905c35dbfbfe380a45f62dae4a98ac104e109214
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 666KB
        • SHA256 af2f349f5791500e9d93c320ae1455e152ed15f97592130fe875d9fee31325d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download