Overview

overview

8

Static

static

3

2026-07-27...ry.exe

windows10-2004-x64

8

2026-07-27...ry.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    27/07/2026, 17:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-27_50098862fda1e2deadd42da1465972e9_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
  • Size 28.5MB
  • Sample260727-v48edsythx
  • SHA256 1042f4639e9a15b2d7339833031639da5bf81e1acbdad7a08c78f7d8e595343d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-27_50098862fda1e2deadd42da1465972e9_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-27_50098862fda1e2deadd42da1465972e9_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4504
  • C:\Users\Admin\AppData\Local\Temp\2026-07-27_50098862fda1e2deadd42da1465972e9_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-27_50098862fda1e2deadd42da1465972e9_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2732

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 29.2MB
        • SHA256 9facdd5e9eaa30e17c60fd561b5c0dea50343ca7ae14d9d944f1fdd91b873f8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe
        • Size 28.5MB
        • SHA256 4aaa6c652c53d9f3df63c4cabcce12e495245a713297bb0fa3bd5606b0873317
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jre-1.8\bin\kinit.exe
        • Size 28.5MB
        • SHA256 1b2c5347b1c6d1e64262e47dc73dbbfc49bb11eee49ffb86a21f951ca53e1d2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe
        • Size 27.8MB
        • SHA256 f2d26df30fabeb9ec17529da658db7a2baf312436ddb6d7ff98b4042012defd3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeClickToRun.exe
        • Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
        • Size 29.7MB
        • SHA256 32213fe7661e1d0d53046b369a24a30c9f208b4e60216268dd750627a500dba1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Mashup.Container.NetFX40.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe
        • Size 48.2MB
        • SHA256 0361ec6ad721010b5fdd3f6c1876d25bc750f72256e7444b1ae51f9596638766
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        accicons.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe
        • Size 32.6MB
        • SHA256 449ce9fdde6d60b62782a53891d4f23fc505270c7c592e4425e036e4f2e2a9b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        grv_icons.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe
        • Size 33.4MB
        • SHA256 a0f3a4c898c5a6a40d4ea0c7cce7b6634a48dbf8079f38dd09b92a2aa2f88835
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        joticon.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe
        • Size 35.6MB
        • SHA256 b55bfe54123c1399f099eece008cbbab9ab344772888399e874af8203f37f455
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        lyncicon.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe
        • Size 20.6MB
        • SHA256 21a76a6460c231ada8f56704fe7397b25921dcde8cf4e54ca3978b18629be068
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        misc.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe
        • Size 33.6MB
        • SHA256 601a2437d4590c0938021d366c2001ea2f60dc669460ffdfe05b49966fd6f8f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ohub32.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe
        • Size 33.0MB
        • SHA256 3b84a5a40e019161d6bc2d422340e6585e55276a8e29531a3b771c8c2ea230ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        osmadminicon.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe
        • Size 35.4MB
        • SHA256 455c3ff5d2530551e9f614e36bfeec5c76a476b22d1766438226202aaf25bb4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        osmclienticon.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe
        • Size 34.1MB
        • SHA256 f77180dc9bdc9009912e6d049c0732cd686d117c1d6eb5c038df7536b4798904
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        outicon.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe
        • Size 34.8MB
        • SHA256 1c5756de4ae4d900593b849a9a834f58e12939d8922a687d3f2918a84e39855c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pubs.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe
        • Size 32.9MB
        • SHA256 56bc9a783ecdd992e16670bfdd4a05ba054472854c4ba4f2c038f395af774096
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sscicons.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe
        • Size 32.8MB
        • SHA256 1b8782a9ae50079bb146c564d4befbbe54f382a38bfd4b42825d6a5d04abe61a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        visicon.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe
        • Size 30.4MB
        • SHA256 c415f40452fcee55dd00d203dc7e1f890641ebe9b68cc4c13b77310c27b85ed4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wordicon.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe
        • Size 31.2MB
        • SHA256 9ab1b3fadd37f23cca50b4561781372cb8e5094287a3b7749166a5b0bc34ad28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xlicons.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe
        • Size 31.7MB
        • SHA256 d2e08a7cea6cf42277538d9ab1813df8ea3ce67082a0f689f0f30eb42885d9fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        misc.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe
        • Size 31.8MB
        • SHA256 fda91ec32882369a318af74cae072dbe382182f8d29d722d15f00daaba321547
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        misc.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe
        • Size 30.6MB
        • SHA256 a9550ceca0278639d134d3ba7286dd23b7cba0a03e9ae980436e05b51a03aa14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        misc.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe
        • Size 30.6MB
        • SHA256 d1780c64baa391db26aef16a7080f064889e205ae41a08655c0a465604d5e3a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        misc.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe
        • Size 29.3MB
        • SHA256 75c10f32ec308bd58840c56f496bc44d49aafde50bcc05c3b25f21d74ad5c376
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        crashreporter.exe
        • Path C:\Program Files\Mozilla Firefox\crashreporter.exe
        • Size 30.8MB
        • SHA256 5c0c21a91f15a5fd866d3efe8dd79e37a6084967b061cf3a69455b377fb4708b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        default-browser-agent.exe
        • Path C:\Program Files\Mozilla Firefox\default-browser-agent.exe
        • Size 29.1MB
        • SHA256 63affeb63278e0b56b1cceb5abe8205e70b29fa6def7d7bd4e7452aaf03996f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        firefox.exe
        • Path C:\Program Files\Mozilla Firefox\firefox.exe
        • Size 31.3MB
        • SHA256 025140a7d186d270cc0fec70c206ba46885f4754473613236bf52de51a750d17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files\Mozilla Firefox\maintenanceservice.exe
        • Size 28.6MB
        • SHA256 e338fa0a642842636c9796e25349933ddf177bdaf4d0e443f3cb2b2d009745c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice_installer.exe
        • Path C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe
        • Size 27.6MB
        • SHA256 bfe5a9ebe4677c32828f03418ec6b6d51493f9cb67db4cf385bf279d8e0a7079
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nmhproxy.exe
        • Path C:\Program Files\Mozilla Firefox\nmhproxy.exe
        • Size 29.4MB
        • SHA256 136429b7c6a8dbd83bc558302940935958dc3c35d4df6a8d8391f73cb164fbc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pingsender.exe
        • Path C:\Program Files\Mozilla Firefox\pingsender.exe
        • Size 27.9MB
        • SHA256 48df7452b3dcb2f608ec05663317097323ebc52ecd2b3f902c7396be66f6bc2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        plugin-container.exe
        • Path C:\Program Files\Mozilla Firefox\plugin-container.exe
        • Size 28.2MB
        • SHA256 48b5f077aa77f4fde6c614fd3ea2256a21792e25d8470088421165c466200a2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        private_browsing.exe
        • Path C:\Program Files\Mozilla Firefox\private_browsing.exe
        • Size 32.4MB
        • SHA256 29a774d91663fb5b51511794d9a2d457e43eb91871c29701c3ca88f266423f48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        helper.exe
        • Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe
        • Size 28.5MB
        • SHA256 606f929e1fbc408415618090cf0f00f41ba8ffa846954ccd4887451aeae1da59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UpdateReset.asp
        • Path C:\Program Files\UpdateReset.asp
        • Size 29.1MB
        • SHA256 a16529c5f5d2ea61f8789f81464ab985534151b9bd7acafb72ee487538afb080
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        uninstall.exe
        • Path C:\Program Files\VideoLAN\VLC\uninstall.exe
        • Size 28.6MB
        • SHA256 d7e69fbf3c5e11c2b5bb472399eac6cdeea213372dc50d98705a7a49fec712da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vlc.exe
        • Path C:\Program Files\VideoLAN\VLC\vlc.exe
        • Size 29.2MB
        • SHA256 f4614ce3bed27c33527d33e35a9ec41755623a532514a452b27a37b16019d33f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 28.5MB
        • SHA256 1042f4639e9a15b2d7339833031639da5bf81e1acbdad7a08c78f7d8e595343d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        set.exe
        • Path F:\set.exe
        • Size 27.4MB
        • SHA256 a29393dbc6c48533783d1c0bb5330345d156e3c2312b27ca43aadd0a0b6d6cc2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        set.exe
        • Path \??\c:\set.exe
        • Size 26.3MB
        • SHA256 5893b9635c786752fb65e00807408c3ba120d11b0938a0c6cbe1ec2ade166723
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2732-6-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2732-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4504-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4504-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download