Overview

overview

8

Static

static

3

2026-07-27...ry.exe

windows10-2004-x64

8

2026-07-27...ry.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    27/07/2026, 17:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-27_ca67fdaf395d947fa0cecd4ecd0f9f7c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
  • Size 28.5MB
  • Sample260727-vx2chaap5z
  • SHA256 df1e6d4552e22f75c7aec3cc3336e714ea7ce54981f1438d540332e235bbc343
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-27_ca67fdaf395d947fa0cecd4ecd0f9f7c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-27_ca67fdaf395d947fa0cecd4ecd0f9f7c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2440
  • C:\Users\Admin\AppData\Local\Temp\2026-07-27_ca67fdaf395d947fa0cecd4ecd0f9f7c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-27_ca67fdaf395d947fa0cecd4ecd0f9f7c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2236

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 29.2MB
        • SHA256 3db2b7ea01f3258f87cd27a99238cae8cba0b2f7fa129defaebd889c7c48fe15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 57.1MB
        • SHA256 37441d5788cc90524de506bbc36df10c8a04c59fbcb028920368f22fad9ce533
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 63.0MB
        • SHA256 0cd395cfa71527f6b0387f7d8159a6431e9962518ee6324f648d2bc4160e7b01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 58.7MB
        • SHA256 625ea3c0e0717101fb08d6e225a05fa57e28fcd961b50dfb55132b73328ad43b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 60.4MB
        • SHA256 8835d45984264a212a80af54e47ad4f46c70755f63b12d89b608a7ce900a612e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 59.2MB
        • SHA256 1d3e59e447a0f55143cc5ed7914b2cfdf26958155fe0ee85b1ebbe2d6cd6070a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 58.6MB
        • SHA256 54fef17857eb52987a3e07cf3e60955d4c8348cdc8cffd09d012ffc7379ca0e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 58.8MB
        • SHA256 dc04bf1a2b8b2aa4943e3441ff20cc0b3a9df8d4261df537c30c53a724621536
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 60.0MB
        • SHA256 94e3fe89989e098985600d311138c1aaded758de7ba50a8f5f2cdeddc37c2764
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 57.0MB
        • SHA256 a7b78669d7f6ec3264f03018c1c632c84f5f2a84029cbfa970f87ef4a69226a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 57.0MB
        • SHA256 4cb775451dbefb48117c243704cb2f4bfe0af630071bfde41d6a9b36c221da21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 57.0MB
        • SHA256 a50c5136e2069d67fb893f140bc40bc441caff6935a06aa4979a692cf7a05efa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 57.0MB
        • SHA256 021ee78f1574ec0276d3b14fd98d6270a0f4f3ea3f1b8b685ab6170455b73dbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 57.0MB
        • SHA256 dd09a9ad9e39ec5c7f95c7469876d5eb0c5e8eb58082b8ef1ace5a9ed330eb5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 57.0MB
        • SHA256 448d0e772661e0ee5338ec523bfd9c9be087e1472aeb443a39c3a492728ed86e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 57.2MB
        • SHA256 25d060f94b735062ace86b1d7180452ea53a92fe0c9bde919a93949f5309a8d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 57.0MB
        • SHA256 9605b2a428a9bed1eab42e5d7341f75e1293911a2b6c96bff4d7c3cac5f3a5be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 57.0MB
        • SHA256 02115db20604ed81f1d9ee7e681a6371e274f1be5f09fececec94e6c1773dfec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 57.1MB
        • SHA256 c003b40c0850923a624c5ce0721af900c7941b08ae04a7a0b3b01d0eac302a24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 57.0MB
        • SHA256 c97ae82a8350eb9788beb917cf8c5060f6ec60f1f5cfd718b3b7d38ccdfce166
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 57.1MB
        • SHA256 cdf3c019c97d85f9b65cef8ff8f111037cf78d095d3e76d2d389a582a13ec05a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 28.8MB
        • SHA256 3e3efed665b685f6149a1cb80b0743423507f59e01e4c963725e19d00d3fe7a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 57.0MB
        • SHA256 e954e15114763b2c6351848c7b34bd0cccfb40a545e12ffee25b807ba1c45303
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 896KB
        • SHA256 8eeb97b640af332d62476e61bc49f32f16ee0dfa34fe4d7cec160e4ca990048e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 57.0MB
        • SHA256 693823f1d142f0da5d0939f15113d63c0c6d7c43b56b39ed3cab80bfe2713c3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 57.0MB
        • SHA256 5fa5259bb74ad2e7422d2c653b029145166e25d53270f8c6a9c00b50fa5b2a65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 57.0MB
        • SHA256 513dbeaaf5d19efb2c6f7a83cd971009d8995cc666e19b4208e89ffc1fe8c405
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 57.0MB
        • SHA256 93709917425b827e1d545fe4af1a82e322533dc475950c978c06d131a2148e94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 57.0MB
        • SHA256 573e475c1a8b97a869b7ec5b948a7e3a68d005f7af38de42440268482c8b998e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 57.0MB
        • SHA256 6261606c1b2842fd39d5ecdb85678755dac7e4716a662aa245b8ccb0fdcc5c27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 57.0MB
        • SHA256 d0c806129bca49e00a0501a1803d5a6ff584cc0a894740b859a923e9e50441cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 28.5MB
        • SHA256 a1687d1e603ab13b9021eab44da89d55b79f2bf9ad7c1df262bd11299dfc428b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 15.4MB
        • SHA256 0411a2102c1dc83b7905c357471c9632b86e5a9f391872b4c067aa6703897be3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 8.7MB
        • SHA256 7725b08030a898115d5c1a8d6188b6e0f6840718dbc8497c2aaa6e3b74a4e9aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 960KB
        • SHA256 b6bfa9acdd9417d53631eeb3e32ec0937b3287ab4963d3a18fcb0b1ffe79f4a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 57.1MB
        • SHA256 07970da7e2f7cf51dfe38a7d18b803029bb29c4d9abecdd38cedf4e711aad5fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 57.0MB
        • SHA256 49006d9b5c22c50f68802ffa4d1a5a08ad589cbd5c8623d01ddbe7d694e980eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 57.0MB
        • SHA256 017bd3dffabac1b03ac2441ecac8ac539b48d04cbb8780aa87a5dc56a0b17352
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 57.0MB
        • SHA256 1621aea57d44ec5f5f2a719565721bd9e9cbe37d08a980ffc526856337ac9775
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 28.5MB
        • SHA256 df1e6d4552e22f75c7aec3cc3336e714ea7ce54981f1438d540332e235bbc343
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2236-6-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2236-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2440-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2440-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download