Overview

overview

8

Static

static

3

2026-07-29...ry.exe

windows10-2004-x64

8

2026-07-29...ry.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    34s
  • max time network
    136s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/07/2026, 08:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-29_a64394ea1a9ac614d72764e6a3bfca2a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
  • Size 29.2MB
  • Sample260729-j47mbafb64
  • SHA256 9facdd5e9eaa30e17c60fd561b5c0dea50343ca7ae14d9d944f1fdd91b873f8d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-29_a64394ea1a9ac614d72764e6a3bfca2a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-29_a64394ea1a9ac614d72764e6a3bfca2a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5520
  • C:\Users\Admin\AppData\Local\Temp\2026-07-29_a64394ea1a9ac614d72764e6a3bfca2a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-29_a64394ea1a9ac614d72764e6a3bfca2a_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:6176

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 29.5MB
        • SHA256 4a70e5b8a58460dc23061ac2add7f2d16956f5d3614ac73ac10a157b3d7f30be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 58.4MB
        • SHA256 e5b0c1487c365dd66ecce99554e5704e64547ad8ed7570d20f052a4623625027
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 62.5MB
        • SHA256 f011a37642f86697e14b945e8f10959854f762e5bd81820d76c8b9ff89e41012
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 58.8MB
        • SHA256 9503c8e5378d92e921c76ea380284f7a740c8c1a231314716c0352521d95e9e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 31.3MB
        • SHA256 861eae5dfe286bf8cbe4cc44a6ace3b316100a76fcefe6701c984c5662c7091b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 58.5MB
        • SHA256 998534b265cc77010752a786a9c13117de85c6ee0ef42a0ef424a56f7aed135c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 56.3MB
        • SHA256 e7a50663e87d87bf8e6807f59b646e6935446467ef52927101d7dcd68e8027a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 54.6MB
        • SHA256 ea2ec2c92388e7de4f078fe4b4226ea90dba7d517e582a4fd55626abd176e81e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 60.1MB
        • SHA256 0ce37ea67fe3729db0469880859510a6024bbc07ac9b506747731e0842847f56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 58.8MB
        • SHA256 cb075314ce4983ab56e86dc42343b880325e84c6bb52f056e561bd053ba7756a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 56.6MB
        • SHA256 0a5e856d7c7c4c5c0e4adac8be0b32d7477646a474d1e6644f99dd58538b32a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 52.6MB
        • SHA256 0e3ae63180f4622634202a6b4281e754b646ffc92f4adf282f62fe62051094d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 51.9MB
        • SHA256 a8dba47e072754fd5d9a69d10d40768af402859ffa62aad055f24635bf938e74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 50.6MB
        • SHA256 02b3d0614f3d5b54127ea2ae2477ca6976939fd506f1736f349b41119a1dd58d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 50.1MB
        • SHA256 50841b914ec8dd4f480af77d16eb508f1fe9be9c85fad798d96dd9d1b657e1ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 47.3MB
        • SHA256 4efb8d1af4fab3fa605013987f9c7cf1ad29e00b4ac32c8a6bc581cd57522966
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 46.9MB
        • SHA256 e3447fe0935a755c586f173462421fd5022cc49792ec89fb9b4012c07a45d150
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 44.4MB
        • SHA256 0347d11931bcb4e76bf2387c36476d72fb7ee737f2c8f8e13be36dc65c093248
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 44.8MB
        • SHA256 1b822c6601a79b9942c62335e797ecaf95d45d28717f346f39475f52e708b4b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 15.1MB
        • SHA256 1d62e85191e3868530b0d1641cb476acf467b07f612be0cebfc36dec05d6fff6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 42.6MB
        • SHA256 fbd9799bca4ff6178d89774cd1d3223b4259645e22ab64e6348fd263b3e52d43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 42.1MB
        • SHA256 cb33eb4e2f2c10bcc4db19b78e3624c268664111296488985436ba6056fedc60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 41.2MB
        • SHA256 426d0dab97d7238f01949357cbbb3e965279495e3001bf1ccc16389836f1c745
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 40.8MB
        • SHA256 c143c68843429768919926dfeb503627b538b719cbfde455bcae7f4e55d2826a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 40.8MB
        • SHA256 7142c8b07ac044e9b43c8d4f9de01948b5d135e89f422d65047421ed952560ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 40.2MB
        • SHA256 43a86f5d6bf7b925b3c061c78db85000a245147a9fdbbaef2c954f4fb46c2721
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 39.5MB
        • SHA256 d7a885c09b2cc9fc0f3487bdb5e4dd0e21468b1c0687f1ed735d4bae5970a30d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 37.9MB
        • SHA256 671c9bb4106ba6bf24a3b018faa2331f7bdcf15b16ebe9c9f6cc0b5a55d2a12f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 37.6MB
        • SHA256 d685ad5e7d9cbbb89a3b863ae3a97873d65c93a367cb6e2ac3a1d907eedb2a19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 37.4MB
        • SHA256 daece9aebd1d744fe7015ceac9a468b8ac46b717edffcac21338c6a225082f89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 37.3MB
        • SHA256 e6d1a8f3ea5c86fca5b10afb68a06e30a8804b909bf10bc525eeda836ac26791
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 37.2MB
        • SHA256 240575ce429ae93a77d8b38ce02dbed575041abb467a5ae0e8c6107c89924738
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 37.1MB
        • SHA256 f0d9c169a5a947cdfb2daa508fbb083538210bf0a1aaadad7247cd787ee277a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 36.9MB
        • SHA256 ba56fcbf18f5089ea5588b3c8b521f4b1b5f730f6204fe7d9b96a37f0427415b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 36.9MB
        • SHA256 3ed2ae4d9d39fd1f8b1608c28c841877cf986dc184da4cfe058e671bceb6f735
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 58.5MB
        • SHA256 662b0a5cc64428232be19d7e47ba1fd16ff3038fca07b83c695357d28deb9b70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 58.5MB
        • SHA256 775a2108a939aafc6d1e8ab97228e336e1062874ac572d6a2ee40ea6ebcde29c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 58.5MB
        • SHA256 3276b1b7a9ef4047505518aef9ef0d1204aca82b88e834907112766d6cf571cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 58.5MB
        • SHA256 d526dc45d19a21ac4c20867ed444961b46627e6e7c0e71931eb3930f77f3bf24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/5520-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5520-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/6176-17-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download