Analysis

  • max time kernel
    150s
  • max time network
    132s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 01:01

General

  • Target
    2026-08-01_3574043e69a76f5e94e14e3d595002f9_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
  • Size 22.8MB
  • Sample260802-bddmjsar8z
  • SHA256 394c81b9230525eb900b216aa5d0ed0b3c2b3ee2437fb2e43a016cec05e9b1b4
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Control Panel 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_3574043e69a76f5e94e14e3d595002f9_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-01_3574043e69a76f5e94e14e3d595002f9_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1984
  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_3574043e69a76f5e94e14e3d595002f9_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-01_3574043e69a76f5e94e14e3d595002f9_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2564

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 16.5MB
        • SHA256 d85c5d5d0dac53fc529237d2a00e3ea6552d011df2cba8a16083afbbc67a61ca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appvcleaner.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 18.7MB
        • SHA256 e2bcbc5a6cff87b1fc5e8c33dba39d53c69f301ce30c478b9a5c6413224a02b5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VSTOInstaller.exe

        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 14.1MB
        • SHA256 f3955c7e9260ffe2c3bade9e4c111f5fb45c56678f5e8b6c49d6713dce58fe18
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrmstp.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 12.0MB
        • SHA256 e18349dd5ea432f2ffc90e732c3594616bab567191bba06e000082735d586cb6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        setup.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 12.3MB
        • SHA256 cbf8059874727cc4ada41b317392ae9945cf50b7adc796a5dec00d632a02f67b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_pwa_launcher.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 12.1MB
        • SHA256 1fcbc78713315585ee9fc16fd5163b16f0871fb8bab8549cc516ad036737e422
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevated_tracing_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 12.6MB
        • SHA256 4ebc59c49c62b29a98e3e1b35eabfd4af25463e8d0b8e57ada0b09f307b0ffb9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevation_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 13.4MB
        • SHA256 fcc8e02736c4e76fc417bededfc69df986e11549acc23227da788fb76149b28b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notification_helper.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 12.1MB
        • SHA256 0183a88e2828373e6cb6de7629b7eab884b2061c0d9759ed774be6d3bd057253
        • MD5 SHA1 SHA512 SSDEEP TLSH

        os_update_handler.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 12.0MB
        • SHA256 835f1345844ec16fd0d74dab8310ce22e9ffcb59e0f9891cf5460d3670fef674
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 12.4MB
        • SHA256 c34748d29ae5a8778882784eaf2513793228d5090f9c349ea9ecae2bf2da0cdd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_proxy.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 11.9MB
        • SHA256 a120a4df1265574c6219d7178299cdfa8279f6890773b5b9b0dd55c91297ee30
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appletviewer.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 12.2MB
        • SHA256 231943e6b2cd7b9b2a7014c22f963bbe01a10fde7ca4fb10b8605904e141d90b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        extcheck.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 12.5MB
        • SHA256 7ddc924e05dea06f1cb2440b05cf2a0631146cddba0422c35fd620940e1de88f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        idlj.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 11.4MB
        • SHA256 debedde6c53cf2581bba0cde75b0690314f4173b583ba55fa670078111f0397f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jabswitch.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 10.8MB
        • SHA256 27da461e45a37efcaf3a9af8d314d8370fe09aded3bc7497497fc176d7c07687
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jar.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 11.7MB
        • SHA256 406f8b8af211521b611e5da2e872fc5ece12b11a2d03ac98fe7900980dd92c66
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jarsigner.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 10.4MB
        • SHA256 648cf4b2082f3e68a2075f3794e711f28a16c5da0909611c7e3dd37b48b4e7df
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java-rmi.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 11.3MB
        • SHA256 8047de7173ed0bda9ce29a4cf9100a65306daaf1c91c9909e03fa7eb5f08827d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 11.7MB
        • SHA256 0918c5eb88dca3d96333236dfc0d3f6f5296a9e85b3ac4df385fdf5033bcb16f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javac.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 11.9MB
        • SHA256 64dae44ab09f2d0db5db55d9b3a89c8d36a704ce139cc5ef6fab6eb540de7d74
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javadoc.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 10.7MB
        • SHA256 6c0f04bf8ac876829926a68c932948050f8efe098cb83f31c2930c2dc2f42821
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javafxpackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 10.9MB
        • SHA256 8ca28c45e224ef2614860d9c991fbd2b4ab9a6eff42c9398a49600cd63a76a57
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javah.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 10.5MB
        • SHA256 bff7b792ca5a9799053e8ff5d7129e8deebaab0f2a7ac3b4b705c7bab06e8b6b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 10.1MB
        • SHA256 10beda160e87b4ec30ba1f73cef45b6c9258625d8720c93255ab3e1599598d64
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javapackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 10.7MB
        • SHA256 6c0cff4c285179ec342459eef996bf14afe2778e2feda0db79fcf66cd116c098
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaw.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 10.5MB
        • SHA256 7996e2f5be23a85a09bb840729116683eaab1708349280c42ca5145e0b8616ce
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaws.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 10.6MB
        • SHA256 f10596e6f496bd1646bc9a3fc056b96bcb4b7620288f8606d0a1e73560e6fdff
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jcmd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 10.8MB
        • SHA256 469645fc726b79744c019f9c7346d0ef7d972c75cf707a50ec4faff711b1724d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jconsole.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 10.6MB
        • SHA256 077fbe8003723bc53e99d087cca33e5483d6d8739355b1299f053e129e40c0c3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdb.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 10.2MB
        • SHA256 253c32221a756fd97006f553a6c51d8b652c26678383a67795975a2bf56a779d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdeps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 9.6MB
        • SHA256 92261614b6b4ac4808dbf0b6e4d5f401f9e3081f3a7f6a9e0a832ea1b928f0eb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jhat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 9.8MB
        • SHA256 15e40ed45b3ca3f06638c1a2cd53509af338e6414c0c3fc53f97e38d1beb33db
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jjs.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 11.1MB
        • SHA256 47a2b33f7251837e1f447ed71fe8772b41796020f7b97194eeca19c2addb18ad
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jmap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 10.4MB
        • SHA256 f543315e9478399c6f1c1a71ced01189d8e87836eeb7bc5bd63d473f38936738
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 10.1MB
        • SHA256 642783a7a8cf20a0dc0c366b719175066ed9b2d73963257e4fc48d032394f0cc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jrunscript.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 10.0MB
        • SHA256 285bebeb89200f5ae9b3432208bd8c0081e560b236350f44ddd73b924526d216
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jsadebugd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 10.6MB
        • SHA256 a863d238c146367dda78c1e1891816ca227444e791d59d7945cda7365ff31f51
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstack.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 9.3MB
        • SHA256 40c4fa26a6fe3e7e6bf5cca0ca8730f836bde4dba9e6a27ecc3685c6a75477ec
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 9.4MB
        • SHA256 afafd74bc90e2e4ed749c6640868d61d39a9c6abc7e0586d43ea2bd5a0542798
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstatd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 9.8MB
        • SHA256 96a579b00652f1b5dc0489beda05a52b6d145d4bf881fa02a6504b0cdf0920ae
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 10.6MB
        • SHA256 df9b4ecc7ad8ae650a5011807c0076462c85162ed6887df47f40ed4c4f7f6ae1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kinit.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 10.4MB
        • SHA256 015c1086f953138dd6f5001e9e86e4855f3385d7fa48b98e7a8786b9cd44df29
        • MD5 SHA1 SHA512 SSDEEP TLSH

        klist.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 9.8MB
        • SHA256 f49d31afa1a4e28c4365320408aaf571b1f6b3e79bb0f2b68e25a7abb3184b33
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ktab.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 9.7MB
        • SHA256 b25f80d922ef0d3c4a82f4fd386567649c7fc43db0f7883fa550104e6112ee74
        • MD5 SHA1 SHA512 SSDEEP TLSH

        native2ascii.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 9.7MB
        • SHA256 ebf30c96817d728a64dad7335b13d3402ac8f033d1c576c1f0052de984ddf068
        • MD5 SHA1 SHA512 SSDEEP TLSH

        orbd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 9.4MB
        • SHA256 785bbc7390767a084fbb66e82b7f8a56055e0141aeba6b70bc4bca70d0ca0b0e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pack200.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 9.9MB
        • SHA256 8a9d1e873f429be09a6c9f39371e6f4895d3beeb564868a1c860f18afad2b7a1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        policytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 9.9MB
        • SHA256 bf1b68ef31d0de5911549e13a11ab56427be6bad52e20d3a58b639c45c67757a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmic.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 9.7MB
        • SHA256 c4711dda5101df3c24d795aa3164300334e9b9f136b6eaca5f3c917509a9743d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmid.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 10.1MB
        • SHA256 58f6690a3f2e9f2275b31e46cca20ecaa10dc56b49089baf8553921372427910
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmiregistry.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 10.1MB
        • SHA256 c2f610f985b140eb039aab67b5c4dceb24a75b0c8426da375176df9623746102
        • MD5 SHA1 SHA512 SSDEEP TLSH

        schemagen.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 10.0MB
        • SHA256 6f9ca55708a86c2e109a7a94d7e433d500cf85cad9606087ade2af5eef32b0fd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        serialver.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 10.2MB
        • SHA256 de8106d33a91d58c727b8155c4cce00a14ad95ef57ecb0aac4ae18bc0f9967b8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        servertool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 128KB
        • SHA256 018b597827351ef5fba9c0e1d321cfa9b45d887ff0f8d5607452eb75d8626cb5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tnameserv.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 10.7MB
        • SHA256 d6c3a5ce9cd9c06f24ed619d745117cfb8bf17f3e38f7407c1d7e5eaa5ddfdea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        unpack200.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 9.8MB
        • SHA256 ebb57e6ce66f9e488caa16f538deef3a64efee09df680e2be57728d8a176b652
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wsgen.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 9.6MB
        • SHA256 b10e5d29c18b3ce64597b0b876e84ce4dab52d60aafd8e263b7884e9eafcc72d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wsimport.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 9.4MB
        • SHA256 df1c625fc7b77172bc4965ae5b22ab2851eb4ecd6de184a9d4b746ea841a21b6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        xjc.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 9.6MB
        • SHA256 84c510c61201e05bb7ca3fb64856fb00f37df2d15be37685c9b2723ca4af95ab
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dotnet.exe

        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 12.8MB
        • SHA256 03718b85bb2c0295b965619bd98ec59da8bbe645fa276114ecf068b4d4413ad0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 12.8MB
        • SHA256 2b2de19d4911bb8da5030b9512b0ecfedc8e8e8c1a8819239a294ccd1627d3fe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 12.8MB
        • SHA256 19e9b89cf581d9df71a7c2804b710f50849e4306505a25c372b319e55d308961
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 12.8MB
        • SHA256 bc7bf8d771838a0662670c9167dead1c18f105f051701f85de214fc30411a806
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/1984-0-0x0000000000400000-0x00000000004E4000-memory.dmp

        memory/1984-1-0x0000000000400000-0x00000000004E4000-memory.dmp

        memory/2564-30-0x0000000000400000-0x00000000004E4000-memory.dmp