Overview

overview

8

Static

static

3

2026-08-01...ry.exe

windows10-2004-x64

8

2026-08-01...ry.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    34s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 01:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-01_26130b392693a6d37a6c4c7d185ef639_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
  • Size 22.8MB
  • Sample260802-bg8xvs1tey
  • SHA256 c3a1d5756c6c10d226270e2e5b090a26cca4bc1dbacb7e694ed463fa4fef4fae
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_26130b392693a6d37a6c4c7d185ef639_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-01_26130b392693a6d37a6c4c7d185ef639_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4032
  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_26130b392693a6d37a6c4c7d185ef639_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-01_26130b392693a6d37a6c4c7d185ef639_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3732

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 23.1MB
        • SHA256 d7151b8a057fcaa9cfb8dbc9a065f9119679f16410adfbf86ec89ece3b0dcb6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 23.2MB
        • SHA256 4aff961e94a02749fc03bc6bd4d28f9a1463b95a66e8d63a8a7d38b091b6fb27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 25.0MB
        • SHA256 5aac9b89c4c370f5c26619e1135c4c57030cdd982da053ed2c3ae22472fcf13d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 22.8MB
        • SHA256 c3a1d5756c6c10d226270e2e5b090a26cca4bc1dbacb7e694ed463fa4fef4fae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 37.3MB
        • SHA256 37b776dce032ea4482b4fb8a90cbf2231772fb75e2caf40a7703a23da0265dee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 36.7MB
        • SHA256 f18b8eded899da6330ff0d3628e0bb5648df0e05cf91435d2b499d49e708fc3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 38.4MB
        • SHA256 e9b262c1212664c8559629472c908145a0321aa9f40fe36889d6b60571c08e3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 36.4MB
        • SHA256 93d667a8057dd6061095ed8e012a3b56372da63c0c5c8d57dfaf1c9518d67ce2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 38.4MB
        • SHA256 ed6c8360e1bb1a614615283dc7f6e7cfd47782eab0ebd11e504f1adc9970518c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 34.9MB
        • SHA256 12397ed0ee2dd5eea9987f085933389a0d2fed980357eb0d9b8a72a083b38125
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 35.0MB
        • SHA256 6bcb4a2b4a327de8e1f28639e13fca58cd2d732c9913f5d51735f8c8a545edc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 34.4MB
        • SHA256 f0c1b420d3c0b4096229685aa09cb09c5db99daea4413eea42897c34319edf1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 36.3MB
        • SHA256 18aa642e5e1d2cfb97b6fc38d4300c1d8fd6e4cd77a266785499904f1c2b333f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InstallApprove.exe
        • Path C:\Program Files\InstallApprove.exe
        • Size 32.8MB
        • SHA256 3947b55307460a153d26a0b0bbc2ab7f31067e99e7993d00e387ca8669b96e5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 35.6MB
        • SHA256 16d9ddbe5271b1b52999ae9f3521dd4dfe3daf5253bcab194030e91239222663
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 31.1MB
        • SHA256 5f57ca6ba1f1eedfbf0ef985f1e8aada03dbd1c75f3c51d95d8936ff0b76a128
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 34.2MB
        • SHA256 81c915a3c84eae4d9178015f9f3319196a1f4781926137bce5a7dbfe37d6138f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 32.6MB
        • SHA256 c1801bb0106479a3c7915ca3f0755f2b9880f2c399d2d35108015eec91c63796
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 31.7MB
        • SHA256 137c961f3670441983394bf3ce37cfb4264856253607a609f4cba639b695a581
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 31.9MB
        • SHA256 b27bf952d11dcea4fefc972b01047e1f7a45f87d1af2e0f497d8d161eaa545bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 32.6MB
        • SHA256 fb00a1c314064a32bdff23b23f7820725d4fca7b2bc1b2470c59aa9fc4aa0400
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 29.6MB
        • SHA256 45c622330d87814c2e1e4aa4391fe6d1186102850069791482b0aa74cf2b21ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 32.5MB
        • SHA256 2f22783f62bc1169ed2f5c3555b629ccbe749ea909db8774b21c15c3cb1e104b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 31.4MB
        • SHA256 f17c7dcf56cc5b29109eab1fd855642b3664b5cdcca65b5ab55f7d0e335f598b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 31.6MB
        • SHA256 0af0c0e8371f3f40ea7715842c4ad0ad1be707bf1af3df0c67ba2064aeea9f14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 30.5MB
        • SHA256 888918b33be9c3f9990db4e9c498823c7a46fd5785bafe11cc309bdc833c6068
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 31.4MB
        • SHA256 7a94f64850e8e9b1eddcc8bba780091aee0b18f59b772017be84f27649852ed6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 29.7MB
        • SHA256 be8262cf07efc93b5ae4259740b1ddd10c94c87cbc15b46bbe42153a1e6a1940
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 31.3MB
        • SHA256 689a48556c5c26e4e08bfdcdf24ae631e6c0e0b319c4eacf41555d2de8938a41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 30.1MB
        • SHA256 4effb03b731d16fd2b1adb34a3ff15486d9581abf4496906ee94cbe5d01ec323
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 30.2MB
        • SHA256 a94de322bd4f7ea023b00e4c4ec8346f6643f5436d7890c0c2fc64dd69672c2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 27.7MB
        • SHA256 80440a6efd99c584970a39e6eb535fa04481707f730ee3693ef298ae8de253de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 28.4MB
        • SHA256 9afb9061b8c84d36400147d3ff36eec360425b3a5f497713b3c128ceb869c3ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 27.1MB
        • SHA256 21c9d1a526f0ac7cbf9d7973b9f7248c1e2ff72d51617c58e2acf61a32997db7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 29.9MB
        • SHA256 1ea4cd7149bd46cea44f8d9075ab93eb5fdb30e91ba5a446269e92c66ae4e2fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 29.5MB
        • SHA256 b65a462031afcb7a8c0ad7be23bc09259cd261a991b17791d42871ef3917e1cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 27.1MB
        • SHA256 4930f6cf506bd0524291c7c581b84effd5df833eaf3d2bfc3e668fb6b83dcf6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 28.8MB
        • SHA256 4f8c804a1ef8182eb327e298a2590d8a7b1f1670002d78c3c57630bc3a208798
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 29.1MB
        • SHA256 7dec5f606e2bab7eb7ef5578f15e45c1724b93a3dbe56aab3340733ebf26f9e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 25.4MB
        • SHA256 2009564e321e5e28d56bc00617c43157d3b565c77f2de931e9f29bbfd22f4356
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 28.3MB
        • SHA256 7f72a5afe23c05ca27b00155c70e19a68c8b81dd1616476076ea26e7ff34b1b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 28.2MB
        • SHA256 b559902af00536446772eec2348a0116cf0c182dc3724e852e9df01838de3538
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 25.2MB
        • SHA256 03cdf1d5ace0c10c0f97282ddc8d77dca4ed844a093b47b3482f74e89e4e2028
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 28.2MB
        • SHA256 1c541ef675b4b5d2d7cb68fbf96c093b9cc3727887dc24c4d0f0ef201899077b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 27.8MB
        • SHA256 09191bd4c3de4f261c31cc3d2d3e8f91eb09b57806af93e7f0ced88bfe1fd5a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 27.6MB
        • SHA256 9ae332e5af1a3e45968e1fd66d8a532e30316374dd2e7ce300665de4b65c702f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 27.1MB
        • SHA256 89e1803498f96613f27ff68cc5ba9f601eba9405863474f85ba47ff6cd008617
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 27.2MB
        • SHA256 165d7398002c34704dcc7ad03e160a81f75f7ee635f110d0c58c4e10464bd626
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 27.0MB
        • SHA256 b7afb5ca04e09bbf226627d68fb4948f7fcdbaf6733f55d9362a267f43a704b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 26.8MB
        • SHA256 3769cf8cbfea9befd63ae2edfe69ca43d7fe961d02b3874c1f1297be84b3b232
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 27.2MB
        • SHA256 a57f9a34da30f63c01ea5a5ba8845fdc0b00099b68c54f716ec828b00cc03dfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 27.5MB
        • SHA256 9415f913b4d7dae7c0e29e370d713f33798359aeadb6c8a1a318c1774eac1a2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 26.3MB
        • SHA256 16af88ef4ece9c18ae8f1773368dc7747598bc1b933af253a8a26d5390aae831
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 22.9MB
        • SHA256 16e48c77945dc1085940d1bbf1da71f65a9024a5115b6c6f13f992bbaf93ac5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3732-43-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4032-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4032-11-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download