Analysis

  • max time kernel
    149s
  • max time network
    136s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 02:53

General

  • Target
    2026-08-08_b42d3c81bf3d79ec1e28aa6b267b0d99_amadey_cobalt-strike_elex_emotet_icedid_remcos_vidar_wannacry.exe
  • Size 6.2MB
  • Sample260808-ddqcfsbc95
  • SHA256 3893232ab7dd02a28be67437df4a096822a22c19a3a265faa2346f7f5b844085
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Control Panel 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b42d3c81bf3d79ec1e28aa6b267b0d99_amadey_cobalt-strike_elex_emotet_icedid_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_b42d3c81bf3d79ec1e28aa6b267b0d99_amadey_cobalt-strike_elex_emotet_icedid_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3200
  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_b42d3c81bf3d79ec1e28aa6b267b0d99_amadey_cobalt-strike_elex_emotet_icedid_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-08_b42d3c81bf3d79ec1e28aa6b267b0d99_amadey_cobalt-strike_elex_emotet_icedid_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2232

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 6.5MB
        • SHA256 e6a239179b3969112d58b769391d69b1d02c16e0f607721fd847832890f69a60
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InspectorOfficeGadget.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 12.5MB
        • SHA256 a79603020a25b25d31746f6d3931148ff49eddf286a89b3007661345f8afc6c5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IntegratedOffice.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 16.5MB
        • SHA256 85cf3136693a253b08b3cf3da6eefafb90b98cd9b572489d42030bccce85bb31
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MavInject32.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 12.8MB
        • SHA256 ab6fe59bf699987d221d19ae8fe84f0bf71f7c171f5bfee5c6d87c173e8f1d74
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OfficeC2RClient.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 29.7MB
        • SHA256 c1585df5ec1b4875fe2987d7aad40ff1c2cc226ba745ff4f5797bdc9b4e6a2c3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appvcleaner.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 8.3MB
        • SHA256 c576d33655f814b01385172e45c7970c07b2316632051df168f8ce0de56ea745
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VSTOInstaller.exe

        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 12.5MB
        • SHA256 93d1aadddfe808eace339a4279534054e997cb4a2a7bc1585229c8a88b34c411
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrmstp.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 18.5MB
        • SHA256 e10732b3b6226ed916130d68641aff70cf691c78abd7fb678e5f82f62ff00211
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_pwa_launcher.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 7.9MB
        • SHA256 d83d5c80916801dab47335ba669b0d21d9ebdd8f96284b4017e6b119ba5bb46c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevated_tracing_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 15.9MB
        • SHA256 b54ced009d87c203b7439be545ee661e8281e4069ba1b2cb6655057c3b63dd19
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevation_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 14.7MB
        • SHA256 a1758c52c3038b20be2be7f1f4013f92c4f2aeb229937fddf152f456351928cb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notification_helper.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 14.0MB
        • SHA256 0b443a6f35fab288bda52bd1d5ede17a801e84aae7ad4d8377a483890a2b68ca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        os_update_handler.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 14.3MB
        • SHA256 b917f13cffc5d028949d11b62883b1bd326289b997f46d6009e3e6b61e7b0722
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 15.5MB
        • SHA256 cdb27100292d725b069b69f97f37bd92c12eaf6f1deeb0ec1314e7dbb3b46d42
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_proxy.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 13.8MB
        • SHA256 31e7fee366b69ad52861e526c64cf2f4bfc77a627cb06cf459ea6d7e4cd53024
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appletviewer.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 12.4MB
        • SHA256 63d231aa89a14fcdc4c696d4c537bd9551b88be288bb77c76a69f440bb49bcc3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        extcheck.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 12.4MB
        • SHA256 8153176f139213bcbdb25cc0c26370421bfcba9a1ce2975934bdccce9194a830
        • MD5 SHA1 SHA512 SSDEEP TLSH

        idlj.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 12.4MB
        • SHA256 f6e12e660437b6d81f19ffaf553fd86020bb5710ddb5a6567af6a47f390002ed
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jabswitch.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 12.5MB
        • SHA256 29e537d7ad049bcd44ade0cc0caf36e8c2a856e2156b8fd923cdac2635802c41
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jar.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 12.4MB
        • SHA256 f5f02aaf884b54af81a53bbecda48229910fc5ff56b80b3437a485fda1d2a8ce
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jarsigner.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 12.4MB
        • SHA256 0a2993eb492ac9e20c12f60dcf7b50ff724abc001ef6596feb4bf2e96ff2abba
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java-rmi.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 12.4MB
        • SHA256 6f71886143a0067827a75190036ff775b9f751bd49ca8876f225c22ad7846555
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 12.7MB
        • SHA256 dfba803ac25ce5f42a4d520f7524961fdab747de73f5b57d89264fa4d4a066d8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javac.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 12.4MB
        • SHA256 0f734024077f39d779bb9b4b6b8033548c95f7fd283d10052a76e4ba60617341
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javadoc.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 12.4MB
        • SHA256 a693e3fe34469c268a55b541bca83c15ab140fb0582ea9756fced126fae75119
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javafxpackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 12.6MB
        • SHA256 ea5b3e16932ac92fadb3e4aaebea40bde70913bd9d73c3c0d6ebed76a7c7ad21
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javah.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 12.4MB
        • SHA256 91b43bfb8d77b0635e5dd14f932c207a00844732ad8bfd330466c0c2f8892659
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 12.4MB
        • SHA256 6f3c148f5ab4362e3593b8d8f1130ab690881b2a0e52e95cd3d53906e9d8e1eb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javapackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 12.6MB
        • SHA256 5a263fa0d6630bd33f5d6ea19650cb6465789999a988d3bf108f74475ec5da19
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaw.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 12.7MB
        • SHA256 e5f232fc07277eb6d0c8d414c986e39c7192d9cb8a708de650a2a03ca449ecb9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaws.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 12.9MB
        • SHA256 4135c360a31eff4e224741d62efa697d82d7c735461785a27d5b82aa1492ac83
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jcmd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 12.4MB
        • SHA256 3ee5d65c7cd0720427e76302999846fd005966912452e552b0c9440ef89511af
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jconsole.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 12.4MB
        • SHA256 c53927a0fcec5b52fdd9bc00237b93adc5901ea2d4ac07ccea806a395e609452
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdb.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 12.4MB
        • SHA256 41c2c56133ef32c3a110a126541edbc66fe1c6499539a83b3ab117f51a032708
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdeps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 12.4MB
        • SHA256 c4a7945123f131031e1f8292e24bada749ed569191f437a3d386d4ff99ddf2ee
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jhat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 12.4MB
        • SHA256 6bbe16e29526d6ae2cb01e69bd88900f0aa805f8483bfa637840858f4e671de8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jinfo.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 12.4MB
        • SHA256 634cd990f94dea11c8a5ac03bdabcf51e6daf3694f8b1935f3814758e53b3c4c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jjs.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 12.4MB
        • SHA256 e4d4801e3805cc23ebc3527634dfc03abd19758576f4f896414251866b27515d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jmap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 12.4MB
        • SHA256 9be6ba485b2374fe14539bc8d6de57e02f0786e02bf716ec64a9a73b71fdaba4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 12.4MB
        • SHA256 96586edc296ad01a3e52da88165646905be7fb01a2a0db1dfed93f2da11ff1f8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jrunscript.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 12.4MB
        • SHA256 4fbb16b76639c8e105298b2bcffd17844d34f359be274f6afdd0de43fd0cb9aa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jsadebugd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 12.4MB
        • SHA256 0ab26b231bdcb1b9a35460252aa4affb0cb96283b4637dd503f410e7e28e14d3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstack.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 12.4MB
        • SHA256 37eb4853aa7b1aca0dac33274b73d46914e2a789c72fce83a7fecdc67b22458d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 12.4MB
        • SHA256 7f6e48079166f963d613c271b78bbefb9482b235203441bee78acf6597812c29
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstatd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 12.4MB
        • SHA256 7a35f450cefcf3073f37dc66f148e2c456f92b9575eae4aea717570e02b6d1d6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 12.4MB
        • SHA256 8fe0e7d3fda90db99115634e895ff6bf0078a5f8428f1223fb8bcbc6241d1c93
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kinit.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 12.4MB
        • SHA256 9dc17200e9d693fdda0f3683bce4e625b719f1033c430f5fa0275d33980dd66f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        klist.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 12.4MB
        • SHA256 c0f61dee16a64720119fe110ad5936f0fd363420afaebd36bd376d10bf589f31
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ktab.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 12.4MB
        • SHA256 e5d7d4778b424d4a882cb4b9d421eda722dbbac687591ab938062e2ce86bcb14
        • MD5 SHA1 SHA512 SSDEEP TLSH

        native2ascii.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 12.4MB
        • SHA256 9aeec8f50eb80209d05f3952e8bed26787bb006e7aa6ac6f50a68a5cf79a2687
        • MD5 SHA1 SHA512 SSDEEP TLSH

        orbd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 12.4MB
        • SHA256 7c18ba2ac1865d12b035b5c0c9f0218a1f009f1d0b44a19fbd28f460943f9e33
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pack200.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 12.4MB
        • SHA256 e83ee1c803e01fe890478e7dc0f79e173f64c9075d0bc4e5f46434474b81c525
        • MD5 SHA1 SHA512 SSDEEP TLSH

        policytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 12.4MB
        • SHA256 141668395ae399e00789a0515e3aafdf6c00b9d625d027b8b8542d1654624c01
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmic.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 12.4MB
        • SHA256 15dfd7dbdf9506731c55227c3af1e1f10fe998355bcc1df53a28b01b2f54b8ae
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmid.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 12.4MB
        • SHA256 3fa0337633c9092b3757ecc478785b86b9b71ffdec162354e45ed249b8f0c566
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmiregistry.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 12.4MB
        • SHA256 31f9135d644d7e385b236341378f35492c03eed9b749f9f429534220952d9ad0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        schemagen.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 12.4MB
        • SHA256 7c486d04b5b29fa8cced5ce531417fe78c8cde572fa012a8f06fbebed9fd381f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        serialver.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 12.4MB
        • SHA256 966acb91d7597a2a3c825efa799800441bdbbe2b772e745b75ccf89c2ed32183
        • MD5 SHA1 SHA512 SSDEEP TLSH

        servertool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 12.4MB
        • SHA256 67b2c2f321f9ba25d7ecad3a7a12b861a7f967cbb173662fe974c05398739c64
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dotnet.exe

        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 12.6MB
        • SHA256 5d73acc582b29194fca6172b4c25eb7ef86186a0f539d2e72972367f7c4d0d0c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 12.5MB
        • SHA256 940932a627fe9a62eeca4ccb58d2cac8bad8d978ff9caf648c077e34e36db074
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 12.5MB
        • SHA256 d87bb1b54c2019f71f75deeba69b4f231369917ac0d34d2a7dd8f0bca1951643
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 12.5MB
        • SHA256 3d85b99c6b37343bda4a11dafed929c076e5457ac32d6ccd0f341e4399e887f4
        • MD5 SHA1 SHA512 SSDEEP TLSH