Overview

overview

7

Static

static

3

2026-08-10...ry.exe

windows10-2004-x64

7

2026-08-10...ry.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/08/2026, 02:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-10_b7b62e2585d56deab94b5b7c16e55b1e_amadey_cobalt-strike_elex_icedid_njrat_vidar_wannacry.exe
  • Size 725KB
  • Sample260810-cgppnas1bx
  • SHA256 1a3db39eb9535e8c5c719bfaf6e53b834c7725b95c2120ba94493d4c4ff5c501
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_b7b62e2585d56deab94b5b7c16e55b1e_amadey_cobalt-strike_elex_icedid_njrat_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_b7b62e2585d56deab94b5b7c16e55b1e_amadey_cobalt-strike_elex_icedid_njrat_vidar_wannacry.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5872
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      PID:4772
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5900
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:2940

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 1.2MB
        • SHA256 7898401e940a7383ccc4f4a4277890933f7c34e3e560953d52092c8e1853d403
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 1.6MB
        • SHA256 d4dc0b68fe27a65c1b8ca76250f10d333f37f5b0f873363bd6afeea4a3b7cee0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 1.4MB
        • SHA256 0380d19948ca91859a55d947deee2904c67b8b749be5e430c54f0103780b181a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 740KB
        • SHA256 0f8c104c2042ae6f615078e297e8824d499fa0ab96a7f77d0eb8e6857a892bf6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 6.8MB
        • SHA256 e8a5b451a02ac09dfb69ac77dd37de61a7ca3adaee9cf03dd0905d956451475e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 2.4MB
        • SHA256 8b44f393ff7495d79a5ea8ff7cf819d5022915191e4ce8fe61673f56a7028ed7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 4.2MB
        • SHA256 0ba13e9f4d129a130c7c0d5bc3aadb6892e0f91c2b86f91edeac0bea360f3e61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.0MB
        • SHA256 2d27a308ee5d25d27e3d81ddb67ce982b9e965d96ece1b12fdd6ab31038dee71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 2.6MB
        • SHA256 e9452e9a570341edb2b12e97954f7fd9ccc03743ce067c4cd002dcb41163463c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 2.1MB
        • SHA256 e94cc83bd60d0ca8c171784f674b51bc43de76affe071f81a1ee49ed04b620ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 749KB
        • SHA256 8d4aae195b1dc4287dad4d26065e03dcc7816c6e8c3d7d20e6aebf684edbac14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 749KB
        • SHA256 442b4815f20ad99f235c08d70a59d49f28f0d2374bdfc75c411fbf4c9f181a33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 749KB
        • SHA256 b0587f7d38ce3abf03e2895572051eff0ba72e107697cc9c10d5f4a74997e853
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 769KB
        • SHA256 ef1dd9bb5326bc70b333e535e578f2efefb535eedd23d4951d01212e74a740e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 749KB
        • SHA256 a8867290c183a11b363cc9e38debf496b4c25a05c9734b9929207c88bbd14530
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 749KB
        • SHA256 82d4a5d602a6b42517cb240acf96c1c65df5272d9c8b76ec99e7e10dbee4810b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 749KB
        • SHA256 f1e512b70aa178b9a445babbaf36df2a373c0e61ee205b2b63cc92518c1778fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 869KB
        • SHA256 ca8fcbe8d1f556d45f8db432b4b23f0d806c2b2ed54ecfeb873c3704a0e7c904
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 782KB
        • SHA256 350c4d6e7e836a80ef60b32bd07c2b0ec49a8939c2a51f763310826ae05af183
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 790KB
        • SHA256 006767f2486af9c524c5b5bb57103d54286887f5fae05bf340f4edd6de7062dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 786KB
        • SHA256 261b20fff7038e784051dce8f8a0fb71bb38478a73c84de794a909d1d33fe4b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 725KB
        • SHA256 1a3db39eb9535e8c5c719bfaf6e53b834c7725b95c2120ba94493d4c4ff5c501
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 725KB
        • SHA256 218f32c9f7010208ab594fe361716aa1be76955a7a9b83af353ebfbcc98a2250
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 725KB
        • SHA256 b08dfd871c1f86abc668c01858f143555f5fffc4d79a83a29a306010ce0d1085
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 725KB
        • SHA256 7b47f0901432beb03a39923f201ef1ef7b65e2eab08a0652b33f858144dae0dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 725KB
        • SHA256 015abcc327e8752bfe929e214ed02f34a36771c6da19b91322ae218e89a29703
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 725KB
        • SHA256 7a217993b3111419e1c99d21cb27ae9dc9e57c16997962afa0855deb5c1ce75b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 725KB
        • SHA256 72a78ad92d5aeaa7252eb9b5447d371b66d112b98e111ca775fb91015bc0745b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 725KB
        • SHA256 b917083c9dabb4086f35a549800504ae1dae9449bf3cea909e6d019235bdd0f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 725KB
        • SHA256 cd9ea44f7682d2680ac6f89e7eb50d27a1c732f14b0d9614e86978919b4ee8a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download