Overview

overview

8

Static

static

3

2026-08-10...ry.exe

windows10-2004-x64

8

2026-08-10...ry.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    106s
  • max time network
    155s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/08/2026, 16:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-10_ecaa4c67d7779c41cd8f123234f7be21_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
  • Size 34.6MB
  • Sample260810-tgzcjasdph
  • SHA256 05dcfdcb26a85d83ec9248b2d262ea9d17c15e9e3561570cf2e6c1fb40bd1834
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_ecaa4c67d7779c41cd8f123234f7be21_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_ecaa4c67d7779c41cd8f123234f7be21_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4608
  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_ecaa4c67d7779c41cd8f123234f7be21_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-10_ecaa4c67d7779c41cd8f123234f7be21_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5604

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 34.6MB
        • SHA256 05dcfdcb26a85d83ec9248b2d262ea9d17c15e9e3561570cf2e6c1fb40bd1834
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 69.2MB
        • SHA256 02bef6dbe02d794495c794989502fe284acee2f21e0f339c904702a4b1525ea8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 73.3MB
        • SHA256 4a184402f3ed11893388e41b6fb3a9e84094e1d2b91fdc9cf9587301e768d2f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 34.9MB
        • SHA256 a9ff3b8a0c927c3ddfbbd39c9a7990a5ee1dc412e021493c9768ede2bcddc45a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 58.1MB
        • SHA256 7086138738d64d7e935031f22882642918a90af2c22fd12701cc207d56b15ddd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 36.7MB
        • SHA256 7a33dea884e0b6f48f8ea291d310a35cf8d4432f34861b25e2c12e875bb10c32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 69.3MB
        • SHA256 87efaa2670b500c79d6ced3a07b677980d24ca30d3ab5afaeca28eceb35c14c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 75.2MB
        • SHA256 d56e2bf14eb61d8f329116a84821f8eea854c2b48a0eb616059210cb84568f53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 70.9MB
        • SHA256 4fc645961bc6659ff0720a20c9740ede09c3c3e613f045f4f077c2c5dad65d6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 72.6MB
        • SHA256 ab148c2da8c02823e1cd89e6ce1480c957b4ec773de37781910ba117ff5d89e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 70.8MB
        • SHA256 7926ec35281b2c1c58249186043a5b6e730d623d627f55b66cc1bad30427d89e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 71.0MB
        • SHA256 9ad330606cfb1f004067f596631ba85640f9d554d368125dac756adb0ac12eb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 72.2MB
        • SHA256 508e43d45f8bb93928bdc2144404f8fdd5c6d25a9850919a9e796064e3242d50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 36.0MB
        • SHA256 a86c627d53d8a50b1cc235d84dfc592082c7fa591fcc06e22e2ddc594b44cb0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 45.2MB
        • SHA256 842527333d4d64c85ddcb2edc408cd31dfd8d08c66485bb7ae7b63ad983d7035
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 44.7MB
        • SHA256 a2d87b7e4561798544e04d62bf57b0f9743051e754c27dc7ae6821551abaf726
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 32.2MB
        • SHA256 c7ed3119da68be078d07bcad9d02b8161ee22281ac681d83982e0e05967be5ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 31.4MB
        • SHA256 eaf751180a7ea301514b1e412cb14a14812ee8bb29c2c75e541d2c69ae6f43a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 31.1MB
        • SHA256 21dee7c81dd1a7b597c0594edce47c49643e0cd87e2bfbc0efd70e177d8cfa16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 29.4MB
        • SHA256 ea2810a242385813350bbff23d615c4e2e5589bfb55853badc9fcb0beb08f2d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 28.1MB
        • SHA256 290d2580e31e20b00760b2a2fd5ce3fbdaa013753d9076c4108510a34e1db553
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 28.4MB
        • SHA256 ad7578f973cf8de7e0e0c4ccbfb2308ea635960289640acbd3f245f3a1eb46bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 27.9MB
        • SHA256 4070bf70ec896636dd24c202569a29b8e6d971973bc1941831e023f0cf4fb5e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 26.6MB
        • SHA256 2ecd384dd1c9cfb04990af7f8403a1e38598d6c596d1b6f13d63e44590830f80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 26.2MB
        • SHA256 9af123504313996b763791d1efdca9f641d97b95eb0fd99f35c767610aec2b96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 26.3MB
        • SHA256 99f0ad881500cf2921793afa912bf4c3f41c7b58f8092f5007150373653f3d75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 25.5MB
        • SHA256 2c88f6805c169cccae5a08adbbb6d5c1a01f4af9f8c0745c9050d38ffb78a80c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 24.9MB
        • SHA256 442e9aaf1d8e94054f8427bb2feeefc6290349374fb2c021e9548274396b8330
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 24.5MB
        • SHA256 37b6296d2152f2624aabf4f17f1a3c78ccde3f9de77fe8872fbcd12d09ee1404
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 22.9MB
        • SHA256 47783091e6c0f479c757692a390e0c527d940511b74a46e39dcfdfd10222835e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 23.1MB
        • SHA256 dcf3087600e63a22e04c610a06962150ec3fcd4fa13c6a263118346e03cb894f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 22.6MB
        • SHA256 9c9ebc48c75e1324955e7e33cfd6ab24119cd95586b9c8a9542674899ebdcc0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 22.3MB
        • SHA256 d5c472b88ba4b0965831edca143dc00190fe6dfccb1e565573feaadfcebd1fbc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 21.9MB
        • SHA256 ed84ca2f105e0aa4896746359fd33b6d43e66172ec6bdf4be2c20647762a24fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 20.0MB
        • SHA256 1b58ed3bdbd0da309c3f53c5f751668b48c47c260a63d192554fd2dd25b966b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 19.7MB
        • SHA256 1fc6c0d20599f12d3795c3ca8f14959eb5ce714c00137a73907ea23c8b285513
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 18.4MB
        • SHA256 2a4c4d0600632b1134b540976bedfdd1b800f8f6930a202eb9640c372ac82163
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 16.2MB
        • SHA256 b46399e31f632d3f453dbae43df8a41e618b8fa374bb2bd6ba78fdaa69c09801
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 13.8MB
        • SHA256 35d222fe081a90325a0e40070315e4c399c7c23e9673d2d35adc4dc8cc21228b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 12.6MB
        • SHA256 97e029e8feb96b623bce1788c89115c27a4eeade7db864c6566c304134990875
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 12.4MB
        • SHA256 47248021e17b2eb5526ea48d538285036eb806e99f275461c88986d7d6761a9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 12.2MB
        • SHA256 eed2e975f8f01599b896e1a4f45ec2203f38d61d76cfc401208fa182cde4203a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 69.3MB
        • SHA256 f9877d75cd31028ea4d93141b2899669d1d868edd3236ec5a3bf4cb92eaee47c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 69.2MB
        • SHA256 c0373309c8eacdff8561175f014c9239c093c65ca271129174560a293458dafd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 69.2MB
        • SHA256 bfdb723890568487ae5d0ea7663c70635461bd6cbf66bc4198312a34da2356a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 69.2MB
        • SHA256 c47c82fc1244afee001f63f501eed4f3511b0ac74cdb5ceb5b7b83f956baccb9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4608-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4608-20-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5604-32-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download