Overview

overview

8

Static

static

3

2026-08-10...ry.exe

windows10-2004-x64

8

2026-08-10...ry.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    151s
  • max time network
    157s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/08/2026, 16:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-10_c665121fad4ad4468349a4473a098515_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
  • Size 34.6MB
  • Sample260810-tk28laxzbs
  • SHA256 da0eea672830b6661f7e3403d5e82d7f5905113196cc18ccd71356b85a022e05
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_c665121fad4ad4468349a4473a098515_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_c665121fad4ad4468349a4473a098515_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2364
  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_c665121fad4ad4468349a4473a098515_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-10_c665121fad4ad4468349a4473a098515_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3952

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 34.6MB
        • SHA256 2f767c943a1749df3f0653e1ff0d1dfc92abc5529da52c4c88b6c8dc4cd2ac05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 73.3MB
        • SHA256 c38ef7bc236dabb4c4978adcdd8bf78c82f99d9652cf7d8941c84ed54f0a36a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 69.5MB
        • SHA256 c185df6fbdacc639ccb7e2d443f750830a2185cd605a66b8962220496025b840
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 36.7MB
        • SHA256 3c6cc8dcd77478b8c99e17f3ca961f1a610b5ccf455c2577a102db6dd4c55abd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 69.3MB
        • SHA256 1a9fe4ca25129c5fcb5687be8106ba80eeb7e3e8905c5b9a70824053f4a4bf16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 75.3MB
        • SHA256 7645cce6d9ad371f0f504e891b01831656146da7889d879db2947a25a5309162
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 70.9MB
        • SHA256 154f4fdf9bb9f8587d75bd8b3865c1d6bfe080b6e9f9713dac91e647b4feff69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 896KB
        • SHA256 f5bb4bfb4b0f875d7e231e9c71f261092a472b660edd0ca6aaeba00742b49565
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 71.5MB
        • SHA256 95658fc81af3b9a9fd79a8c6eaed6225bfad80bea768bc4f3fff6a6265647772
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 70.8MB
        • SHA256 bc7e125596589fb10a63bb0c63e770c3eabce7f9819838419165263fc6492deb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 71.0MB
        • SHA256 312f31a8828aedc798bef7338a606d8ee62db6742d84bb342331df97e2a1560d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 69.2MB
        • SHA256 99f2ae31eeadd9ad361a0d68610024d0dd255733761144d4131bf9925533a761
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 69.2MB
        • SHA256 defe21678d4bf7e8515ff2e79aa22d168e9a51764677a10785acea571bd7b7d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 69.2MB
        • SHA256 98f602203cf057cfe7df82a7881110f4571183330dd5e11b3afeda494918eaaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 69.2MB
        • SHA256 5652a6cfdf5fd959ae91298b12121dab7a980100efaba4e4e2e295ca89244417
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 69.5MB
        • SHA256 fecbb7de40e0a68ab1b00022497b7c20d70f64307293e41ee0000020ff9a4809
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 69.2MB
        • SHA256 e8ad0a07f78e4ff35691ce28c3053e984f0f94fc24d1e2a1bc3924004bc10236
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 69.2MB
        • SHA256 6d993746213b88336841f1fee5e697ea8e604c4c32b3a08de63648e5d0301da0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 69.4MB
        • SHA256 c329657d2a53cb5ee7a800d732399d5146ebae5ef77923995c080d05d723ca2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 69.2MB
        • SHA256 2f229da1d34dd43ad7b831de2e2ad98983fb51c5769bd4488e76650b6b11b192
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 960KB
        • SHA256 e06b59500ce9e383ee9c96ab13eadbceb686d601eef8b9058024805329a79ed4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 69.2MB
        • SHA256 80c732babb8dde7c7494e23bc54499957b1b072d0f8c2f18a8446b3e0cd40a8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 69.2MB
        • SHA256 8aeeb26070774275fd3978fa246cf166ba8c35a3e76b8fa2de8632d13a837552
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 832KB
        • SHA256 537b71956121b63b96188d49c7b84db6e563b66c7e596e2d275c006bb7424168
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 69.2MB
        • SHA256 6e32bba37e70cab28070afb085ddb06a99a7fecdc9b7a2ed454bdfa18c8aebbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 69.2MB
        • SHA256 4fb0dd0adeeb8240976918f3c3a319c6c65704768554d8e9405967be614d6ae2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 69.2MB
        • SHA256 bd09696b34ab164ae599d0233fd57cd161f23687c011cc84e31f04f8629e34d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 69.2MB
        • SHA256 98069d8600d3171c675c53f465aad60751a2d1baf420355d049007a50e275ae4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 69.2MB
        • SHA256 8e31217d8a2bee9039bbd8cb7d75193b46492591ef8995832b2e3bc4962ea827
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 68.8MB
        • SHA256 5b834eac07f89b00f52b188bd18079d22d007461a710829bfe5a7145ca716699
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 69.3MB
        • SHA256 91a22a7f3a01e1c55f0f742f536d8b4a4a56c882fa492d7b29d227bee8bff3b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 69.3MB
        • SHA256 c772af5dc2b38afc19b726b0d364aad51d53c315a38c82fbbc69b37a3bb6df9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 69.3MB
        • SHA256 35cf9acfd1d1501cc10d89c2c64d221b554a5a760ceeed0f74400bbee6b1d98e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 69.3MB
        • SHA256 14dd1e6f8437a3e66cdb224e683b4e6bb516491950ee18f8203e2c8fda9a8a41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2364-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2364-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3952-14-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download