Overview

overview

8

Static

static

3

2026-08-10...ry.exe

windows10-2004-x64

8

2026-08-10...ry.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/08/2026, 17:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-10_a519c343fb58256e9afae9310c740601_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
  • Size 34.6MB
  • Sample260810-vq21fstemd
  • SHA256 6d7d3a84956b5442560a92b8bb3456fe45d60034f563f9e1d77a5142c4f339d7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_a519c343fb58256e9afae9310c740601_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_a519c343fb58256e9afae9310c740601_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3552
  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_a519c343fb58256e9afae9310c740601_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-10_a519c343fb58256e9afae9310c740601_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3888

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 35.3MB
        • SHA256 4f9f262300aaa509ffb6b4c221c0e8c000f7418c3a18eb913f07108c0f3ff2c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 34.6MB
        • SHA256 e9287ba5676cd3649ee9445f880c845527b572fb4b40be1065602cde57f3991f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 34.8MB
        • SHA256 1fcc348486d178b53cc4c176c2f3dbcca8aaed5156b7e6010c479017b5dadee6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 35.1MB
        • SHA256 881e78a365a4b32af5b04fb1cb1ad05290fff4cf50073e48052a082ecf271acb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javaws.exe
        • Size 35.1MB
        • SHA256 bbd79066b08a863116d44b3a0569552637f41cc7ad0f0a65928dbd60aa769a89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
        • Size 69.3MB
        • SHA256 39e6da0947161448f8deae9196881cb3ab9d9390e820e8332f73ef78b0af5827
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jre-1.8\bin\keytool.exe
        • Size 69.2MB
        • SHA256 068642bd5d15574b0b8500b67f45d59e7e1552a3d0669a3c5294a180b996cccf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jre-1.8\bin\klist.exe
        • Size 69.2MB
        • SHA256 77ba5681fb0faddcc6d1d066a5e3697980ad279eebfc042b009e4d2a4b63345a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jre-1.8\bin\orbd.exe
        • Size 69.2MB
        • SHA256 24e29f453dfb01b27f71b3984a2bae1e52b0dd903c62c9b11699bfd410f9aeb9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jre-1.8\bin\pack200.exe
        • Size 69.2MB
        • SHA256 a8d530ee8fba62bdf8c3e211a9920df5ab8cfa4c64f718046cafff5bdeb6b746
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jre-1.8\bin\policytool.exe
        • Size 69.2MB
        • SHA256 41125c2142ba6924674dab06c605b4fbd75caf980b4c18de91871968f971a666
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jre-1.8\bin\rmid.exe
        • Size 69.2MB
        • SHA256 76103818ff03b62eea7e40a596d7a20da023a50dbaf9f073d524e1c8a37de50d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe
        • Size 69.2MB
        • SHA256 ac666b80f14073f1f8dd1ee456a2f0f0a4b267330863981838af0964c94e853a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jre-1.8\bin\tnameserv.exe
        • Size 69.2MB
        • SHA256 8acbefafd6998ec70a323220eeb916c81bd6c205cc7f2f43ab321cfdacaac83a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jre-1.8\bin\unpack200.exe
        • Size 69.4MB
        • SHA256 2c5d23b455f35be067f662c6e71810dcbda9b1d4dae5d9faa37b67da6d5e7dae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fontconfig.properties.src
        • Path C:\Program Files\Java\jre-1.8\lib\fontconfig.properties.src
        • Size 69.2MB
        • SHA256 a8c26e063b842a5008527727cce08cc79f204bee7e157a2e0b61e02ed0d21c56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVDllSurrogate32.exe
        • Path C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe
        • Size 69.4MB
        • SHA256 90cce4b2dc47f61ff810c2713d170223d34ce5d40a577066a21310b57fda84fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVDllSurrogate64.exe
        • Path C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe
        • Size 69.4MB
        • SHA256 a12d866b47f22874383c5f98be7a01d837ad0eb75a6dccf0a7f83418bec745d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Integrator.exe
        • Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe
        • Size 75.8MB
        • SHA256 9aed61be6dca2b7c9966b9b7f1aa07ed56e3d2cab89d7efdddddda81d059054c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Mashup.Container.Loader.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe
        • Size 69.3MB
        • SHA256 391dfce021a4d4a3169bf7fbcef8f2cf782fb474896e3a20c9b2723135d15997
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Mashup.Container.NetFX40.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe
        • Size 69.2MB
        • SHA256 15f9e822efbfd653556b246e07bf64316f087825f13d6f26905a23abd2f569be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Mashup.Container.NetFX45.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe
        • Size 69.2MB
        • SHA256 f591fdb227914a6f30c950eac0a1bd2bf6097f95ba8e2b44fd33d7220e871f0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Mashup.Container.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe
        • Size 69.2MB
        • SHA256 08509f68d336e23949d8250d363e34d078f11e0d2f122861d8e468a2cb9f087d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IEContentService.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe
        • Size 51.6MB
        • SHA256 0211e571c531f538d097f2e0a8c7cb4973f6a99aafda89966dfa426f29651c83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        misc.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\misc.exe
        • Size 26.6MB
        • SHA256 74df2c78bc4844cd94a9ca76e4d33e81b0c634459e187d45dab0b1bc970852b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoadfsb.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe
        • Size 25.1MB
        • SHA256 24a04b0075ddd80d7f5334c752cd9b453284e97a1fe68bb1f8e42af75c2930cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoev.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\msoev.exe
        • Size 19.3MB
        • SHA256 09b8a3b901c68abe262160d67062d0a66f526f567fc27eba7563dd9f0082d182
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoia.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\msoia.exe
        • Size 6.8MB
        • SHA256 464d40972fa09ec9bd3cfd7f2df0753ca61a904a272b4c156e6829203645317c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 34.6MB
        • SHA256 6d7d3a84956b5442560a92b8bb3456fe45d60034f563f9e1d77a5142c4f339d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3552-4-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3552-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3888-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download