Overview

overview

8

Static

static

3

2026-08-10...ry.exe

windows10-2004-x64

8

2026-08-10...ry.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    64s
  • max time network
    144s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/08/2026, 17:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-10_a519c343fb58256e9afae9310c740601_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
  • Size 34.6MB
  • Sample260810-vq21fstemd
  • SHA256 6d7d3a84956b5442560a92b8bb3456fe45d60034f563f9e1d77a5142c4f339d7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_a519c343fb58256e9afae9310c740601_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_a519c343fb58256e9afae9310c740601_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1660
  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_a519c343fb58256e9afae9310c740601_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-10_a519c343fb58256e9afae9310c740601_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1848

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 34.9MB
        • SHA256 808263ef613e28d6e854566c5c281fa36a2462b8f8a78f960cfab841d0d53a6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 34.6MB
        • SHA256 000094c13eb51b6b1d34d4293c1b18dd55907dbad4d13d73b2e689f83c21e948
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 38.7MB
        • SHA256 97d8ac3be5c443b23e781a03e4dc4046880949bbf4ae4b87f477032d4e42fa6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 69.6MB
        • SHA256 72ceabca271178dd4e708f6a8ac8a3027f83ffc189da0ae8955a09ea0fcb165f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 36.7MB
        • SHA256 088592c2f81041524a5faa6056143c1ad86ba45b0c9eeefc611c37527419681c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 69.3MB
        • SHA256 8518258980ad4f62eae82211359b31c24b721d2aa142c0ae876cdf79a5afef21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 68.0MB
        • SHA256 4f61b365e245785722bdca146358e8917bdf73454ad67d3a5f4cca067d6a6292
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 67.9MB
        • SHA256 ee5d4000422e0add2f756d79d094034e9e94f2d33947c2481d15b8a0d3a9b875
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 70.9MB
        • SHA256 2927fd64d36f4bec0de2c58defa18cf3d9e7d8fa5fd5551e5484354def889340
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 72.7MB
        • SHA256 59531225c519ba58782c069ee59bc65763031095d567e1a2543680aa7fe290b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 34.6MB
        • SHA256 6d7d3a84956b5442560a92b8bb3456fe45d60034f563f9e1d77a5142c4f339d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 66.1MB
        • SHA256 c73f5ec55636bd83c0d119ed6817338c358b62f4f8176aae73456559b5a09d77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 64.9MB
        • SHA256 90f1a4a9d6ad879ca1ebbd93dcb6d457e732b1bf568bba221a4bd1faf71b989d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 64.8MB
        • SHA256 f29f8b0a5b2c9c9dbc8b97d34dc6cac351800f8d97c004f783940b9cd8277c23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 63.6MB
        • SHA256 e65a6469161c0e29a4ba904ee99ca16e06fbb81a24189a6249fbd416b08523d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 63.1MB
        • SHA256 73a4e2caa0d5e05b9933cc72d0174504b4053cf946774d1e18451abf5cefd8f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 62.9MB
        • SHA256 aabc1c5bf48f5c8e32a8aefe5bb4d0b9ba88e814d916aee8344c0dd546ca4455
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 61.2MB
        • SHA256 cea3f56985bdd404d1122683f7a27f4f1eec1e90a36c86d6c2a7003762ae30c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 34.6MB
        • SHA256 0c81668cfaa49cb303456e492f0d22363094b7710e5c1123a6a03446a73ebc7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 61.1MB
        • SHA256 acb312db23f54e51d8ac29153dbe4b981544b1ce493ae605c4cd9a1f6aa43e95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 59.2MB
        • SHA256 c686d805033bf13a94e729bc067a648c2576e3c10cce6ba4af7bb15a0106adc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 57.9MB
        • SHA256 f1ae4dcdbff08b5c2ab0f004656e3ca7e4c19df85b17620e5153bbfd8089b04b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 320KB
        • SHA256 21e9dd8769a39db9165211e397543c288db6cfea67fb378fdcbfa803d9a215f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 55.7MB
        • SHA256 43f0908cafd1cae3ab559785f58a56abf4df374912470061ed52b45389edf3c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 53.8MB
        • SHA256 887fdc961591d96c800a9b21af6946bb003d463c5d5583c7539d69547e59cb57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 52.4MB
        • SHA256 1b46d5192cac414a84b833223357e280b6d281df416cbdf0ed3ca514cd614cfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 50.3MB
        • SHA256 e3976560d333d104e30fc8b46b891bbbf77d46429b654ae2ba8471e6c6e1ac47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 48.4MB
        • SHA256 70754bd63268f8c6f7ba66ce27b631cbd793e05a50ee19c5c810ce5c4e9db43d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 47.1MB
        • SHA256 4b0cb1a050371bff548ed2226aeb3d6ef71d3308731755b128f197bbac8f03e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 46.4MB
        • SHA256 d4d159cfd49f23c66d36e37ef61007d1415fd61913fd05e726868b54a7293a8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 45.8MB
        • SHA256 9c63719fd983defffdbdead25ad6fd56187d8efb7f10489814ffe0fcbe731549
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 43.1MB
        • SHA256 4bf6a0e173db877e6b5f617df2b1e1a75749a344a13a80b5fa76c5adaa07a7dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 42.1MB
        • SHA256 032921e40979a6383a2fa9af157f1893f032e8fa91efcbde56bd7b6c2c742314
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 40.9MB
        • SHA256 26954f25bcbe8f2a6872d8274b155261db22b9b39ac4cb91f8a327ece95ef615
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 39.5MB
        • SHA256 4a2a441e9ba05c3464cc0c0b19cdfbf4c0057666b1f9ba0485a6b9c0c2000232
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 39.1MB
        • SHA256 c9a9392bc576d2b23b9f84eac9244e149bdc0e8ff56dfa9d5590b4640e447908
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 38.5MB
        • SHA256 8e98145ac7a8f16b5700d54d51993e887bde3f9f8814939ed9cf5f9747d0b625
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 35.9MB
        • SHA256 70809bebb0100440823a49af2a09a88def4d3708384758423b00dd8cbc0de4b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 34.4MB
        • SHA256 9158c9efd8d4850b7a7a530bf6d2dfb01a06242176d80f04de19c22e8062dcf7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 69.3MB
        • SHA256 829d6f34dfd6a128d876819463bb760cb2023a6dd08cb314f1417383b96ba124
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 69.3MB
        • SHA256 3c26dce219e2ef6fd1ec7c5fe705d306b74f5fd2a040d652c8def04d855d7fea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 69.3MB
        • SHA256 1fec42883a784fbb3a2bfb1eae132c8348ed48f323225c6e56edf956f75af3f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 69.3MB
        • SHA256 b68aa2ce40eaf54624ad0d6e8abed0052adbf3de803331b805d281731d69edf1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1660-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/1660-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/1848-19-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download