Overview

overview

8

Static

static

3

2026-08-11...ry.exe

windows10-2004-x64

8

2026-08-11...ry.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    11/08/2026, 22:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-11_d909a7fac67cd8d613bc49034c0ab3e0_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
  • Size 18.4MB
  • Sample260811-13mn7aztev
  • SHA256 4962ce5bc55cd1ffe926944425369837d2f05a97c14167ce9aeb5b85529049a6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-11_d909a7fac67cd8d613bc49034c0ab3e0_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-11_d909a7fac67cd8d613bc49034c0ab3e0_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:724
  • C:\Users\Admin\AppData\Local\Temp\2026-08-11_d909a7fac67cd8d613bc49034c0ab3e0_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-11_d909a7fac67cd8d613bc49034c0ab3e0_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3836

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 19.1MB
        • SHA256 2ae2a9066ad80d4801f8b9033cdc3f1803f3f4b6449d93b4361237dc40bd0abc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 18.5MB
        • SHA256 91f3f3adf1fa661310d129684b40ca0f490454d1fa2d70a9817e4994f1239e61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 19.9MB
        • SHA256 cf458cbb5f6ee5c855f83c7efe2e6dca96160b16878e69248fc48f211a7118b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 17.9MB
        • SHA256 f3ba990d4441ab1bd3d370bb3d4b987e557b8f7958b47b2a68cb4eccb6964d38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 18.2MB
        • SHA256 0bbd0bfb400eb2db096e608aeb0b66df355a50639fd635c15a8110e9c6ccadf4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 16.4MB
        • SHA256 8bde20316b11b36c2cac141f1685239f8f80ce4730d42ff0673bdc21433e784d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 17.2MB
        • SHA256 4298e3762bfceef91ba8e5722d611109f1151fcb2f1cbd421fcbf6d119477935
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 14.9MB
        • SHA256 3ceb50a849602883c718f88e01a617f5b5cba64cb1115faf1a5aede521a33bec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 15.6MB
        • SHA256 795058efcd892a6979a3eb818873b6a144f118371d2eff743621de7b5877a5ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 15.2MB
        • SHA256 7d9ba9c564c71b91cfe318745a2fb582e1951940791b77b41500872f2c6b641b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 16.4MB
        • SHA256 bb19233e441e4e2868a1c5c8d4f299a5bc6cffcaab8905426ac97f0d0eee770d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 14.4MB
        • SHA256 75e2228262621fcf6f2d69f5c4a4a5d25120794e9ef48553a1fcca854d90bac4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 14.0MB
        • SHA256 e3e47048f2f8e4bd691c317fbf3b1225e8b87dffcabae07428849e5b9b26f258
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 16.1MB
        • SHA256 ba031f8cdea5ff1ed023dfbec0e92e2d9a222eb71071e60e26e7357fc28c0311
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 14.2MB
        • SHA256 eb538ac6ce22f1d0c1fed9b7d40f5b816fcd27f96f761f620794ba8ea527e3a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 16.0MB
        • SHA256 d235c1d9270871bb06d39bc984bb4109b1f8ccaac3c90472345dcc4382e0ac1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 15.3MB
        • SHA256 2564dd167e195549ce3721fe65d68596daa8fe57e70873fa7ddd268ba4d5c7c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 15.1MB
        • SHA256 d003ad90dc7d9bce69af89cbd67962f32641876258ea1f6c6733214421b8a953
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 15.0MB
        • SHA256 39ac18558ea55e6d6fc7d64683ed9799a662ace03d51743df0f6cea0c61379e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 15.1MB
        • SHA256 3767ad0ff9ba6840f15cd99e7ef75c98a0c1ad4b78b18f5ecb026fe751276937
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 14.2MB
        • SHA256 c6dc06a4b95c51f50106b440b4e26002817d1493f567b00cee2fa56743e63268
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 13.5MB
        • SHA256 39a6eb434f505f3356c2781a3b2c1b61813ccfb1499d23f76298d7b5d83d69c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 14.5MB
        • SHA256 9aad9e528e6acaf559786e5ff03cd5edcbf2751288c86af0f655c065a19137ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 64KB
        • SHA256 d2eb08ebe0c7e7ff2223b6feb8c95f679251883e0b850d913bfa4b604432b861
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 14.5MB
        • SHA256 95fd609fecd1dcfefe76976653e7f3c2d2c708614f1790a73a43d8455f266fa4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 13.8MB
        • SHA256 15b644d2b8bb97ca850f83dade8cc19d2085b9ce9c3d87658b2ba67f98084e04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 14.1MB
        • SHA256 92806c5bf230c7812493a7b23b032debd64e50bb98efbd6ed8c204fe570bba61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 14.2MB
        • SHA256 e9e640bda18e2c95b46c779ccb2c5c7df725696e3cb604319cf732a4f11149a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 14.0MB
        • SHA256 7bfba2a27a7a45f482239a8e70755adf2c30790b327ea056abb74d7ead99defb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 14.8MB
        • SHA256 11db6bce0175b3e778219555ff274cfe908ed252dc93f1aa2d5cd33798d3f70d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 13.8MB
        • SHA256 083682d3443be5a52dcf9ec41779e451d152d01b301002ef012816cd05e8e6e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 13.7MB
        • SHA256 adb4e1af628583221ad81182b42cf1a30bc45d38eb82794999d8441b8cfbd01e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 14.3MB
        • SHA256 8b04c0c0427db34b5b293d35e37d90209cd369d8e68da5472326db757e3a4d6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 14.7MB
        • SHA256 f7d7cb5348c6583982cd7bf59c3b786184e696a20c58619dbddf794f96c6c097
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 13.6MB
        • SHA256 cd10cbb9b26802f77de85de720792f875273d1dfdf9d120c0f302a05042c29a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 14.5MB
        • SHA256 94076aa94737e059d1b2c9c11cd1ff13238066e791ae75bc9995ade3d607230d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 15.0MB
        • SHA256 b223a78121420af1b3b79d0bcdb82dd948ec733c5dfbcd2bd62ef7469af25682
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 13.9MB
        • SHA256 caeb42d43b0dc1c0d335e33f97cb480ecfa84510563d73c9058f4614116c8299
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 14.2MB
        • SHA256 0214007b59f3ccaeba7385aadda3231a90a54a9037fe7cd91c24ec7aa77e5a76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 14.8MB
        • SHA256 c8c5e8505949046c1c51a21c04d7d7b66b6c3a42a1312ebcb9560b9cf9bc6bc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 14.5MB
        • SHA256 be62d69faa5505ed68dba612a1cdaf9203b60fd62fa269fc9029a36dac5f6d7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 14.2MB
        • SHA256 089a4744858ccf4f5d35992a6b8b9734ceb4647610ca59ef6b67d69c676d99f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 15.1MB
        • SHA256 8e7d989615581422d70bacadb0d793b23020b5236e3b0e7990a7e0745d8909b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 14.4MB
        • SHA256 7f163fc1f3f586032e21b0b877cb927a8cce2c89741b0f6a130ffd46684b13a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 14.7MB
        • SHA256 eda7aab203e89cab8204103af88f6a27473652343fe0bff1f5a1a58a4152a883
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
        • Size 14.3MB
        • SHA256 cce9912f3a5e4a0b81fff07a127e8b04604f8f726dbe8b10d75846f475e88f32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
        • Size 12.7MB
        • SHA256 7fcdc0d9e41dafb88d102d6a4e18f96c96e91abe360d6f3e1fdb2f907d9219c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
        • Size 14.4MB
        • SHA256 d0cd6898e3254d7f6fa868c633c0098ae91a1f03d2388dcf0f2a92ec9fce3ad5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
        • Size 13.1MB
        • SHA256 1632af0143af3d5e71e0cae2cb4170a47508f0fec1967b29f9a00960079dc02b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
        • Size 13.7MB
        • SHA256 ef9eebc14413e9c579d66cc2a247835196709c3fa537b79f2dc197753ac56b3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe
        • Size 13.4MB
        • SHA256 d0fffd739dbc2c46b0fd1cdfe06da45a1a340e9841e37aef4058e0b0d31710fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe
        • Size 13.7MB
        • SHA256 61295a6372cf479922b7bd1f453473390c733d48d0fec43b70c86f39a44b6ff7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
        • Size 13.3MB
        • SHA256 7628a4976179643ee8df431b3b75cd850d2a8f51f2c5e29820a88e0637ee54a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 18.4MB
        • SHA256 db5094d4378cd8737e6f04b2544ef4003e83c2e5af6efc777949ee9637e155ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 18.4MB
        • SHA256 4962ce5bc55cd1ffe926944425369837d2f05a97c14167ce9aeb5b85529049a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/724-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/724-4-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3836-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download