Overview

overview

8

Static

static

3

2026-08-11...ry.exe

windows10-2004-x64

8

2026-08-11...ry.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    147s
  • max time network
    116s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/08/2026, 22:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-11_d909a7fac67cd8d613bc49034c0ab3e0_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
  • Size 18.4MB
  • Sample260811-13mn7aztev
  • SHA256 4962ce5bc55cd1ffe926944425369837d2f05a97c14167ce9aeb5b85529049a6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-11_d909a7fac67cd8d613bc49034c0ab3e0_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-11_d909a7fac67cd8d613bc49034c0ab3e0_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5692
  • C:\Users\Admin\AppData\Local\Temp\2026-08-11_d909a7fac67cd8d613bc49034c0ab3e0_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-11_d909a7fac67cd8d613bc49034c0ab3e0_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2592

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 18.4MB
        • SHA256 e9b9368f788a2cf7c014314ae40ee6117763f225111bc58e52ae5a2f5a4f24b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 44.6MB
        • SHA256 93f1aaa7dc322844df0f617793496758a35a71b5de7515658f8b5eda6a69ab42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 20.5MB
        • SHA256 f97a65faa9b9fc7853aae87648290a199f9b500e4bd0add2f464adabd70271f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 36.9MB
        • SHA256 b614652a9639a13a49a64a222ce5489e46d36dd1bf3fbb96ecb75af254cde119
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 28.7MB
        • SHA256 1ae8d7ff1a934abf5f7340b61c3f2d5bac209f1c3e0adb6339b11cab664f08f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 30.2MB
        • SHA256 7ce1719469e68a89a9dd0a68e99a004bfb6d01049facd60a30dcfb8b9811b17c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 31.8MB
        • SHA256 32c5d96e3a0cbaf0b073d959a3b4d35f2f0141997bb17aba967d9542775b480b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 31.1MB
        • SHA256 d97f310cd37bd9430dc64970db03b9a884cb758ed117ea05b303029424efaffc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 28.6MB
        • SHA256 df56ccddfa6d7d92d5a9dfbd133fb1fffa3fecc7ef6ce0f6c1d63595623bcb35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 28.9MB
        • SHA256 57f25d3b236e2bb1b93f0444c6d8dcefd4371e17666b6048c65586dbbf65bd4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 28.9MB
        • SHA256 20f060d9a26f5f84e7560eab2d7b1ebce2f1cd1a1ec23f839e5f44a62b9fa6d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        HideRepair.exe
        • Path C:\Program Files\HideRepair.exe
        • Size 30.9MB
        • SHA256 f3ea655d272d9c75a2d0313c83a6ed697a55f153a834077765fba34f46f9e1be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 25.2MB
        • SHA256 2c915578cd64b87dda963f7e0adf9e02edef7ec3f04ecfefb283eac44cb03edf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 24.9MB
        • SHA256 d55a632576ec16990e51a805cb7d4cf487feb88c8fef29053c0d88f2aa4139e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 768KB
        • SHA256 32a4edcc850e91e49004e89b1caaea00d041d8b04cde89ebaa58552b8c82481d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 22.2MB
        • SHA256 655d2a8c8b8524ada155bb3d444a8fd015db861b7c6b0730e30f3633e2aa2d4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 22.1MB
        • SHA256 c1c842d8bb1b724d6a692ba3c399b4bc00e4ae7d30c4689fec2bd394bdac2234
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 22.3MB
        • SHA256 0d8bbc822d0647fc602f4ffef2500f80eefd4e23689b1f6d2f12329c2d8c74b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 20.2MB
        • SHA256 b2951603ea9e4316f05755e91c6246b8d31c77ea5f4a85471825d21cd83603ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 22.1MB
        • SHA256 d2375dcb12ac52e00ccbcaa7715c25c0726d6e5e1bd7281f1bcc2563590a05bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 18.9MB
        • SHA256 b7e66d05e63ae33fd9a2e434238c526df3a82f064cf370170e7da396cd76c84b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 19.6MB
        • SHA256 466bd57e992fa9da07c1cebd887ada2fb06de85a441dcc94f9813559a622e958
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 19.1MB
        • SHA256 b9f0ddd43f59523e381c59c28c23028ab1b054bf7abb5532f0b65eb6c18aed74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 19.4MB
        • SHA256 68161740a8225cff9fbfb9bc6276a76777b52d3f70460ffa0943a89968777383
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 19.8MB
        • SHA256 9be2f37307d2574c42a73bf0ac53beb5aba2c4e1ac7edac0503928f2ab317a8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 19.2MB
        • SHA256 42d11dd42087c069a7ca474831d86c66f98e46db3914b6e90bcd7bffb3fd37b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 20.5MB
        • SHA256 747399014119f4d571fb108dd3a3f90615e959d776a32d277c117e1dd22c2ade
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 18.8MB
        • SHA256 dec7107f831d282453f0d40d610874d83aa914f2bcf77ad31f10dcbbb2132c0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 19.7MB
        • SHA256 6309120c017765fcc6606b6a026efaf886db0ec50e37c01c1001e299901340f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 18.8MB
        • SHA256 db11bd79a2820d86e19b3918c11ec53976f62476b33fea9e50ff89504f9ef9b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 18.4MB
        • SHA256 e8837d256c615ee6974b640cc4d932814fb1eb584a539c37dae76d0b123979dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 18.3MB
        • SHA256 83209bd660bb25a1ecfee4005137796a1a1089c19db820dbd854a43de4f4ccbe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 18.6MB
        • SHA256 933839072641737e93af8f5126b491817c3f0305de1cdd0a5e07551a3dc77702
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 18.4MB
        • SHA256 71f2484f946b4e0c6d1231ff5f51e8993c876e15d891e244e01379c403d5ebc8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 18.9MB
        • SHA256 5b432c6276afe868ab3cf27ee24c1012842464b0e5bf88602d08e24c4f5413d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 18.0MB
        • SHA256 7fdc4562fdb3c70b92ea1f0d9265103f5a01b48fe30ed7ca1aa0b9f73592208d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 17.4MB
        • SHA256 5712d01e528f5521e33c815208917d1f7fc1791e6ddc37ee762c24931f04a37b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 18.6MB
        • SHA256 fc9b41974a725b0382294a2d419d22050ddd7758c29cdb5ec1127fbd7bf6d88c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 16.0MB
        • SHA256 d678a9b54e7bd8558dfd1b96edd3741e8c68ebfd0f1fe9381bcba09141eb5bbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 16.6MB
        • SHA256 3c01c473d2d273edfa65d41ec3a78839edc3f007f4df94e957cb3e5f9484bfe2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 14.6MB
        • SHA256 ffcef0b52213f3d64a9ecf5499266cc0ef159e93530621f513a7945835db7285
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 15.7MB
        • SHA256 9b7ef1cb06a77c2bf9f26e4e8352a91081b314e93be443d1132dfafd4b11c43a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 14.9MB
        • SHA256 f19179d78e6576beaa432e769c24d8987da4b6c6b97fc500844b74d0763e846c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 15.2MB
        • SHA256 7d9ba9c564c71b91cfe318745a2fb582e1951940791b77b41500872f2c6b641b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 15.8MB
        • SHA256 61dcd8836ebc7b97d0ccafd1aa4f025448fcd09bc96f52e0d19653832004c5b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 36.9MB
        • SHA256 7fa273c56ce6af5c515e7ca3580e991251031705952a6817b8b8e9d7a30d5bf6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 33.9MB
        • SHA256 411124a889de561e0af1809565b9027e998141776460ec493edeb55debd9f6b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 35.9MB
        • SHA256 7ff23ddac0a9e74e13e760c6bff3c33bc23ef28e26cba95154c2762970bd1dbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2592-31-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5692-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5692-11-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download