Overview

overview

8

Static

static

3

2026-08-13...ry.exe

windows10-2004-x64

8

2026-08-13...ry.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    145s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    13/08/2026, 09:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-13_4a03f55061525e21fe8a489188029465_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar_wannacry.exe
  • Size 37.1MB
  • Sample260813-lrd6caaa52
  • SHA256 d203ed34bd4bdc9977b1c3414bfea3b3a2116e916eb998c882eca64eb9c5aaf1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_4a03f55061525e21fe8a489188029465_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_4a03f55061525e21fe8a489188029465_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2592
  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_4a03f55061525e21fe8a489188029465_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-13_4a03f55061525e21fe8a489188029465_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1264

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 37.7MB
        • SHA256 e63ef34b266e3883578e0e6bad283ac941af982f5519c38dffa67c472a2a76a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 38.7MB
        • SHA256 e329f4929d32a9ef296439ca70934e5eade9e251828c4a07b7d58f1164890fd3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 74.2MB
        • SHA256 eae1025630d065fbd9482eca1496826e93aaf169cf14199cf574fac8fb7bbdc2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 74.2MB
        • SHA256 ca2034333ca660b22fda5b56d113a3f684a3211137e3236c80306964f34a3c96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 74.4MB
        • SHA256 9480c08a26e0fdb0b119698e509891cf7860bd85f7e98e37ef8563f567101f26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 74.2MB
        • SHA256 08537db23b450091ed8dc1a2d5a4d318dbb33cc36e829568e1e001319c6010ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 74.2MB
        • SHA256 b6134ce6333e537bd91c19742dc7bf0ecc7a982133100d19855b162818ac611f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 74.3MB
        • SHA256 f149548643d337b779510da8d2ea972fe2951a8cf3beae277a5a06d7abc5eacd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 74.2MB
        • SHA256 5d3181606e501e065e65fdc0d60f62132f77b9c2701e69640828e178f1a63132
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 74.2MB
        • SHA256 028d1f14b8b4b529ae77b880df63cc82156bef891f8ca6f3234702beccc93fb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 74.3MB
        • SHA256 a83a6bb8af21f645722ac8bb7cac9850b8997441ecbfe2fb30db84b41c92612f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 74.4MB
        • SHA256 db5c655cbebaf4b2ede9ac871f04a52cc28ce9ae6981ff90d4bd91cdab9e52f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 74.6MB
        • SHA256 62a84f7eb276848b60ace00e3770b27a6bc6c3ffeeba304f5d75a7b02726706f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 74.2MB
        • SHA256 51a395ca15bc3792a7400a50699fbb66a7ac12994a53d29a4770f0e3beff25f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 69.6MB
        • SHA256 a82a027352128aacf15597dc6ee0bc1a44edb6b6c0d3cdcb4acd2178ac6347f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 55.8MB
        • SHA256 00fb75d640ee9f35f68b8d33dff99ae44a6f89ac42130a7dd91b52ba25a83965
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 71.9MB
        • SHA256 34c8895756db19f35c43c1a932cba89dd32248418a156319a25d45fe1de32542
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 62.1MB
        • SHA256 edd6595051ad30a77ab51143ab8aa6082c79cd445db156c082ca9e9bce4fe1e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 59.4MB
        • SHA256 46af984871c4acebed4f8551b53673c701302f4bc85157384e1212f2762857a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
        • Size 57.4MB
        • SHA256 8712e3d737ab178b656014878f007118a880eddd29720f81fcc2716fa2795acd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
        • Size 37.1MB
        • SHA256 40503141e5799074ee226896447cbe36dbabfc1fcb82a19b0f1c1eb6c3e6faa7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
        • Size 54.8MB
        • SHA256 36fc5378bfaa2581f0b6459c73d3210bd95461fc8de47709c6dd7c1f4d78ae16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe
        • Size 53.2MB
        • SHA256 471d88ce0a09bae4f6d6cc252b2c56d234a4abcb8b192862d3d36f0ef13abf69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 37.1MB
        • SHA256 d203ed34bd4bdc9977b1c3414bfea3b3a2116e916eb998c882eca64eb9c5aaf1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download