Overview

overview

8

Static

static

3

2026-08-13...ry.exe

windows10-2004-x64

8

2026-08-13...ry.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    48s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/08/2026, 09:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-13_4a03f55061525e21fe8a489188029465_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar_wannacry.exe
  • Size 37.1MB
  • Sample260813-lrd6caaa52
  • SHA256 d203ed34bd4bdc9977b1c3414bfea3b3a2116e916eb998c882eca64eb9c5aaf1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_4a03f55061525e21fe8a489188029465_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_4a03f55061525e21fe8a489188029465_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3580
  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_4a03f55061525e21fe8a489188029465_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-13_4a03f55061525e21fe8a489188029465_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5388

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 37.3MB
        • SHA256 e7b23c549e66897cdaa7705a6ff0e9633c309e9e127ebde642b73ac74731185d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 74.2MB
        • SHA256 0a311b671187226236861d2d53cc3fede7f32ac0b18203caa7fff2fae18c4514
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 78.2MB
        • SHA256 5a736d5c55c08e07c87090a5a4c3df8e6a278476110ae1ffaf9b42729b5bdfaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 74.5MB
        • SHA256 da5b1637df81020ddfcafa651da144003c4f0e2bd73afd500a9cf4bee000984f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 39.2MB
        • SHA256 052d48878b9a1d353263ae60ff8d2a08f8bf63148159312c469f2e8dae652c47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 74.2MB
        • SHA256 1121402c73dbda5da11f0e045fa3d41085ed3a9dfff867574be9b7b301dca2bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 80.2MB
        • SHA256 f445ae68bca4c175848e5bbb07ab9164387305c820aee92eeb042e92af45d71a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 75.9MB
        • SHA256 52f2ed723f41bf2d1302c1a6034ebd369e651aa66fa30349c4a40a64b46b1767
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 77.6MB
        • SHA256 f7cb16c5e552f7681d4a888e63612708761b08a0514e12b1b0455e963ac9023b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 76.4MB
        • SHA256 cc4d4596f9f02a02d324bc258422acfd13899a9021175018d7b3d860b9a3f5af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 77.2MB
        • SHA256 1b35f0fb0c87236ae128c8b697b42193902f06798a2aa5168714b3676fab4b54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 640KB
        • SHA256 36e46251acaa3c1f6ddca77a7802721efdce2c29bd1eb6d91a02a5f772f39704
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 74.2MB
        • SHA256 cf263efcbf61aa25e67fb79c46e89293f1b52d2a9c09b133225069ec42bee0ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 74.2MB
        • SHA256 1c54d4afba70407134f156ed21e84c461126978c908a3a1dc3ba689f561f7cf9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 73.0MB
        • SHA256 d414aa4857a08d6a023078bedb2c1120cdf20b7b0eeec0187024ec3396d2effc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 72.4MB
        • SHA256 751c6af2ca3484f9cae5fa14a189b8575a1bb5ad27d716a8a72134fadaabbb3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 71.8MB
        • SHA256 c3274b821777333757a16e0ae99fed122b78c3e0dc37981225737a525b2127af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 70.7MB
        • SHA256 cb168ed29351d5606509e2e9f13797d4d56b8094b83723fa00d97b2212508d06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 69.5MB
        • SHA256 b1b97268953790d0eb75ac9c1bf87fea340082b101e84e90b1d118ed3479dd2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 67.9MB
        • SHA256 677780bb9647de7aad70dbcaeab9b8765d853ae70b3c9afdfb334e8f4d1d32b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 67.5MB
        • SHA256 963a63939d9ca7ef8fdc41e754446560a72f6aabc3f6d1a3216075a47068a6ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 67.3MB
        • SHA256 0d8302d14cf97405561d40dd1e6cc783066aac50fed8125c7f915815c9b5663e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 65.7MB
        • SHA256 59772b066fb59a3ae81a85c77b1c8e70db70dfa26e953704b8cc802d486f373c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 62.8MB
        • SHA256 54944510d1160d44a55e9d08d547b8140d45099b502079e8b4bdea285258dd65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 58.4MB
        • SHA256 1f1f6ef83745b145ba083e15f818023728806dbc6f8b1ca95a25687fe0a42fde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 74.3MB
        • SHA256 6077865413a49679f877b923a548b0560d149b02e479b189003baa7ccfb34c29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 74.2MB
        • SHA256 c38b1107ee891a81e9a28902136edd44d501e5aed62333f451a3fa8ebcc04a97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 74.2MB
        • SHA256 a5367cb9e7c6333e2d98fdd9188c1248dfccb048ee1a65fbfa1787ffd608b1c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 74.2MB
        • SHA256 4694c3964a9bea4dfccfee9c7673f7fff761483f0177294567a47d2c2b333bd0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download