Overview

overview

8

Static

static

3

2026-08-16...ry.exe

windows10-2004-x64

8

2026-08-16...ry.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    32s
  • max time network
    155s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/08/2026, 10:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-16_940d72bcafc2f4d68278835bb6f3f05a_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_remcos_vidar_wannacry.exe
  • Size 25.8MB
  • Sample260816-mgqbashl41
  • SHA256 6280317012f23e8a47c5fd2f8db7892c1395630e31de4ad52a38cad85a48a5a8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_940d72bcafc2f4d68278835bb6f3f05a_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-16_940d72bcafc2f4d68278835bb6f3f05a_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5764
  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_940d72bcafc2f4d68278835bb6f3f05a_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-16_940d72bcafc2f4d68278835bb6f3f05a_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4160

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        CheckpointExit.exe
        • Path C:\Program Files\CheckpointExit.exe
        • Size 26.3MB
        • SHA256 a1745b7476160da26e84b7fb11154594c9af00e8a7406221ae3934ec2f6aaf51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 51.8MB
        • SHA256 5ac2e50afb2b248a960cf5a6f195a41ce71fee69ab173afe3f3a8c4686c4ba59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 51.6MB
        • SHA256 5c46f3dbd8d0e019d965f798d497245b3b2f7db835540d4cb4916223e3a0a21f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 55.6MB
        • SHA256 fb8ad3020a752cce030117ae438005a6775e51e6ed93f357ac5605eeae4a673b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 51.9MB
        • SHA256 f7b4c26156e558c45b7f86d5e81c0e52481b2c44dd384d0fddd29df20b2f73fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 75.0MB
        • SHA256 d3b6fd797d60df54bc7e7db917bc31680448d0e4079202c8fc55e5b91ff4193b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 27.9MB
        • SHA256 9d60c00b6f8c0a5192c291d3e879f446e84a0a620e1d881564876af4da503927
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 51.6MB
        • SHA256 15d012b107ac644e692e7aca00eff427fda6f4ab3a531fc64010244701a105f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 53.2MB
        • SHA256 3ad75e3d0056293a89f53a125036989735b530c0795049e7f696177e96fcbc3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 55.0MB
        • SHA256 620cbdd3f6604738a85280dcd390e3ee30845b5de6e1aa46c70087ef277f4a7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 53.8MB
        • SHA256 75ce9508ad553ccdba26123b8111461756e389cc71da84cd0ee806086b3fb868
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 51.5MB
        • SHA256 58e3b740063ae22700e3a8be1bb4d50e1bcbcbf5b5542e9ed7e0a7305549118d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 51.8MB
        • SHA256 423d7402938d90bf8fd1e03e9cf14322d10886ed40eae026a1c087f32cd349cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 51.5MB
        • SHA256 9281b1e1e097d9a52396b1efcd71f088e2671c4f5859cd5d18a1063f278e4f3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 51.5MB
        • SHA256 6775959e628a8070f1b07f801ba2ef88ec1642ade6005b2b535c4004d3083925
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 51.7MB
        • SHA256 2ec9ae91650ceeee2e4dc564c4714f8fb656f6d5a74364e5c0f57d8377e55866
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 51.5MB
        • SHA256 8f41054f6a20bc52d293c835dff81e8ea60046b725f8f9f73ef9780b32e4d7c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 512KB
        • SHA256 54a9cdeaa70d56716fea0c2b033f8174b1495f38e428abc781f5cd97cc816efb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 51.2MB
        • SHA256 cf54682e8241cf01b6a4d3be3c7108bbb92ea4b9c5f68f4a99e8eb0248fcc385
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 49.9MB
        • SHA256 33fdaedc24c4b9e46eced0028f85576ff7897867c7acf31a786dabf401246e06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 48.6MB
        • SHA256 2508ad58301f2a838facdcdaae417a3b279ce840204d6ba3fe47f48d42d49a5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 47.5MB
        • SHA256 0c02c4dbe4aecd7d4d5771a274d97cec1d515a722b567e9fe56bc34f00bc91a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 46.8MB
        • SHA256 718dfc6cea6540d5d1016ae99f560c6f78c02459619f70cc083863c2c043fdde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 46.7MB
        • SHA256 30efa16d1385ab59321b18cdb472c3529c5d5e480703b84bafd60dbc5847676e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 46.6MB
        • SHA256 91299a86fbefe2b9999ff3b77c7d22c36bc08f32d574ecc3d294dfed84ef0c14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 46.4MB
        • SHA256 03d7e043c5b7ef8ca655243b84b43dd7588707256e26439dafcddd592d03ba80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 46.2MB
        • SHA256 79b88c719136c28f25a3a65801c9bdcf244f6d8651300853b37bde634be3da8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 46.2MB
        • SHA256 5d889d6b3e18cf5581403e40c2ebcf5c9e324fb488793e86004e170e8dcbfe60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 46.1MB
        • SHA256 e2ffbe2213e6741fe70668ab26626d015ed02ed590c0391082b7b59764681780
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 45.9MB
        • SHA256 4b28bfbe33c7adf0cb1647c69bb0ec4cedeb3bfdb566787a9805af272d107f17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 45.6MB
        • SHA256 b66a27e016fe690b2854082ab175a1e7007f5700dbe69cfab3ee38627b23d16c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 45.8MB
        • SHA256 8190c27726e8d484233e54c1c19a89432a4b2fade7a9a812a5ac23371977daa6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 45.6MB
        • SHA256 de18cb91d573b49cfa896eb96a59d431a91352ea0be61079a74238cf9b010b1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 44.6MB
        • SHA256 88aa93fa2c366ae9f8fa319a27a8cf06f235ac3ca7a5f79ec7a9a71c9750cba9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 45.3MB
        • SHA256 aa04e146cb8f9c1c77d047d19cbd8388b27b6ac8ebd242cd45126fcd356de6ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 45.2MB
        • SHA256 242faa2b2ff09c12f1514e5af7ab0482dbf5dce5980b2cec7dcc1830f563329c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 44.9MB
        • SHA256 3e6b32e5b18bffe0846caa772fa24d67910dec97ed0f750510eb5888bbe67a2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 44.1MB
        • SHA256 d19865b94e311a431c0b4a3b8cacd1be20158b2beccf47e47f6409f0f6e0da48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 43.6MB
        • SHA256 7b0953c5b8bfebfe2ffbd2a6d66207082daaac4c6cf0cd088dff2d1d052f6e3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 44.6MB
        • SHA256 af1434a3118438fbd49b1861f036811294ae3937181b57fe845b17856238b169
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 44.5MB
        • SHA256 4e21d35e8aaeada306859064a8328dbdf6aa6c35deb5bbf8cc57ad77d809c998
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 44.4MB
        • SHA256 ca45ebe9d35718ec12e67e25391b3f145a5bec8b03273718f74be850f87f2db1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 44.3MB
        • SHA256 c2553f6ff818400613ae30faae57a99ef5b25e93ac143cf85794e3255ae5d07a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 25.8MB
        • SHA256 edf58f86da87966f0435188fee133014e2dda1d02b207aac8bdb56c1eb78c7c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 51.6MB
        • SHA256 0037a6561b65648719e9edae8afe15b5e30730c9a339e8dc110a230bd4679bdd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 51.6MB
        • SHA256 ab556d73dd9cb3c857e5c577df3ee31773a9ab5a45afd75472b3583c5eace34d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4160-22-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5764-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5764-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download