Overview

overview

8

Static

static

3

2026-08-20...ry.exe

windows10-2004-x64

8

2026-08-20...ry.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    20/08/2026, 03:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-20_116e29d5a229aac8e5a975afcefaef49_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
  • Size 21.8MB
  • Sample260820-drkn5ayfla
  • SHA256 3b34ae44c8e2f8ca4df25ac4b932c9990ffd4f27c07ff000d57eda5e19f1af2d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_116e29d5a229aac8e5a975afcefaef49_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_116e29d5a229aac8e5a975afcefaef49_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4888
  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_116e29d5a229aac8e5a975afcefaef49_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-20_116e29d5a229aac8e5a975afcefaef49_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1652

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 22.5MB
        • SHA256 d19363808523763e73ccd93c2c1d83b41f1404618eec5a46f89eff62fefe157c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 23.3MB
        • SHA256 d1882c2cc68b04382c534fe18c983aead4a9d9fe1e0839a88b91676152daf4f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 21.9MB
        • SHA256 affa3c82dee9ca1b8e7290640e96167c3e1cc681e143c6c3aa014306dff625f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 21.9MB
        • SHA256 6ef91180daef5bddb4cd2c032ef6108bffe58181216ea4501aa70cf2e0e50d25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 43.7MB
        • SHA256 d3571a9fda5a7e51cd986475c4f997ffa510e5855cfa4a4c2e522867e3f467f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 43.8MB
        • SHA256 9fd2d7e6c562a9c5afa0b03bc002965fc98d091dd069c4dd66e3a4811d501bdf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 44.0MB
        • SHA256 d3fe824cafcfd80763723c2732c73a48b1a34732beb787134b1ab80f587e8411
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 43.7MB
        • SHA256 b37f98a79abf104d694b3612c0a30d52fbc6dd9d64bd09a77c66542ca890e02c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 43.7MB
        • SHA256 e6e4abfcafb0231774becdf998f2b37f3a525827bc3bf5747ea8863c2396867a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 43.7MB
        • SHA256 4b74275f3ef1c557ad4ff0d7c1e852d3707c418eee3e48530c93ee1da97ad880
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 43.7MB
        • SHA256 0cb3a2edaa2c599a5828218c7d968ff10ef807aee9ec6ccef490e4a046522386
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 43.7MB
        • SHA256 f10a3da60b868c29d2904e67993e9302be77d776197fa30b55685280d3f9a895
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 43.7MB
        • SHA256 57783bdb2bd1c9dcf27af4fbf62b0b7c8d0bef062c170c8060a4d7d03b0b3f29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 43.7MB
        • SHA256 8e856f984d9e82ca4df0f4163c023d244bb04e846fd8be227620681402e36ddd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 43.7MB
        • SHA256 f076d36b106782e0682c8b86c555d6dfb700df2e192fb9dd855dd7f5aca0267e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 43.7MB
        • SHA256 94bdf33d4409868456da5be89dff2bacda9937298f88dea2ef708ecf1f577935
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 21.9MB
        • SHA256 658d29f78952f00da51b2a81042ad5cd863c6f3fbc05b8a12a0ad973a244078a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 43.7MB
        • SHA256 309458072749456b3a384838b1cba018a20071ff9c855ee156dbe2f4318ab380
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 43.7MB
        • SHA256 fc1c44f32ba38229089fef1aea3906588651f6d70197228b36ee687c366bc3cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 43.7MB
        • SHA256 7683f6a1fb06cc7cc5b63b3e7124f0e5120bb5f538a26e3bd2cd297dcdce7558
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 43.7MB
        • SHA256 a9d81a48dfe6074cff07785cea93d17801e5e751e1e6527efe8f6b9a8cdfbd31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 43.7MB
        • SHA256 5cd44a67426826f1b8d6433c1391674d2a780e7f34d13b6c5149c2b10bda5d24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 43.7MB
        • SHA256 a9dfbc6eea0d92b122ec92c4486beabbae48465fec71b74a75792f604fa89a9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 43.7MB
        • SHA256 cd33bc505ecfcaf8cbcfc2a22bda2f76c1fe518709c27003be0c8f89897369fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 43.7MB
        • SHA256 98ba292320b0b610f1e17b39b2b92766d36984929eea43efb527c4e68177b388
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 43.7MB
        • SHA256 d16f04badd07a67b3049753176d34f5989f636c12976978d96b55e78e6972e83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 43.7MB
        • SHA256 94f0b1bc09ab75eb36f94613fa86025c953f5cde2a36aa78a367f46c1134fe8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 43.7MB
        • SHA256 76dbce4419acec696b0d8b2873a2e1ec7abb590445e20f9d19d432ec305ff3d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 43.7MB
        • SHA256 a24de5e414945bb37482748cbdfd748a8adaa70264887cd472bd05493b81ee53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 43.9MB
        • SHA256 03aad63fd8f5af2ccb496aafaae21b18d7d7d2c9734f73046707ae4471784535
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 43.7MB
        • SHA256 c49550edc3bf312e023942e1683de365c24e582360aa43f073acb33b644ec47c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 21.9MB
        • SHA256 3d48b92d3d4f96917ab7b31d52e7f0370fa11690df44a0774c6f0719fbe938b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 43.7MB
        • SHA256 562be1b46734c67648c15f7be199f9a47f941976026cdffd738197e9f27330de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 43.7MB
        • SHA256 b8add60da5fce9069d5e273cc4ebd2179e2e23a3c3d7d25b31af2135f12e6610
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 43.7MB
        • SHA256 b39a4e17c6cd0c4980d68f64138577c3044c185ef0b8ae13cecdf0f4cd5dd317
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 44.0MB
        • SHA256 d47140506bdd02d1eb970740c8ea8fb52344ad6019eeae8340f9264bea846433
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 44.0MB
        • SHA256 27e9520a6cb95519515b6345d7d89bfb8ca8241979c4ecab06841cc594b72873
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 44.1MB
        • SHA256 8d5ab4a05a940c3fd8459cf66f96457fe3617a266a7ecd118b1ee985b43a4312
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
        • Size 43.8MB
        • SHA256 c4f2410244a0057d711c5a36ce73cb1d5ab882cdd41419afd56812f28de11957
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
        • Size 43.7MB
        • SHA256 fba66dc66d232c0fbc35b6e259ffb05956dd30fc2a5b4d0c39b6dd7f3012c2a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
        • Size 43.7MB
        • SHA256 bcd1dc4ecc2ee9a907c50542da968942e4073b24e4d7724c954c24a449551b34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
        • Size 43.7MB
        • SHA256 80d3ea30beca4eaa8a0fe18c269e355e6ffb4f5eb065a29da0ced7f9d954f1ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
        • Size 21.9MB
        • SHA256 9a74e57b5d567916ca7b8f13dc5c1ad50b6bb48930f5b2f98a9da502119f30f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe
        • Size 43.7MB
        • SHA256 996cbd1c0c34a3cba7fc1a8acd48856e82f6e4354b49f9ff0c9f2e45174d13e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe
        • Size 43.7MB
        • SHA256 bb713f24da14daa3876b0a17256d611e567e2ab5ccf3b0d15f93b5807b30c769
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssvagent.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
        • Size 43.8MB
        • SHA256 a9c6a568ffbac542c909d5e8142e673241d6651cc00ce6a3ac6e3733ab3777ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe
        • Size 35.3MB
        • SHA256 8791e577665493df0c920dfafde7307b4661b052ba41f0632f082e7a2db1b523
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 21.8MB
        • SHA256 3b34ae44c8e2f8ca4df25ac4b932c9990ffd4f27c07ff000d57eda5e19f1af2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1652-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4888-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4888-4-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download