Overview

overview

8

Static

static

3

2026-08-20...ry.exe

windows10-2004-x64

8

2026-08-20...ry.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/08/2026, 03:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-20_116e29d5a229aac8e5a975afcefaef49_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
  • Size 21.8MB
  • Sample260820-drkn5ayfla
  • SHA256 3b34ae44c8e2f8ca4df25ac4b932c9990ffd4f27c07ff000d57eda5e19f1af2d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_116e29d5a229aac8e5a975afcefaef49_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_116e29d5a229aac8e5a975afcefaef49_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2804
  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_116e29d5a229aac8e5a975afcefaef49_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-20_116e29d5a229aac8e5a975afcefaef49_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4756

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 22.1MB
        • SHA256 898ec0a242755f5adeaba9934119be537657f57cedaea92f9c843dcf26a9250d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 25.9MB
        • SHA256 d4356873e3e77796ef98113bba5328a59c7c32289be59d2941925c8c09af50e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 21.8MB
        • SHA256 3b34ae44c8e2f8ca4df25ac4b932c9990ffd4f27c07ff000d57eda5e19f1af2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 24.0MB
        • SHA256 c03fa6ba5faa88d3950d8c6a88f7d40e955339823f8c0f2ba44fbd9b1501a404
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 43.8MB
        • SHA256 a449927d2379e6beea521a2ecfbb9af409090a2c8c9473d0ece6acd2d3002450
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 45.4MB
        • SHA256 91849c7a3373e028dbbc5978e3ed8b3b19f67479adf152c98391cb726b7c9afa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 45.3MB
        • SHA256 16c778cef20cdf10703046a741e2b4fab15c804dca228784a749e80af8aef1ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 23.3MB
        • SHA256 d1882c2cc68b04382c534fe18c983aead4a9d9fe1e0839a88b91676152daf4f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 43.7MB
        • SHA256 53d320d0da37127833fe28a401f46111b22b47e2ccbb5794956ccf46f22c48ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 21.9MB
        • SHA256 979fd58a218778e495c869215710ae7a0697d92e8353416a92ef3ff937056f7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 21.9MB
        • SHA256 0dad0667e725253c27901382a868b252eb39a1a466fb8cea3dd0384025a391bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 21.9MB
        • SHA256 94ebbf48ea6b9853ebefcefe995426843c5587e918c636cc018817c7247de589
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 43.7MB
        • SHA256 639cd2c4e73e740ad471cafd485baab0e4d7a70fd37b19eeb42da172abe17861
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 43.8MB
        • SHA256 ea10a9550810f6f510a18d065c6476ea4db6d866ca673395c9a1673b99a090c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 43.7MB
        • SHA256 8676f2340a7dea8c349ba8e514d63d0a95417deeaa283d51c882baba22fb692c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 43.7MB
        • SHA256 d3571a9fda5a7e51cd986475c4f997ffa510e5855cfa4a4c2e522867e3f467f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 43.7MB
        • SHA256 b37f98a79abf104d694b3612c0a30d52fbc6dd9d64bd09a77c66542ca890e02c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 43.7MB
        • SHA256 13c8102a11761c77e9f96218cdf3f789c7a3299c3fa17327699ca5ea59e0404d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 43.7MB
        • SHA256 95093acaa5e17530b0e45d5bb784df82a2c3f6da7371a861878a7429eeb8fcf9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 43.7MB
        • SHA256 e6e4abfcafb0231774becdf998f2b37f3a525827bc3bf5747ea8863c2396867a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 43.7MB
        • SHA256 0e94469027040b5451990bb0c74b383076029712c5b08e79ef5f2a60f33b2c19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 43.7MB
        • SHA256 0cb3a2edaa2c599a5828218c7d968ff10ef807aee9ec6ccef490e4a046522386
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 43.7MB
        • SHA256 f10a3da60b868c29d2904e67993e9302be77d776197fa30b55685280d3f9a895
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 43.7MB
        • SHA256 57783bdb2bd1c9dcf27af4fbf62b0b7c8d0bef062c170c8060a4d7d03b0b3f29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 43.7MB
        • SHA256 8e856f984d9e82ca4df0f4163c023d244bb04e846fd8be227620681402e36ddd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 43.7MB
        • SHA256 ddb21567c33f5ef6ed3d89d6354b6843acb2f8ceca3e0b8cf0d566e7d31224eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 43.7MB
        • SHA256 94bdf33d4409868456da5be89dff2bacda9937298f88dea2ef708ecf1f577935
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 43.7MB
        • SHA256 f4bcc77b88e4caff78c123319e2d4618967f9eb0d56b308ce3a28cfe99c8fb63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 43.7MB
        • SHA256 309458072749456b3a384838b1cba018a20071ff9c855ee156dbe2f4318ab380
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 43.7MB
        • SHA256 bdcca45c667e9ce9c978ceb06cdd02bd36bbe19236dea62166d53546ddf659b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 43.7MB
        • SHA256 fc1c44f32ba38229089fef1aea3906588651f6d70197228b36ee687c366bc3cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 43.7MB
        • SHA256 7683f6a1fb06cc7cc5b63b3e7124f0e5120bb5f538a26e3bd2cd297dcdce7558
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 43.7MB
        • SHA256 a9d81a48dfe6074cff07785cea93d17801e5e751e1e6527efe8f6b9a8cdfbd31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 43.7MB
        • SHA256 5cd44a67426826f1b8d6433c1391674d2a780e7f34d13b6c5149c2b10bda5d24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 43.7MB
        • SHA256 cd33bc505ecfcaf8cbcfc2a22bda2f76c1fe518709c27003be0c8f89897369fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 43.7MB
        • SHA256 98ba292320b0b610f1e17b39b2b92766d36984929eea43efb527c4e68177b388
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 43.7MB
        • SHA256 d16f04badd07a67b3049753176d34f5989f636c12976978d96b55e78e6972e83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 43.7MB
        • SHA256 94f0b1bc09ab75eb36f94613fa86025c953f5cde2a36aa78a367f46c1134fe8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 43.7MB
        • SHA256 76dbce4419acec696b0d8b2873a2e1ec7abb590445e20f9d19d432ec305ff3d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 43.7MB
        • SHA256 a24de5e414945bb37482748cbdfd748a8adaa70264887cd472bd05493b81ee53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 43.9MB
        • SHA256 03aad63fd8f5af2ccb496aafaae21b18d7d7d2c9734f73046707ae4471784535
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 43.7MB
        • SHA256 c49550edc3bf312e023942e1683de365c24e582360aa43f073acb33b644ec47c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 43.7MB
        • SHA256 01cd892f63a5ea61af552865310508abea4dda110ed80f82cb76c54c3db774b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 43.7MB
        • SHA256 562be1b46734c67648c15f7be199f9a47f941976026cdffd738197e9f27330de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 43.7MB
        • SHA256 b8add60da5fce9069d5e273cc4ebd2179e2e23a3c3d7d25b31af2135f12e6610
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 43.7MB
        • SHA256 b39a4e17c6cd0c4980d68f64138577c3044c185ef0b8ae13cecdf0f4cd5dd317
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 22.0MB
        • SHA256 fedab042113f13a523337fb6d876aea895333ffea793ac1a46147622ad9e0b1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 21.9MB
        • SHA256 aa207c03ecb619bf82d265dbbbd631b1e1f286784c509e458f0d27bbea11c711
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 21.9MB
        • SHA256 a59259e6987d841a791f1cf42ac3c5b5353b216e048fee536e300f8607b4ceb1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2804-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2804-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4756-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download