Overview

overview

8

Static

static

3

2026-08-20...ry.exe

windows10-2004-x64

8

2026-08-20...ry.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    132s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/08/2026, 07:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-20_2277c1ed6ad9bb16218e252538aa173b_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
  • Size 10.9MB
  • Sample260820-h4wpdasbla
  • SHA256 aa4bdfb19aa9d0a17889c0afe513cc392787d8efd7298e8a6eaee98755c6da5a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_2277c1ed6ad9bb16218e252538aa173b_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_2277c1ed6ad9bb16218e252538aa173b_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2320
  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_2277c1ed6ad9bb16218e252538aa173b_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-20_2277c1ed6ad9bb16218e252538aa173b_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4072

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 11.5MB
        • SHA256 33ef39185889e3cfab8792fd0ca1299509607e60aa23b8910d510c386eae1690
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 11.9MB
        • SHA256 a5b65ad219adde6ee78fb17ad4495e5327484cf9518c77bd8ee709342ac53f3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 22.6MB
        • SHA256 5734190d80db5fd9e34c3902ad4c194c7efd0fe1101da16bbb6d9afe60e5d287
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 21.9MB
        • SHA256 1b9a8d4d505533214ffd9d9d5f66ed3f948b5d08bdca8c5787952dea91ec2d79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 22.2MB
        • SHA256 dd7f8297a2238083cf666e423ef1972389f3369ff355d33a052ec57e31e4d3cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 21.9MB
        • SHA256 3e2ed2476995f9d37e9d10f2402ad2e47333b01167f15c2b5a9231387803689b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 22.2MB
        • SHA256 ff36a673f19abd4283be5b9835c52b356d839c3c75415cfbeb42edd1771c8dd2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 45.4MB
        • SHA256 f4f90b3c34f8a40cd9269174533e9c00b9d4358aebc26574c7e1479f4e31e4bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 24.0MB
        • SHA256 fe7341488c53555631fe137e4c090bfc6b8188a521758e89a0999d3586e89b15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 22.0MB
        • SHA256 cfa01e3ac37c3fd090fed7e0ffdfc383b28c332cfbe2fa44100cec270b72061e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 27.9MB
        • SHA256 834a2709f5140dc73cfe38117612eb3b3dde0c464dc44bb1ce310dddd62bf3e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 23.6MB
        • SHA256 02d9af00a4576d5b71c42d5a51bd9d39d448540387b30ea0bc8662a7302a6c76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 25.3MB
        • SHA256 d038c69a457970c59a53419f03ba9643c38ed606dc053f656a9a9acc86164fb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 24.2MB
        • SHA256 92f38e5f73ee11b4bc76fa62fc958f4aecf5761b525b6e0f2781978f7aea072d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 23.5MB
        • SHA256 0f5fd2f6b2846a2495cd2ef0f6cb56e209566b4ea26406f3b2a579e59a278683
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 12.8MB
        • SHA256 76275c756b9856ca9efa8e90f702e82ad4de2d31ba625a88d1a6a84db92ef224
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 23.3MB
        • SHA256 a96d639fe02ccc58700e50afebe210817ad80bc38637dfb4d1ae2289d4682b74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 21.9MB
        • SHA256 6564ae805c5126a8a218d1d5e503a1a2c00f21a0c25316664310b32341927e00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 21.9MB
        • SHA256 5f3eb98908eecc12584b5a4b50f7f8c21d15e9c82917ef50f2b5437b06cf3970
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 21.9MB
        • SHA256 2bc65546068f3af76e51d6b843cf741ae873eff7f2512e66de48759892f30444
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 21.9MB
        • SHA256 dcc87dd1812bdb75ee69ac71bd7730ac77fb1d3be298be302d49de5e6074679f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 11.0MB
        • SHA256 23291a1a418b030ec6eb466c8da960365687b97d5a8607a41a221e8007d5874e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 22.2MB
        • SHA256 4a47162471d43530b2acdd84e25d6d13178609deefdbc7da039b845149c317c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 21.9MB
        • SHA256 b96b40e2fb53caebb06afa74ee9fff8b66551cdb6617796e3ba4adbfe721b936
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 21.9MB
        • SHA256 2a75fa90716b84a2beccb678d84ea1e887486f7a7d9ffefd5bb1189344d521bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 21.9MB
        • SHA256 b58159156763e03f66227789c2058f0ef2f1a1e72dfd0f33c42c779d7329f59d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 21.9MB
        • SHA256 d54ac7e424b3dbfc99bf93052a2fc67a3d69cde351f88ca01964ac6d9052ffdb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 22.0MB
        • SHA256 964d134db0af3deeefbb51edc0bc0b8343d8628e210737a08dd08585d78d8559
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 22.2MB
        • SHA256 19fc16a1ae436546467848c9a5de1de540dcea9ee9e3a8c55db2b6d1ea077b50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 22.3MB
        • SHA256 fcf82873db67c580eea719c0841b1d4953f8e389047ef89b0417a612191170fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 21.9MB
        • SHA256 5b44023b175c78dcece65cf5fc7cf073a6e84b41efeb9771d50e26f0060d1a62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 21.9MB
        • SHA256 1052c3087c5e37adc58746739932c4ae04b1cca7ada7632a8c9368c9c4bb8124
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 21.9MB
        • SHA256 2ac9f2d6e54b90b20f5608818c2dab5e062b29393ea8660cea575dbb78939e8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 21.9MB
        • SHA256 01ffeec859ec1dba366429d785fda68a1d4c5cca194356a9058c7ab072d491a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 21.9MB
        • SHA256 ecbbc8c8fb779511811c6964bd97031663d0ba1692cb78e8dc30490da87ee756
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 21.9MB
        • SHA256 c84cf8d2f327a7a158152c1738af3690eed84f2f47ff5ea725f1f109712bcfd7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 21.9MB
        • SHA256 a55d86517c37adb4635834b14a353eaa7617058977ccdfad1428d3d147062a3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 21.9MB
        • SHA256 8d16ec90bdd2575e94ab0b7f326958b5fc067dcdded8a110c6b3669f6fa5661d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 21.9MB
        • SHA256 70aa8d1269dfbed02d9ca86ff788c6fd2aac1b3f0459bcc2b40864005fe0e546
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 21.9MB
        • SHA256 501e534cf8e9cd0e97c2b212f13fe2bcc996b8b34454dac6d3c38e8228f58ce6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 21.9MB
        • SHA256 41ec57370c5a3c4e3a52e4e3a332b795fed3dc9fccd31ee687155996d24f8f82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 21.9MB
        • SHA256 a50d8528d271fa1bca7cd989428499bbbaa82faf11d7c584d2cf90bbf7af5896
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 21.9MB
        • SHA256 edf47343bde6ff2efdcfcbab6f8eb6eedfe9c3ad1f06aa63d80c07a0f7d41513
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 21.9MB
        • SHA256 c0e870526dafb2ba1af1d10fbcadb48a54fa73329eb4d1267232fba3d6f4992f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 21.9MB
        • SHA256 3e9be6c5047509411eac8e4fb0a9975f7052c5d0cab98c84e74014b491086e40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 21.9MB
        • SHA256 0fd555a6ab84ed363ca3c86b9dd73a684dce11428e5c9d368a37d8e6453a475e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 21.9MB
        • SHA256 7d2b6ebf7918e4a655252882081a2e9c628bf9ff93f32ed6bec96ed3a16d9772
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 21.9MB
        • SHA256 8f6811459badf7a322e0f4b67de4a52c87d9ca633618f0d126b9412f86270487
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 21.9MB
        • SHA256 0722d08ed9eb97a5dd9a84ae8872c131d583cad5c4bbe9cd6a39343bdbb29c5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 21.9MB
        • SHA256 7589ce411f7ca7499b5ba78b9622b42c6c8bd2fa9e7dc91f2a5446a7373ab157
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 21.9MB
        • SHA256 cc643b4eff97711bc16891c393ff776c6c0796c50b1dd2504370dab1340e9a1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 21.9MB
        • SHA256 c8c9b2c6af0af0fe5093efe79e64ad047c26646a062f005457cdee0a12bf9595
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 21.9MB
        • SHA256 e910227630fcbd11650931799db567b1756de307ccd9288aebeb8cbb217bd964
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 21.9MB
        • SHA256 c435556b3000a1fe14c820b35f3f7395bd4f2fa51f96a0d585b131ed801b9a60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 22.0MB
        • SHA256 46d2b1f1d0b4248e232e91d9b8ccd0ccb0421c8193587b658a2c5e0e42210307
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 21.9MB
        • SHA256 4ea41a7c3c59da7c7107fbe4d8e100b36f33652868e2835f6cc10ce5fef84ec7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 22.0MB
        • SHA256 57540e421ea816d0064975b1df4e9976d9db42614681a8a61423d37e368b7acd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 21.9MB
        • SHA256 df5cd11cf72c72ebc361e6a352c40f0311e080f95dc0a478a84ddd1968539b70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2320-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2320-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4072-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download