Analysis

  • max time kernel
    148s
  • max time network
    135s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/09/2026, 09:21

General

  • Target
    2026-09-09_f4e8bf33b9578975d6b2ebbbf07f4816_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
  • Size 9.8MB
  • Sample260909-lbef6svanb
  • SHA256 c06e56fe5a098b3c0eb0a38aece3df85c91657edcf68ce704cc3aa6c1b64d792
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Control Panel 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-09_f4e8bf33b9578975d6b2ebbbf07f4816_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-09_f4e8bf33b9578975d6b2ebbbf07f4816_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4892
  • C:\Users\Admin\AppData\Local\Temp\2026-09-09_f4e8bf33b9578975d6b2ebbbf07f4816_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-09-09_f4e8bf33b9578975d6b2ebbbf07f4816_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3244

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Uninstall.exe

        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 9.8MB
        • SHA256 1a75d547f9485744c74d8548e805573b962a804e7d287ea82cee4c85d368885a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppVShNotify.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 10.1MB
        • SHA256 677340d4a828522c684e46202f806458330393b399e00713a29a2f10c66e765a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InspectorOfficeGadget.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 19.6MB
        • SHA256 d97ff86ce53557dcf43527043c86ffb20230548629a7098d2e91f3514fc49085
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IntegratedOffice.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 23.7MB
        • SHA256 89cf2c21b2b5ff4cda573b87616a60206244063f4076fcd43d2ddeabaa72fb40
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MavInject32.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 20.0MB
        • SHA256 9b10d601977dd1c99073ea21cb70d5e4ac781b6982cbcb45ab8a0f66a4de3bf1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OfficeC2RClient.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 43.1MB
        • SHA256 d05333e4f0a6b373d3fb8042d63ca4adceb64559daaa7e4a77871bf5728036f6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appvcleaner.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 11.9MB
        • SHA256 72845a7dcabb92b62d314226c6e562e6a30ac93b8007386a4ea01be804ecb360
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VSTOInstaller.exe

        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 19.7MB
        • SHA256 73cf37ae9b7d9a5899cc3f0466bae5bf68aefb24db0e34d6a513979fbe00e42d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrmstp.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 25.7MB
        • SHA256 4495b7d5800b990869a2bb8051574854027da55741bf35dbbbcf37abd4131336
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_pwa_launcher.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 21.3MB
        • SHA256 71c1ee7edf415b42f87f48a6d4daa0398443d042eb926564e0001a03618320c3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevated_tracing_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 23.1MB
        • SHA256 407dff94698bfa7547dc0ed26177da2649ba00242c908cdf36167cd5b20441f4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevation_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 21.9MB
        • SHA256 3f0f5cd330ab177365721128e09c93cbd5e0b26b8fe58c8816c5acf4403263f3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notification_helper.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 21.2MB
        • SHA256 b01db7921cd235986a1e5c077edb83eb978654310df6f93ca0e8a48c4399db1e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        os_update_handler.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 21.5MB
        • SHA256 6822cf0a707cf054ed8740d160a151f3fe680b8ac6c3a44fb538a93d8c75298c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 22.7MB
        • SHA256 350f7d6ba095ccd0db515a8e8899e188efe3260050b8eb89457e196057f0e3f0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_proxy.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 21.0MB
        • SHA256 bd29879c3e717b16fc63df446bef1efc8124fe3a3f8b1173370b766db6ea56b0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InitializeAssert.exe

        • Path C:\Program Files\InitializeAssert.exe
        • Size 19.8MB
        • SHA256 8af1f1035b100bc7fd8f59d17c32edf7b2d0b1a533dd05e8d0f8950a8852167b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appletviewer.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 19.6MB
        • SHA256 4e388b59e600a10e162fb32975f582646297a183c8a5f46b8ecb2b0dc2be9936
        • MD5 SHA1 SHA512 SSDEEP TLSH

        extcheck.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 19.6MB
        • SHA256 bb4fe31e19ca65a76606731f8239ebc9d05b3d124d71d826bbfe5fe1ff137432
        • MD5 SHA1 SHA512 SSDEEP TLSH

        idlj.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 19.6MB
        • SHA256 55fa76ab90e6b4ffcffd3f778e1a5ded2bc1eec1372f738af3768bdbab15e4fa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jabswitch.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 19.6MB
        • SHA256 d89fafd6b5383e5fa795b0d818af0974581adcf5652929825f2d021b120c43d6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jar.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 19.6MB
        • SHA256 5a7e03e62d795636f9ae37bdd1c97506a260f848cef6da8f62b3ee85ed87d024
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jarsigner.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 19.6MB
        • SHA256 29d192d127334da81a41e536b4819f8a2f78fcfe9870066ca10279f06cc4d55d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java-rmi.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 19.6MB
        • SHA256 3abb1ce417e9f710f9fdc7722b41e2ea3c753f9814bdf0de4d9a00f827d4d900
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 19.9MB
        • SHA256 ce9c2c284150fa8189af3b3270fb4316f82ab21c867dd366e1be7a72122f14c9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javac.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 19.6MB
        • SHA256 1005ab2855ca9c7d43a18c256aeaee77992d889b34086f4606151736d6f2e06e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javadoc.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 19.6MB
        • SHA256 b1e4d94aed37b524b5ba3b3ca766568004ba884e78d3ec9073ae7701a9c6a546
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javafxpackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 19.8MB
        • SHA256 1e7f620205d4d74bc48c523bdcc68f806f36bf3dfdff5495370811fec1accaf9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javah.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 19.6MB
        • SHA256 252b000ec950a62da30c814b004b849ca19c03272fee6e7c84d92a2e3edee492
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 19.6MB
        • SHA256 6057a7ce131db806349ec67a93cd8708b792f4f92b6df9eadc75631acebd289c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javapackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 19.8MB
        • SHA256 2f2ddc55aa03d6e2e14a6d0637cc0e50fdafea83a3028a40c06fb4c3db097f80
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaw.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 19.9MB
        • SHA256 6b2449d3fa53d7c0939bd0b94e663180e7bf9f69951b066d3db7ed39f050856d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaws.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 20.1MB
        • SHA256 3a9e4bc85e8a7f4d012114ff904bdac78f2a1e39f29171c1c14c4dcca33f0fd3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jcmd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 19.6MB
        • SHA256 2b4173b486f41d1db54ce71941a30b82de6b44e15f7f64d076e82e0d30726a9e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jconsole.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 19.6MB
        • SHA256 46e1f3f0a20d86e5bafef4df93f2b487047c137a5883b0bd4dca6be577e65f15
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdb.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 19.6MB
        • SHA256 ea6fa56d7297b3660bedf72743a11ed880679cd8ec7e3bc9322035722ce62f0d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdeps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 19.6MB
        • SHA256 113061650094355ba541e0b32a38a86358633f3e7192c1042fae4ec5b19390a0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jhat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 19.6MB
        • SHA256 bb82c871a60366532b898570cdfbd7c480a70adfc834986204536e688af5b559
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jinfo.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 19.6MB
        • SHA256 9a6019e7d92562bdf60add7eb1fb525d4f5847669fd0bc5c4bc1bdea5be5990f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jjs.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 19.6MB
        • SHA256 4671e5905935d42f24ef2bc092937abc1e98e51b5a473a8d70d092758847d76a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jmap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 19.6MB
        • SHA256 266c99019a963a975dc5c95fe81d37c891316a34c1cf31e70044c8d7b49fcf83
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 19.6MB
        • SHA256 c481423b77d7de0caacfbda4d48d0781b1a04da54b54f625e418c9a2f138b211
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jrunscript.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 19.6MB
        • SHA256 7ba1701da187f321c3e50085a65077abb9134e6907b36120d33fa9a654c931e7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jsadebugd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 19.6MB
        • SHA256 99fe881a7cf3b536659f01c9c36eef0978f729c61dbcfa6f4d83467b88c9f180
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstack.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 19.6MB
        • SHA256 a6d53e612bb46469ac402a2a3563bba91d9e9fce7d316e1660d7d989508ceee6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 19.6MB
        • SHA256 85e96230f201d5f6da382abdc69ffef36588bb494841853a5611c889a040fd86
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstatd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 19.6MB
        • SHA256 8ec71e1140a91547c771317fcaf7eac51227b88fb35fd753c781378d0f6f95bb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 19.6MB
        • SHA256 0d4e25eb9e173e151a023ef38b354d5ed3ef136b9ab7549b3ce12b6da9097a51
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kinit.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 19.6MB
        • SHA256 6dda96d14e57e3cf07319bf452074f0ae6c9ac45dd6fd1b76fe1dd611fa12ade
        • MD5 SHA1 SHA512 SSDEEP TLSH

        klist.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 19.6MB
        • SHA256 cfcea897d70d8db8ac7e0cc8671927cf2ce8a02a7ed567abbee50d67b98160db
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ktab.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 19.6MB
        • SHA256 03d83bf328eb3df69070e36c931d46d4c78bac70c50c0d8253701dce836afda6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        native2ascii.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 19.6MB
        • SHA256 8cc6f774421746b936367def58be9f8199010dd31ad02bcec05f367d34053be9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        orbd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 19.6MB
        • SHA256 aa7a6aea92ff29b888105b8e963f1427cb5597415806e08b38b4e0045c8ad12f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pack200.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 19.6MB
        • SHA256 c22351835201a4a1ff46e1b469645c69f55547d9404f3dcccaa068f2cc25a369
        • MD5 SHA1 SHA512 SSDEEP TLSH

        policytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 19.6MB
        • SHA256 cfd7f4659e394b979e37c1fbbc3d6166652445167906163b8c349b0a28facc10
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmic.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 19.6MB
        • SHA256 9bb3e47c2700f16241d1589adc196b3f7d125cd50d79c57ed72a5b5c18662226
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmid.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 19.6MB
        • SHA256 fa92fc83ad2ee3962696ddfce0e9d6b30bd30008cc1bd8428b5b4b028515a2e4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmiregistry.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 19.6MB
        • SHA256 5394192693a17c753f8ea73184f1d3adf65cddc54d080d322cdb7b737ab1381c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        schemagen.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 19.6MB
        • SHA256 23849de03481bcae395d63a4adf2261e737439a607f1aa2d3fc869e66b19adc9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dotnet.exe

        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 19.7MB
        • SHA256 8a398206ed291a4f620843cf4a4d6ec48a0af132c94e2a1a64468912e19c1d1c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 19.7MB
        • SHA256 1baf3ae3e10630b3d1800b4bdf708c22d4177550c48546cf0e1d8fbe2afecadc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 19.7MB
        • SHA256 f0bfb571b814721cf7e0e569946c47f2efd5f9e5d0401106a5bf953439847e26
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 19.7MB
        • SHA256 92c032b3401bde0fea0449d6c2145b04e04c7446e3071dcd28f7809e030e83c3
        • MD5 SHA1 SHA512 SSDEEP TLSH