Overview

overview

8

Static

static

3

2026-04-15...uc.exe

windows10-2004-x64

2026-04-15...uc.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    16/04/2026, 01:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-15_f00a530328a3d2cae13b40ec8bcd5563_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
  • Size 25.2MB
  • Sample260416-bq2vxagy2s
  • SHA256 cc2d83c2d3a418a595721f0cbd0b6b3a2ae73be6be8b21fba955423bf14dc2e2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-15_f00a530328a3d2cae13b40ec8bcd5563_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-15_f00a530328a3d2cae13b40ec8bcd5563_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1332
  • C:\Users\Admin\AppData\Local\Temp\2026-04-15_f00a530328a3d2cae13b40ec8bcd5563_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    C:\Users\Admin\AppData\Local\Temp/2026-04-15_f00a530328a3d2cae13b40ec8bcd5563_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4936

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 25.7MB
        • SHA256 3fde60b302cc4154f7461515cb7388e808166d3a357b2f24b681a426d97c51e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 26.1MB
        • SHA256 02cb9343fe90854e5d7878b04d83014eed51d666e8a05f96eaffcb3f88e17f6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 51.0MB
        • SHA256 23bc05aaa90feda2aeca3f55c6b7d25c3d223acfd5d0e8afca5e88b334a05009
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 50.4MB
        • SHA256 069bf8789d8b32c15fc454fc2212a3a2ba662c576d99b2a9858dbcb9c02e8ec3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 50.6MB
        • SHA256 9700d25d15c844a9958ac50a57fa81ed513282bffe3b8538d9c5941e43f98c3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 50.4MB
        • SHA256 0a279cd7b636b5702636d02cdc1c8b2687075ce2391d4ed08e5edead7ab60f65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 54.4MB
        • SHA256 e7200575e25cd46ed7ef76ec9a90f961ef0a6134bae1ad8a8eb8a82f0e22521e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 73.8MB
        • SHA256 b43da1dec83f74a46ec78836c21937a5aac3fc17097a0571536000f8703c7cb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 52.5MB
        • SHA256 41c92e96fa00da5b19ff0d4c0c51b781e6954c7cbcad99795c25d1cf555219c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 50.4MB
        • SHA256 7496a8921357479a57893db0a34540588f6a72ec1752288afceb7deb54805fa6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 56.4MB
        • SHA256 a2c9357f9f24756454ef11d018edd925ba4ef9aa163dde857a816dfce014d852
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 52.1MB
        • SHA256 bba165e5e4ebc827d6b0dae2f112ea3c6616269df22171cbe1c7d1f5bfcbf5b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 53.8MB
        • SHA256 10756f91de9cda718ba0742980eb5972dcfcdfb790b9e7ae87a74695e77652a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 52.2MB
        • SHA256 37a61656751d094aab130b205045bd74f1bff9c8db239a4255bce339eb673e82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 53.4MB
        • SHA256 f1290ea6223d2933426864de33cff77548774a0d4b643bd84a1248a38a31a12b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 51.8MB
        • SHA256 98c34f50e233e890395325befe1d0f7311f480cb7ebbac01081477effb577d64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 50.4MB
        • SHA256 f5f16a61bb5c265038e4fd79ec05e43dfc7b81951445035078014b26b98ece74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 128KB
        • SHA256 c845e57c2a12493146dd94d766bd3f762d2a164e99d493cdbd76d3b229f5789e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 50.4MB
        • SHA256 e604a5ab00c0aa417cca58e673f0348d3b34b748290bd2c7e98bcf1451110039
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 50.4MB
        • SHA256 7efb8527217489bfc0c4b6e10dc5d51ba205497b36e7d99142aaa1f2602d2eb1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 50.4MB
        • SHA256 bd9c6cb37d398e7ed432a670f40e980767d620063acf9554c7e3fa15a6ffb3f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 50.4MB
        • SHA256 8c7c7ffbafd63ccbfc208fd6f5723951c45ce4d1814bcb2a6a160ff89437a9d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 50.4MB
        • SHA256 7f041832f1c9596a771b3aa577d51e5fc0b4ab4214a7a9796bad91129b6592ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 50.5MB
        • SHA256 187b663643f52a22ab37f3bc86ecd4df98f4dbae52b7e12c4e704499ae674972
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 50.4MB
        • SHA256 ad7abfcd68412b44c919569cd71c7e89cb2330edf37e856a8568303058bd05ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 50.5MB
        • SHA256 29e8295976b91e0a564c2c09512ad1d283a8c386dedf51caa66c61ae22948d72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 50.6MB
        • SHA256 05daeb57c99385e67a99a1133b65557e97838567fe9c656b80a110310815a090
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 50.8MB
        • SHA256 749faa1eaa46ab7160d2245fc25b6f9d5b5b9b80e12bb8dbf1cae6300fdecb1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 1.1MB
        • SHA256 ecaf289ab53c2c915c709cace7fdd86d01ca9f290677955629e518e2a65bf14f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 50.4MB
        • SHA256 832f4f5424ec29ae7e0b772890e7295de340ec484c0ad9c881bfd02a82d4e5b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 50.4MB
        • SHA256 81b9e24c8162d077239cef03c64ec6f016dfac77c19a573df6e9928cc76a5cbd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 50.4MB
        • SHA256 57fbcd4c12d61ab3b6618b41a9b9450dffd2c9d2955e6ee1ffe8bf89c5363b70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 50.4MB
        • SHA256 29025e3ee03acd07f4d3fcfaf8195aaf395af5c64f73517c45b0aecc07bd87f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 50.4MB
        • SHA256 c3ca4d187eb75597afdcbe6aa0686b5f32d476fdb7d7670aa47f49fad09869e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 50.4MB
        • SHA256 704d983a44aacd898e534504b8eac43fefa2927eefc48e77ef9d685a921e330d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 50.4MB
        • SHA256 792564fb9e79c1df35b50c1fa331ac6e1073454933a13c69dca5191fa67850ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 50.4MB
        • SHA256 bd38a0ccf00d10d164b439ea9a67cccb1d9fb3736202a3174b277e3339a7392c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 50.4MB
        • SHA256 99c6d194fd64ea821e8cd29024e4669257c4a6c46001fa23f9d2cf06c0f3d898
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 50.4MB
        • SHA256 ae99fd5f6f52e57047608c1684c7c9e292dbe5bbe0ac4c0baa5854427e44a12b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 50.4MB
        • SHA256 7eff25b2d52eee558c58b3ec90bb3135280dbb8bffff1e813707a66f689c02b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 50.4MB
        • SHA256 37ea95344f98d9af70cdaefaf4aebfbb1435701f2e304faeb2c944310fa7ab19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 50.4MB
        • SHA256 8ecb24f7c0bbc422618b9e557f95160ffb3886eaa697df60bbb80214753a29b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 50.4MB
        • SHA256 6960d02fac0de203cdd4d627b81232877a9ac60adb56eab9ba8ba4920eb10363
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 50.4MB
        • SHA256 bbe7229fb267b235b8793beca5b23446788dd8803a329b7660dda1537d4fc1f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 50.4MB
        • SHA256 8754dbce866f0f5ddf11c26e802bd56ecbf8b2f52422d801678ef3ee3b320e05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 50.4MB
        • SHA256 4a60c1d99db693f2a6217c321d2170d4bf23a9c34c42a46956ce045dcf1f5355
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 50.4MB
        • SHA256 0a7e497051c271ee0e192b8b1fbdd39acc019cdf8ae1a3a2b5c52a3a576f5d03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 50.4MB
        • SHA256 4fa4efb425c6ba9d6f066db52db35e216221d13a79992cee95e28272b4986c4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 50.5MB
        • SHA256 3494ab024f9a6a64f11d7a0ccf64c73b7618a0b80c42c3c575146267a45ed3b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 50.4MB
        • SHA256 0c643b38d86cb0d9eebba37c8d745a5bd5fcae914da660b7886505af3661979b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 50.4MB
        • SHA256 72120bbddb6b8ae30bf1031d2d400e55ee882a8f04878c59e1e24ea707c115ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 25.2MB
        • SHA256 cc2d83c2d3a418a595721f0cbd0b6b3a2ae73be6be8b21fba955423bf14dc2e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download