Overview

overview

8

Static

static

3

2026-04-20...uc.exe

windows10-2004-x64

8

2026-04-20...uc.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    20/04/2026, 14:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-20_c934878b5d62405bec16c0d894351b08_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
  • Size 8.2MB
  • Sample260420-rr4c5agy4x
  • SHA256 74482d478171ed2086f300876d3299aee303270ce3aaabb642093a76cec14e41
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-20_c934878b5d62405bec16c0d894351b08_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-20_c934878b5d62405bec16c0d894351b08_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4800
  • C:\Users\Admin\AppData\Local\Temp\2026-04-20_c934878b5d62405bec16c0d894351b08_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    C:\Users\Admin\AppData\Local\Temp/2026-04-20_c934878b5d62405bec16c0d894351b08_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4640

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 16.9MB
        • SHA256 c2227c2b6d2f1e1945a5c0fc924636c4bc3f8eb84398be1cb382eec034852e5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 17.3MB
        • SHA256 f0504ec5838d7822e3db9520746fdc141965b0c77d31111e8af927ba3bdb987d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 17.1MB
        • SHA256 faf690955ed14b44565be39c2190bc3886eb166299a8fe85fcf4d44e175dab73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 16.4MB
        • SHA256 fdc62aa935c529b3e47d488704268293a7420dc78dff0ba231fba40241fee975
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 16.7MB
        • SHA256 27eb3c0c21affc89b2a4febf2cc6aaea1f6f29547f9f80aca1306980a35e1027
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 16.4MB
        • SHA256 50e7026888068602fa1527c0f6ecf5aaacb60bc3d8b91cc4a949f3bfa7482a7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 20.5MB
        • SHA256 ee0bd5a0f923ca24d9325ccc64113c5ba2df8c6ca6d9b4d927ba8294e22d201f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 16.7MB
        • SHA256 e745221b5548d0dfdc5b94e498fbd56303bae1e872244b081b9a0a05e8bc16a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 39.9MB
        • SHA256 1def559e328d7ae47f3309e89a878ba1fd3a1e672e7128bbb7c7a683df659938
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 18.5MB
        • SHA256 cb5a5348b4d4c049204461d7691384ce6759e3f83ab64062b2872e192b71b246
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 16.5MB
        • SHA256 faf144166f16f3c51297dee76120923eb95cac5c4521845fe297fb754ed97623
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 22.5MB
        • SHA256 ab0746dff63e458dbca174faa20dc875e4c25683b57edcdfcd33f107a754ceaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 18.1MB
        • SHA256 e4039608e401a57b68076970591349655b202a55cf7344518505af34d5c3276f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 19.9MB
        • SHA256 e958ad48c41268b1f4acff8c0a64a5f60eaa3b70baee699a445e359a9ce85806
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 18.0MB
        • SHA256 2366e7946de22e524610497cc05728eefc5a56484d5c545e8f4eba657a573c02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 18.2MB
        • SHA256 3817baa25060187f036a8b896f4242140c736f032b06131e543cf724c00cf6e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 19.5MB
        • SHA256 7d3d3c1f5596e9f0d6ff96ae8841880bf05d6448bade5dbd40b2cc56dddb81c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 17.8MB
        • SHA256 109674ab036ba2c32dfdc5e2a740936e4a37aff3ec330b6a1fdc5680946f235d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 8.2MB
        • SHA256 3317a2dac81338614151becbc404492817cdf8b3f6f08decdf7b3bd1ecb34099
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 16.4MB
        • SHA256 e0b9e728699b1674f89df7d00339276cb5ee1f8630e25e47b1557c1355c0cc1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 16.4MB
        • SHA256 d924742fcdcc2c2d50ac476a68ea20afbae7037b5175f585854a136e25f5749c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 16.4MB
        • SHA256 ab2f9d31b3c1c3d992bfb28c6feab354e846c2ede412753936305dfbc26b8577
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 16.4MB
        • SHA256 f81f6b66a0cf5482d4c0cc7f7a005e0594dbdf5284d0b978ec0dc0333c787ac6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 16.4MB
        • SHA256 232f1874de8d025a6f73918b0e47b0b59ab883f695d7d83d4eb171f36aa891b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 16.7MB
        • SHA256 a949b73c6b9259451cb320e0375e2b41c59517d22082d7d73397fc0cb0c775b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 16.4MB
        • SHA256 b20a84b15506086d435f363341f10a05ef3fd5cc6f63faff6921a09e267a1ea0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 16.4MB
        • SHA256 96cd91a440313676f7e4b31cba42ec7433cab12d119d526bc96aba4c01936d3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 16.6MB
        • SHA256 e61754a08770f72d8f1d7be6c657b2c9c6050e61b7a1697279b00e365b8fdd1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 16.4MB
        • SHA256 386092e1486a2cd03ae40612d2941bc689a2ff50c171681309874d329f44b3e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 16.4MB
        • SHA256 b60d780fcf1b431a921c38cdf22485153a9cc1de2978c4c71ebe2db8ad7d5214
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 16.6MB
        • SHA256 0eadbec8edaf3672f8fd47a60cfc408d32746948863bc44802427f401e03b83b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 16.7MB
        • SHA256 e4ff5e817dceb0def973f26468e0b4138dfa15f060d8c3ef1c0881cd654ea309
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 16.9MB
        • SHA256 f99d4ad3e99fc2d06053ab43bd53e1b58d8ae2d970873cf0d91e51261c7144f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 16.4MB
        • SHA256 19e6f44d69eea4cca09bc0f3575385d316c889431e7c031a08b8d94fcf6391fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 16.4MB
        • SHA256 26872f5eb9134cb720589dcf0ab678d7f760e1126f577c0a6e2320051b678362
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 16.4MB
        • SHA256 f94dfa05c43e8a25f204e6efa43a114cbf7701fd38b3ab1d7f0c27a2fb135864
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 16.4MB
        • SHA256 4a941bea64d24ddda0c25478047aa97175a043e907d2debe4bee949d33fbf524
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 16.4MB
        • SHA256 4bab669efd87e50004c639bd79f23b4d87db5e024c9b1e5cc15d83a8f4055cad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 16.4MB
        • SHA256 ec76d8b1559b690f4f0570a30fd1252731f92ac0af10e4d5ceae0672df6d3a74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 16.4MB
        • SHA256 49e272049c67cd9205dbed1f094b445b75cd81fcc18940b2e24c42f30fe09e9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 16.4MB
        • SHA256 f42c10526c444a75fdaeda4ed91e13da0bb10064bb2035fe0c0381031dcc8621
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 16.4MB
        • SHA256 9b929357a5b6b65bb5b4e8e34878293d886416117abf4c770513334d3ead1a3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 16.4MB
        • SHA256 759c68027dad771d7ea72906bcdf488a7f346b1ffe7f7db9627a01b5c44b13bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 16.4MB
        • SHA256 c31e669cd9673a6eb32cdfbcdd67e5f69d4acf889db709e9468b6bfca996eb45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 16.4MB
        • SHA256 1e2c56b9dda3d73ffb093ef229052b619f0f90347412695c1d75e7bd5b7fe23c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 16.4MB
        • SHA256 eb201e532f607525de64903d655ceda247467d525bcfcab1f166befa6338891c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 16.4MB
        • SHA256 01f87b1812bc0646b635f63c137e4d8ab7b10d23c2fe6021b435fa0341fb1cea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 16.4MB
        • SHA256 c2d8f56550e646160365866e19851987911d07db27391ecaeae330fcd658988d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 16.4MB
        • SHA256 1a93e9e2c5e80dd4ad356faf8218d98898b73ddff45570f5eeca6fc43c4e2753
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 16.4MB
        • SHA256 a07438a5ab8274abd68891a9dc74e4e1b6957da2303c4fc34d253e485dc91408
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 16.4MB
        • SHA256 24ef9026f2a4d1fe4acd19ad020b0472096d33384c913a6e389bc24e6154a4b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 16.4MB
        • SHA256 3445c9e814fda6c714d879107a063f78275d7f7cc911a1c4610624e98056c338
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 16.4MB
        • SHA256 0eb88fd7f5c3f4a1c219261710407d25b9365b0d2c01dffda0640667e275547c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 16.4MB
        • SHA256 035ea098b791d57fde78825fd1f4b429a5933ae0c7541fbd7e775ed409d5a823
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 16.4MB
        • SHA256 76a338e256af9d681104e484f47f63bf040401cc0dc9a4540bbd8d654004652a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 16.4MB
        • SHA256 9419205253cfed3a5fa2f203ce355c50c1c189718acd49042eb03449ec893409
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 16.5MB
        • SHA256 e047739ffbd2a47f8e4e441c67a0b8fdcf4e7b055472d9a49526b7d687b67206
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 16.5MB
        • SHA256 51421340405ec287acad7ad09a65e84e67166331d1be1e804f63cd887919ceab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 16.5MB
        • SHA256 268f152b2dcd699a4d204771c1772db9dd1df4c8e5f1c89103cfbae26608920c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 16.5MB
        • SHA256 8a0dc3348e80f0b96f52ab2d2e5a16f384d7191d169f0f131ece9007e929649e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 8.2MB
        • SHA256 74482d478171ed2086f300876d3299aee303270ce3aaabb642093a76cec14e41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4640-122-0x0000000000920000-0x000000000099B000-memory.dmp
        Download

        memory/4800-121-0x0000000000B80000-0x0000000000BFB000-memory.dmp
        Download