Overview

overview

8

Static

static

3

2026-07-07...uc.exe

windows10-2004-x64

8

2026-07-07...uc.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    39s
  • max time network
    124s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/07/2026, 22:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-07_cc2533f7d37d0d9544a75a581dd1cf77_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
  • Size 38.0MB
  • Sample260707-2kagksft3x
  • SHA256 78f07565f2395806ab62308c894a540f2461a8e0fe9b43368564588b9e93dc0b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-07_cc2533f7d37d0d9544a75a581dd1cf77_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-07_cc2533f7d37d0d9544a75a581dd1cf77_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2704
  • C:\Users\Admin\AppData\Local\Temp\2026-07-07_cc2533f7d37d0d9544a75a581dd1cf77_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-07_cc2533f7d37d0d9544a75a581dd1cf77_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4984

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 38.0MB
        • SHA256 cbc49bf0ad88675af52bf2c577ffe5bfbd0b93acd5721117fbe5391482bbe65d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 38.3MB
        • SHA256 fdfe2242689b057ba346f532781af4ee5390a22423390d567bba13a8997f8498
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 42.1MB
        • SHA256 0074559620382ef22983499f03332858629d7713b0fab3bed56939ce49e98cdd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 76.3MB
        • SHA256 ce46bd6d422ad049d4cad7f29d6db91efdbbfaa66a45d42858d6d7baf73fd798
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 40.1MB
        • SHA256 b6d1d112897a05fec58bd02e55670088dab09d2b7582b609b6be47f60bde7041
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 70.5MB
        • SHA256 ac8113319f8d6515ed648d873af19f691a9cab241471513527b3d085385f9baf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 63.6MB
        • SHA256 9fbfd7f116d61a44882ebd50c2b3c75cd6061cbe61b7779797461da1b5faf714
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 62.9MB
        • SHA256 71e233a35df9d4e357f3eb399f6c23aaced804eca50ee2fd98997d717d49731b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 64.7MB
        • SHA256 482822567188d626fc326777bcd08cae85f8c415ca6e3c2e120ce90feedce452
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 64.1MB
        • SHA256 b36a40a9037e47f0c6c355ee40fdf7d1b67b20f480332349fbcbbcb62fdf4c40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 63.2MB
        • SHA256 1f53647476dbbdb5ad27609fa4fc31e8f6ea604dd312ce569265ec15ade82df6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 63.7MB
        • SHA256 0ae583e6f1fce61fdb8e167bd59477c64f545367abca4d5e49f335c2ac73f5e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 59.8MB
        • SHA256 d2a027a6d9d254b29d1874c33ca8ad01c2ff661c223e44688a73092875830fc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 55.8MB
        • SHA256 93d40620d0cd77ee77231ca65d8a792af278621a4748e16caf370643687f75b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 55.2MB
        • SHA256 7c2ae16e6367835714e7b9b7b33e1e8a0e9069809b26977bcf88e0ca1ea45ff5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 55.9MB
        • SHA256 d1bb63463291bbdc7b2f7d1ee66490c8921ce0967f5f008d45da84df59c44194
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 54.1MB
        • SHA256 3d592ec1f60b46074ea17db0dd97952696b75f3d384565fdd0459a59012fbe4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 54.0MB
        • SHA256 aa6203d66419c0d431a9cbbfd6bf339003b514688d5d20f33361a7e2dfce43e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 52.1MB
        • SHA256 10f204e2974502d5c3c2a616ec8edd5a32e8b9c4699a8fecc495d6cd8dc4a4a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 51.6MB
        • SHA256 a1502a684813cb4d5f8860b013bea395641eb6dc251e0f43ada45934c9da8e55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 50.6MB
        • SHA256 e9148ac0e79c127a78428eb8cee14f9bcb11955f389ea02dff2dbbc7bc0e2a51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 48.8MB
        • SHA256 d7914a703c131d1321c6266b9e2b7ffdc1d5a9ab48a26ab9f819da8fb1e34dea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 48.4MB
        • SHA256 1c28dc556a1f950dfe7dbebe590c6c693186ef9f181cdfd30550a0b2b9a30398
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 47.5MB
        • SHA256 b866bd8c324e1667ebce5bcfa08799f2d859c137c26eb444e8bfb70708155337
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 46.6MB
        • SHA256 3ed1e1575e6fd9d478bd58527df2444883a22d710de7d9b2bd145dac5b56ca5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 44.8MB
        • SHA256 4e2c36c448a4ec3ccc6cc46109d1f702a49ee4b22cf88a0826931311aaefe189
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 44.2MB
        • SHA256 81e06ca2715ef0171a17ef17f597951a6f6eefe854710b88e3d50ae2cc776d92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 42.5MB
        • SHA256 4fad9e75a0a262c00cfe5a5e6cffcfbdd0c441d1b51361039bc82a44d194662c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 42.3MB
        • SHA256 d2dff3faf0ed06e4c838426aaa278a34641123fbdbe0c92ff7b72ac9daf50e13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 41.0MB
        • SHA256 653179ac057139c4d79e71b86358bd18bc382cc4d4f387032cc2d0fc95178aa3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 40.7MB
        • SHA256 145340bb6dd847f9a4791211b61d1059d116c6483df2bd92109b6dbfb5178c87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 40.6MB
        • SHA256 71c0061c6fd90a4fb8f2a8426f2dd3bf5796aa13655f61102a8621795b292188
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 40.2MB
        • SHA256 3e4a7277c1bb7b6c10779b15c4543a51f46e79bd1a9ae716ab4cd0fc37a0a917
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 40.0MB
        • SHA256 a4b38e634f806b39acd08513c7f236e89135484a66fdd9ba58165b10617869de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 39.6MB
        • SHA256 1fe652c595f974cbc634acb281e477184c74cfdf497e81f33fd73625c6384e71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 39.5MB
        • SHA256 99b5ae13f507598ec35f126f0c65212a2dab5d4b5b2bc365753b053f276cca85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 69.8MB
        • SHA256 d5baec969636587e58523eba2de902e2ae895ffe51e4067d714a2fd1400900f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 68.4MB
        • SHA256 58ee097b24922a70d3cc40ae6480c892071ca21786a84297092a7e3578cb0ee5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 66.4MB
        • SHA256 b04fd53188c55652683e9adc80244875adcac92fae9b6328b7a3c8166bfbd110
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 66.6MB
        • SHA256 8ee962d0e945297002bfb779e3618f6ca06e301b831216b267d6ac22de5c95bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2704-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2704-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4984-10-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download