Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    12/07/2026, 11:49

General

  • Target
    2026-07-12_b7e5853e8a1c53db1163d8b7a71c6ee0_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe
  • Size 5.9MB
  • Sample260712-nzgbsaa16w
  • SHA256 9976751d1564d7e5a4b449ba58ebf0efd42e3d15f834a6eabd0356cded1fe371
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Control Panel 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-12_b7e5853e8a1c53db1163d8b7a71c6ee0_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-12_b7e5853e8a1c53db1163d8b7a71c6ee0_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3364
  • C:\Users\Admin\AppData\Local\Temp\2026-07-12_b7e5853e8a1c53db1163d8b7a71c6ee0_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-12_b7e5853e8a1c53db1163d8b7a71c6ee0_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2016

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe

        • Path C:\Program Files\7-Zip\7z.exe
        • Size 6.5MB
        • SHA256 f1c94b7253c83efa7f705a1156dca4ddd5a25ae5e852abfc8a167ced5d3fb6dc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7zFM.exe

        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 6.9MB
        • SHA256 0e13ad77c3a9d632537257092c787f1462270216f420297cfa18206dc15a20dd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7zG.exe

        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 6.6MB
        • SHA256 4ac3783146a3a436bbff13d3f8cfd5bd59f0f2eb8997f8350b18fc1253f06046
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_pwa_launcher.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 7.6MB
        • SHA256 b895f4c1c213c9e1983e9e4412c3bbade1e73f1a34e857b254cbe83e180e9f8a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notification_helper.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 7.6MB
        • SHA256 37dfdb59d5addae139cc03da4ba7111b59e9509d3a086f47307813ab0aa231d0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jjs.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 5.9MB
        • SHA256 a007a068d150434ad674676ff182a632388f3051a3faa22b3c4bb31f58689bee
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jsadebugd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 5.9MB
        • SHA256 db719d8ab6d62ab4dbba02cb8e9c0a7d575d7e09ea16d5ab67127f67cebafd27
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 5.9MB
        • SHA256 b42639c09beffe289684773cb37a3d22c9187bf2e3f8904993baa302033d160f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tnameserv.exe

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe
        • Size 5.9MB
        • SHA256 e2feac09d33dbfecb8f37087ea15e3166c7c47e700432580e5bae301438cc28e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        unpack200.exe

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe
        • Size 12.1MB
        • SHA256 210b955b717b2e6ede86e02e8666fd8094b3e3e09d5e1f8feb5868093a5317ef
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fontconfig.properties.src

        • Path C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src
        • Size 11.9MB
        • SHA256 2dfc139090a976c45f8c46236912dfb8ce96ff6897929c966c363ee2d9e6035d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jabswitch.exe

        • Path C:\Program Files\Java\jre-1.8\bin\jabswitch.exe
        • Size 11.9MB
        • SHA256 2be7826aafd8f831c3f87c8fbc081a73be75967328bc0f475d649c21c21b9a87
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java-rmi.exe

        • Path C:\Program Files\Java\jre-1.8\bin\java-rmi.exe
        • Size 11.9MB
        • SHA256 cab757b74fd3969fd3fd905064e71ea36da570c40adfc010566081ba79d9f9bf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java.exe

        • Path C:\Program Files\Java\jre-1.8\bin\java.exe
        • Size 12.1MB
        • SHA256 c903b1104e32e0fb110df516b530215ac1f3026aa9f19b7b3168d5725f6a2ecd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javacpl.exe

        • Path C:\Program Files\Java\jre-1.8\bin\javacpl.exe
        • Size 11.9MB
        • SHA256 1716ad1e1835e3726280c222d78f1738e2600064a1449d447ebeb924158a8725
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaw.exe

        • Path C:\Program Files\Java\jre-1.8\bin\javaw.exe
        • Size 12.1MB
        • SHA256 dd798676023b2b16b07a90e47d8b85e3cbc85eabe28e14237906ab4edbee4fd8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaws.exe

        • Path C:\Program Files\Java\jre-1.8\bin\javaws.exe
        • Size 12.3MB
        • SHA256 c0df4b02561fe69a297014d8176e9da51a9256477162eb23e7906924fbb39cdd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jjs.exe

        • Path C:\Program Files\Java\jre-1.8\bin\jjs.exe
        • Size 11.9MB
        • SHA256 682b9ddc50bea485b4aeeaf27f03367a921794bdd081256a82ab8d3e30baf83b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jp2launcher.exe

        • Path C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
        • Size 12.0MB
        • SHA256 0668b56dd26753cb7cdf580b105cdc9e291d4afcbbbb1cbbe690aa771a76ab4f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keytool.exe

        • Path C:\Program Files\Java\jre-1.8\bin\keytool.exe
        • Size 11.9MB
        • SHA256 5e160c2c62119e76fc24f04f7831df7658cf5441dc8a8ce8d1050995d9d0fef3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kinit.exe

        • Path C:\Program Files\Java\jre-1.8\bin\kinit.exe
        • Size 11.9MB
        • SHA256 07b8e2a36f519290554462bd236284d7706ba8e6afa866797067b3ca6f5ffa66
        • MD5 SHA1 SHA512 SSDEEP TLSH

        klist.exe

        • Path C:\Program Files\Java\jre-1.8\bin\klist.exe
        • Size 11.9MB
        • SHA256 382b30eb38cec2c5a4ebee8639515f473e439052231c353151e24c1b77ca9bf8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ktab.exe

        • Path C:\Program Files\Java\jre-1.8\bin\ktab.exe
        • Size 11.9MB
        • SHA256 171d93852beaa6ba6a60d47a6efa85d600fe1a5f41d80c03a0ae0f7bb2f8ba41
        • MD5 SHA1 SHA512 SSDEEP TLSH

        orbd.exe

        • Path C:\Program Files\Java\jre-1.8\bin\orbd.exe
        • Size 11.9MB
        • SHA256 36b769dfe445fea429a2f71d3c663aa62681b25bc1596feedd840775c5126444
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pack200.exe

        • Path C:\Program Files\Java\jre-1.8\bin\pack200.exe
        • Size 11.9MB
        • SHA256 07525812a5630619784581b54e81460a5738c117a0d5419b475de989662b404f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        policytool.exe

        • Path C:\Program Files\Java\jre-1.8\bin\policytool.exe
        • Size 11.9MB
        • SHA256 048bd77784bc99d7287cf38aee299265d4d69f3581f24040a363e831ebe5ba91
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmid.exe

        • Path C:\Program Files\Java\jre-1.8\bin\rmid.exe
        • Size 11.9MB
        • SHA256 9be8108aa2a461aa31aa97c57bbba0ce89f90985499715e2490c74d687d279f4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmiregistry.exe

        • Path C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe
        • Size 11.9MB
        • SHA256 14fd8f440a1b2d85207b41e10ba316d6f47e5a440ad90f0629c668c16eccd705
        • MD5 SHA1 SHA512 SSDEEP TLSH

        servertool.exe

        • Path C:\Program Files\Java\jre-1.8\bin\servertool.exe
        • Size 11.9MB
        • SHA256 a758ce4c75a7ff42df48f9daef7403c5b35bf0646de96b1bb7ced716643c0cd3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ssvagent.exe

        • Path C:\Program Files\Java\jre-1.8\bin\ssvagent.exe
        • Size 11.9MB
        • SHA256 a58cbb33a05807266b40ecc9ffca0d7ab966318dbcb5c13122a311f173c0a33d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tnameserv.exe

        • Path C:\Program Files\Java\jre-1.8\bin\tnameserv.exe
        • Size 11.9MB
        • SHA256 605d3eeda49d4b553021518ee8c4709d8456a696892601498ed9827b0d5c865a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        unpack200.exe

        • Path C:\Program Files\Java\jre-1.8\bin\unpack200.exe
        • Size 12.1MB
        • SHA256 b03cebc7c9bf2ae698e3d0a4dba234c5b9379dd4b3f995c0f8ee79789bbbf990
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppVDllSurrogate32.exe

        • Path C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe
        • Size 6.1MB
        • SHA256 411a0458668f2245ed0dd522a0d834047b93c6f66f8a7a23d4d565c813687e6a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppVDllSurrogate64.exe

        • Path C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe
        • Size 12.1MB
        • SHA256 0e104997730d6846373cf9607e08bd679909498ee82601de7415749817a6d408
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppVLP.exe

        • Path C:\Program Files\Microsoft Office\root\Client\AppVLP.exe
        • Size 12.3MB
        • SHA256 1685e759773722201af2fac24125b33a7615c4b4d24e9cf2e2554ba030f4d374
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OneDriveSetup.exe

        • Path C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe
        • Size 38.4MB
        • SHA256 6e1b177eb52c22bc2829f78e394628bf8a7d57c6bd5497162df7a1bcc8f33ae0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Integrator.exe

        • Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe
        • Size 18.5MB
        • SHA256 25c8685ea10dc67695d1545c585e82fdf6ebe5a91d717fce50f4729a0b5ac846
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Microsoft.Mashup.Container.Loader.exe

        • Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe
        • Size 11.9MB
        • SHA256 3cfe80ef1ec850da181bb05be0deb3c026ae2a95cfd569c18f4192caa5e9075d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Microsoft.Mashup.Container.NetFX40.exe

        • Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe
        • Size 11.9MB
        • SHA256 b2c94407cd89384ea4b4d6bd536ed6bf294b90e471945b43267618476e59d772
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Microsoft.Mashup.Container.NetFX45.exe

        • Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe
        • Size 11.9MB
        • SHA256 a05739fd5d31f19e9ef6ea9acfbfc8c281269c93dfa982b93843b470c0334ece
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Microsoft.Mashup.Container.exe

        • Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe
        • Size 11.9MB
        • SHA256 1a93d9beda162844197683b5b35c4a227112d1dffe91cd43d658c3c6dc87fd1e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IEContentService.exe

        • Path C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe
        • Size 12.2MB
        • SHA256 235f81ac40f8c40e36b7696616a4f5ab1798d8c049f26fd1bd511ab9be7462d6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PerfBoost.exe

        • Path C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe
        • Size 12.7MB
        • SHA256 f2e7647135270f80fecd17c36d0ffa66dd9530e07caefd3b3b35e9b3f6e10a56
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SDXHelper.exe

        • Path C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe
        • Size 6.1MB
        • SHA256 352d8c666c8e6aca4bcaac62662e5f09287c62eb05e2e507da0d853191e022b0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SDXHelperBgt.exe

        • Path C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe
        • Size 11.9MB
        • SHA256 410118a1330d0d91d4ec48cd4167ec3d17d52ff7b68246744f58298b839026cb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Wordconv.exe

        • Path C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe
        • Size 11.9MB
        • SHA256 e8135113ad5661932c0bc8b766ff32242f19b897a190a72536416f95dd93ee1f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        misc.exe

        • Path C:\Program Files\Microsoft Office\root\Office16\misc.exe
        • Size 12.8MB
        • SHA256 4b7619a151d522473634653924107593a6e4247fe32bc4e12fecf89f904ac542
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msoadfsb.exe

        • Path C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe
        • Size 13.8MB
        • SHA256 618fe95884a79cafc6a423d4a724abcac40bf6e1276c39d10af7f56ee48fedb9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msoasb.exe

        • Path C:\Program Files\Microsoft Office\root\Office16\msoasb.exe
        • Size 12.1MB
        • SHA256 c765896407c5464c9796c118458e8124dcea93c13159d3530f26af6f96f8e1db
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msoev.exe

        • Path C:\Program Files\Microsoft Office\root\Office16\msoev.exe
        • Size 11.9MB
        • SHA256 d0e7765cc2d5aac544aa45ef5f7aca983c66f59b0024ffd62b2315c0436acbb5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msoia.exe

        • Path C:\Program Files\Microsoft Office\root\Office16\msoia.exe
        • Size 11.8MB
        • SHA256 9dcae619331eb43e63aab339859a73967691bf07ce6137ba2a1a2efaefa09982
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msotd.exe

        • Path C:\Program Files\Microsoft Office\root\Office16\msotd.exe
        • Size 11.9MB
        • SHA256 8b261c352325a5531c044f46d96e1154048991c0944db1a770b363b9f79c4260
        • MD5 SHA1 SHA512 SSDEEP TLSH

        officeappguardwin32.exe

        • Path C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe
        • Size 12.4MB
        • SHA256 3049b4c258cacfb58fc6dbd5a47a3c674a305684100201128e7c7ca83b1d17a9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        protocolhandler.exe

        • Path C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe
        • Size 18.1MB
        • SHA256 5eb80fc34a8aa4929560304d271523ddd272702ea4a74018acc320abb1a7b037
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OLicenseHeartbeat.exe

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe
        • Size 13.8MB
        • SHA256 768d129e8f317ae1dbf3a635fc42398335eeb26b6058117c25b4e89441417e0c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SmartTagInstall.exe

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe
        • Size 11.9MB
        • SHA256 b231f799159fca5e19012e664297bcc15a3d5d252b9778af63c4621739994f36
        • MD5 SHA1 SHA512 SSDEEP TLSH

        eqnedt32.exe

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe
        • Size 11.8MB
        • SHA256 4be175efc29bed314dd1efa1f398282a2d065ac9c0463fa9c646d9e0f2caf830
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SQLDumper.exe

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe
        • Size 12.0MB
        • SHA256 474bdf04b833d4471ea90e4dd426acf88c6bfb274b60bc4e302d6dce7a1935b2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SQLDumper.exe

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe
        • Size 12.0MB
        • SHA256 b2717389e9a2b8560ea8c05e0036c5a6e373be1bc24f1c91ced8e2c52c2ae2ba
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppSharingHookController.exe

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe
        • Size 11.9MB
        • SHA256 19f236a815d01ddd7634473ba1f0f4f73c85704e23cc4f707a0934a1e0b14ab4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        spo0lve.exe

        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 5.9MB
        • SHA256 9976751d1564d7e5a4b449ba58ebf0efd42e3d15f834a6eabd0356cded1fe371
        • MD5 SHA1 SHA512 SSDEEP TLSH