Analysis

  • max time kernel
    149s
  • max time network
    89s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    12/07/2026, 11:49

General

  • Target
    2026-07-12_b7e5853e8a1c53db1163d8b7a71c6ee0_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe
  • Size 5.9MB
  • Sample260712-nzgbsaa16w
  • SHA256 9976751d1564d7e5a4b449ba58ebf0efd42e3d15f834a6eabd0356cded1fe371
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Control Panel 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-12_b7e5853e8a1c53db1163d8b7a71c6ee0_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-12_b7e5853e8a1c53db1163d8b7a71c6ee0_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2972
  • C:\Users\Admin\AppData\Local\Temp\2026-07-12_b7e5853e8a1c53db1163d8b7a71c6ee0_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-12_b7e5853e8a1c53db1163d8b7a71c6ee0_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1292

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 6.2MB
        • SHA256 eecc7345b7aef0d67be77f3e12d4963c19e05f458f1d59eddab2be508d862e60
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InspectorOfficeGadget.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 11.9MB
        • SHA256 7198828a423d401a37c509398ae43736b29ce42e3beec12639d2133b95b9d986
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IntegratedOffice.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 15.9MB
        • SHA256 fc3257ed8f814b1d6208aab4f6b9ad1f2cb9e5a7e8b17722e5614c5d357de23a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MavInject32.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 6.3MB
        • SHA256 2c29c68c1a9fb1ba094ebbe6c653aa9e39e2777ed19276d791ea8c0c0e05caba
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OfficeC2RClient.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 29.4MB
        • SHA256 230d08d6f25c5817b4782af31968d8c234d7cecab3364db394ed6bfe8976a5d2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appvcleaner.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 8.0MB
        • SHA256 2c83694865c3676a1c8ade62fa34f511c72d62f74597bf7dc66eb8f8bedc78a2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VSTOInstaller.exe

        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 11.9MB
        • SHA256 d0055af2192c18ff20763863ea738f3fea85e20d2c40a7f73de3808479b1f08e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrmstp.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 17.9MB
        • SHA256 313bc8b5eb54282506530f0f14b17dd8dc3dafc9b18f193343744b582a774ca2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_pwa_launcher.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 13.6MB
        • SHA256 3620987b6373d5b30a30e126bb801163445f4dff77a234e03cde775db5e4efb1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevated_tracing_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 15.3MB
        • SHA256 fd7884f932f523047836d03b9649b4a7ee0e309a5cc750b34685c02859445083
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevation_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 14.1MB
        • SHA256 5efece3ffaeee5997c17fb9d34f624f049dd2a2a11246d1ddf4b7370766f274b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notification_helper.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 13.5MB
        • SHA256 21121391c858c20616476ebde7213a4dee7978045eabb580358c0e42e6de7ce7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        os_update_handler.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 13.7MB
        • SHA256 0a6b950f2646229a033ff7f4bbbd19ad87661ed04dd359eb3a18853375aa499a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 14.9MB
        • SHA256 f2e7ae8e48c4ff16e935d116215cf37a90aa6d918ff255c2b312a1309b1ec839
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_proxy.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 13.3MB
        • SHA256 4ffe690f740009d2d1ef4a847bb3567e30a034d04f126d8ffae054a01e75cfaa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appletviewer.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 11.9MB
        • SHA256 0c44bd29a52e72f4e27ea3461216cce39c25ed565ea19d17b55ac434bc4d681e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        extcheck.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 11.9MB
        • SHA256 aea6f3c989cf14bf656c325065b08d2edb95398ed77a8080076e5f186340ee1d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        idlj.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 11.9MB
        • SHA256 bd008d5a0178b59390549b8683a4d5444f26976288929ed82579dcf45b994b90
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jabswitch.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 11.9MB
        • SHA256 72e8a06bee0b02e27f41f080c78cf398e1d9eedd30842b5946ff0f01c6e2f2b7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jar.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 11.9MB
        • SHA256 1cd97175adbec78666da8c16605ab8a94af8ee0d91111d6678a6ed916bcfdb87
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jarsigner.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 11.9MB
        • SHA256 33aad267aa1707ded4898269d8225a65770cafd2342c15503518da804a4575df
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java-rmi.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 11.9MB
        • SHA256 9a6c64af7e2b4ee462451b99a56e397c5c9fb8ab7effa39762126e097f615d3f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 12.1MB
        • SHA256 19af11ca9389d53c943e8ae58c427dfe211996f9c4b22894ec8d7681d764882b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javac.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 11.9MB
        • SHA256 0e0bb7bcbb6f19e5005f978e85c2889fd08e139968a9ff2b8a54908534e37bfe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javadoc.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 11.9MB
        • SHA256 318a79349cbe6c40ad34b9b26ce11c68d609d60a637085fb89712906d5b985cb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javafxpackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 12.0MB
        • SHA256 4951dc5943b5ad4bd0dde72356e613022ae7e70094ff3a0935aee9f5aa7994ed
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javah.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 11.9MB
        • SHA256 1ce0594fea78ddfbb745148c50f132d3cee641f64c314c0cc15f68973af7cf7e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 11.9MB
        • SHA256 9ce14de0cb91fb03d4763e31f5efa32f8893620cd48dfbfc1089331a1b3b4bb5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javapackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 12.0MB
        • SHA256 887486ed053959c1dad16673c8eca94286f3fff31ba273d708943ada457746c3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaw.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 12.1MB
        • SHA256 69c4312c37489cce9f3a807dec39027ee07b8894c0ced0b9bcc7b2094b7cb8b1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaws.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 12.3MB
        • SHA256 f93aaf5b5589fc0438ffeb3d718aa17536701db4989f6734523234cbc723d9cb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jcmd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 11.9MB
        • SHA256 36356f1ec2d677b520709ac39f2187fef1028b70f18a67beed1bbf7e8a410b4c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jconsole.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 11.9MB
        • SHA256 df42d2cc663d403445b51627d80b9e8093c64ef757a6321b26f684bcc81b6745
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdb.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 11.9MB
        • SHA256 18438afc2900b6287dcdd823c3bf07daab98e8c1ebd2dafd2cc87a38a3f566bc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdeps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 11.9MB
        • SHA256 16446614c9cc475f43196fb674a5a6b11402a323b1d64d8789275a910ba9bc18
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jhat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 11.9MB
        • SHA256 48da37356e5df0aa3067c685bd0c7fc88fc95a75ed7388f9f5fb13c79ae20edb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jinfo.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 11.9MB
        • SHA256 9d62474612e067639b722d37c15040d7a02ca639e3a1bb7477336a8f533d573e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jjs.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 11.9MB
        • SHA256 19c3e6aaea65c27b8d7f64ac05ac614538ad0d9375ef5fb1bc24cd5d4d7566ba
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jmap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 11.9MB
        • SHA256 ff863bcf73a39c77557aaa28cf0456ffc7db8853b477595f40fe52b2d63187ab
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 11.9MB
        • SHA256 f34848200d399374f82227d82897dead61fd80cbfadf86e9a93d26ccf7fbd4f4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jrunscript.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 11.9MB
        • SHA256 7f05b0348b21848097e0b32319a5056b143a403541dbd1897479d92a9ec70775
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jsadebugd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 11.9MB
        • SHA256 c42696008ad831d677acbeefbe71a1dfe622d2041ee0493875647a28907f1880
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstack.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 11.9MB
        • SHA256 48c77ced96d2c68492875403d360475a2d23ab9118bf72b6fd4aa5933e00d952
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 11.9MB
        • SHA256 974300add2fa45a3b87ea585a7808eab54012f3116f0f3494d2ebab8cf6dddbd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstatd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 11.9MB
        • SHA256 79aa504dbfc1ad3b4e8def7fde63d084c53c6cd7dcabf2c5a1127223ff1a06f2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 11.9MB
        • SHA256 00f05a9dd1344bbecfaafabbfdc116407a2ec0396d9538d7a76252881365e084
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kinit.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 11.9MB
        • SHA256 434379503a5c7c9d820cd5fd1c882645d8d078722dd07e02ee68c3e42c25a90c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        klist.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 11.9MB
        • SHA256 5f0bbd71dc51e172f55eaa17e492e2a9bfd5fd862877f8048b0bc186d9c25744
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ktab.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 11.9MB
        • SHA256 c220ca9809650bd2d5e190dd95daf72b3b2a991715661e9a3b867024f65b9181
        • MD5 SHA1 SHA512 SSDEEP TLSH

        native2ascii.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 11.9MB
        • SHA256 31bad615504b7d1a2b0732249a85f3aa2cba588d1cdf7c646b0b0aa88d8811dd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        orbd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 11.9MB
        • SHA256 fe560a36ee1433a0a273957a9194d1b3ba3786a400085cabb121d43a09a9a630
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pack200.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 11.9MB
        • SHA256 659d788f7597c1114bd1edee964d0b8ebee8d7331f0834e0c6b20c858029b258
        • MD5 SHA1 SHA512 SSDEEP TLSH

        policytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 11.9MB
        • SHA256 7ae143b826b4342b0b3e9eb4026246bf3220339f7c4bcf69d4de02868133a256
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmic.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 11.9MB
        • SHA256 656f19194c25d21075e36c41186ddcfa121f2affdc82cb056454154bce1b986f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmid.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 11.9MB
        • SHA256 15fa8c2bc2a6937db312754471435e26c1702f620fec465c0892baa081c1c814
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmiregistry.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 11.9MB
        • SHA256 badb680a0e30217d7d96e7d9713b56430874f1ed65576c5752d5f95acbbc0af3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        schemagen.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 11.9MB
        • SHA256 839da3d4d47692033fc92ed21a28a9f5d124f75fdda3e82a338dc37f63ae649f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        serialver.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 11.9MB
        • SHA256 cedcd12adf6021f1cd6d1b44ab977e3162bb067ccfc26234f9f9866063be0d1e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        servertool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 11.9MB
        • SHA256 66a56893e7cb4b797d70bf7d69549958a8dddb6c182b70187c82e67754375978
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tnameserv.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 11.9MB
        • SHA256 7fdbcd5df5dd0627327a819d834a2795419062c57d13e3ccfdd3b91f5b31b7fa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dotnet.exe

        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 12.0MB
        • SHA256 623fcaafa34d911c63e426eb4a69c2f8e28fc13287886c27c03a1b600fc3d35f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 11.9MB
        • SHA256 493513177be0e3104bda405d71c881f00b1003763203a2ce4d49a5077524fc60
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 11.9MB
        • SHA256 1411fe065aeb074e85842df4cc8ca0af41d033fedbcf23124308a498a6ccc48a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 11.9MB
        • SHA256 be9d99e7a8581623e13370b54d1dca76e20032df6bf0c96f7b443ade86cdfb33
        • MD5 SHA1 SHA512 SSDEEP TLSH