Overview

overview

8

Static

static

3

2026-07-19...ed.exe

windows10-2004-x64

8

2026-07-19...ed.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    124s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    19/07/2026, 23:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-19_04a6b42dcad521a8087bc560b86bbe93_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe
  • Size 35.8MB
  • Sample260719-3s8vsagy2p
  • SHA256 aa7c64f69dd7a4fa37ae647929e1f1d752dcc8869852be6a3fd1ff4452661bd3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-19_04a6b42dcad521a8087bc560b86bbe93_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-19_04a6b42dcad521a8087bc560b86bbe93_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4908
  • C:\Users\Admin\AppData\Local\Temp\2026-07-19_04a6b42dcad521a8087bc560b86bbe93_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-19_04a6b42dcad521a8087bc560b86bbe93_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4516

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 36.5MB
        • SHA256 d88d64bbc34e90d2e62d441090ed13b260c9fcd160e474575e3d64a25f87c261
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 71.9MB
        • SHA256 8dddc2660c0125ca0ba4fc562f7bdc77ac60f0dd817c9248d30829231c838229
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 71.6MB
        • SHA256 12f964fbf0b94960737e03f68ddd2efb01c1b36ed8dffa5d6e372979c278f743
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 75.7MB
        • SHA256 b4ae97ae999656aa40daf30a28ab97eacd1673216fcce72285026cd97e1cb86c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 72.0MB
        • SHA256 383890ae6bc54c36377e409c01f67c74e965a911b1a2287b6a520b4a5a3528cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 37.9MB
        • SHA256 6583bc634ab44fe13de97ef4284e4a27e4977c0b4091c79440ed75124e1d3297
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 71.7MB
        • SHA256 15f9fd4fef9d97f5342822ca9905afc2251e1fbb98ecab00a333d0e0b5693f9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 73.3MB
        • SHA256 b12ffd9b6bd5c84d511ac47ed8372365bb3bd92ec11915d6b61b0eaf6d6b2fd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 75.1MB
        • SHA256 1894139e677b1e54d8531dd97cddf7bba03e235789d4abd7cd0b0e7b9703949d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 73.2MB
        • SHA256 46f70fa40130c9bed1a710406445f0911b7a92bc089e4b0f1f534e115b206cc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 74.7MB
        • SHA256 698a4283bb2280212673ae424ecd04628b9bb6cd9700011afc97eda5d62cb7d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 71.6MB
        • SHA256 b08977aa9183fb26598155ec2fd77e6e789c979c03873866a45f88654444add9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 70.9MB
        • SHA256 0d611c3d52ced1d5df533db7c1089369cea5a2e3e111c48380f2dc2b9ede3121
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 71.9MB
        • SHA256 fb38965ac537f7c465f24728fbfe4a128e2d49f5a82bf5ea3eb2814f464b3026
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 66.8MB
        • SHA256 c8aa0b528cef153c44fcfbb483dc2c58c13793674032d1b8bf1c841b81a89770
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 65.5MB
        • SHA256 07043ac0c93e83d1aa6745d64d131e12e26dc5387e640e0e75323687d8a92568
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 65.8MB
        • SHA256 36e864a4a944aa55a6ddf24b39bf69747b9198ad248154b9772fa9037472a097
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 64.0MB
        • SHA256 ed68b19798492e49987f128e0fca3bb87edaea96fb48900791f653723beb2760
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 63.8MB
        • SHA256 a6418487d2a127ab03299889b374ec6934f05521ef7a3a3daae677992a75228e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 62.8MB
        • SHA256 1d82382b2bc0d1e0d675f51bf33c6d2009d2644a5220aa6389543c73c0812a1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 59.6MB
        • SHA256 f34f79c693209c423c1e61ae9736417c3740a1f829a792eba2a054e255e2fe28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 41.7MB
        • SHA256 54ca7dcde1d4b09b6f300cefe6eb5e636736ed3ef6009210ff86d2be7d838ea4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 41.8MB
        • SHA256 810af4fb4cb15858335d33af3d997e12931af99078eec8c33357f75dbca6e260
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 34.6MB
        • SHA256 ac889c2306cd937db6b63948ccf82f39d918aec7be2a39532218f7a19af9da6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 33.7MB
        • SHA256 0ea4ef2efa05a510a9c103da4e6fae2b20942072014639b45865940870fcd5fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 25.6MB
        • SHA256 00299e82624483ac2aede1e9f4f055af0f8355318d56b11d2ad61279964c0511
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 24.0MB
        • SHA256 24d732102c82e89d75fa4f08e044c08498a54cda581ab8d811b2108cd9814a84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 23.0MB
        • SHA256 f903f3321fb5b2b4878700c4b9566284b939d61ff41fd5546fa0d20218553760
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 71.7MB
        • SHA256 115e80f8f1cdb2994be4d16d44d2b3e6dae01c0e040b88c8ae68a034abc69cc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 71.7MB
        • SHA256 23a7c12bc2d16d8749b2f43c2408d96b00bdc7586e65499c48c7b7385e92d1ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 71.7MB
        • SHA256 456e84d0fe1d2e1bad45e1e2568fc061d5ebc2ada40c30debb41e4c74685aeb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 71.7MB
        • SHA256 6b4763dda488fe62e7b2252000b947ce98c7edd4fa74f579d932e25defa573a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 35.8MB
        • SHA256 aa7c64f69dd7a4fa37ae647929e1f1d752dcc8869852be6a3fd1ff4452661bd3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download