Overview

overview

8

Static

static

3

2026-07-20...uc.exe

windows10-2004-x64

8

2026-07-20...uc.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    22s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/07/2026, 08:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-20_ca8dec4edc8236aaec64d60c874d7299_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
  • Size 21.8MB
  • Sample260720-kphkbaew5s
  • SHA256 29acc1afdffd80b94bed83ad0150757a72f6404c81e6f0a17cb19d210fee9c0a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-20_ca8dec4edc8236aaec64d60c874d7299_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-20_ca8dec4edc8236aaec64d60c874d7299_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3956
  • C:\Users\Admin\AppData\Local\Temp\2026-07-20_ca8dec4edc8236aaec64d60c874d7299_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-20_ca8dec4edc8236aaec64d60c874d7299_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4112

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 21.8MB
        • SHA256 29acc1afdffd80b94bed83ad0150757a72f6404c81e6f0a17cb19d210fee9c0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 47.7MB
        • SHA256 4d180599f6d32c6f3122cd8af331ebafbe7971b8afb8f6dfa0593aa21a8150a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 23.9MB
        • SHA256 5b3f498f4948a77e1947277be105c4bd680bd38184643956762b313b0d057012
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 43.7MB
        • SHA256 7697f1082cf2f0352e99cd90b12a69f0d143135e9e2e1908da019ac4b47d0c09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 49.7MB
        • SHA256 49bcc9ae9806bffedf5279851f7872ea71b1ccef6eac71da918d737b8a513895
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 512KB
        • SHA256 54a9cdeaa70d56716fea0c2b033f8174b1495f38e428abc781f5cd97cc816efb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 25.3MB
        • SHA256 75492493dc698be5b478aadbb660df65c0ee83b3040543c6b615d67fd7923441
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 45.9MB
        • SHA256 86170e1bb915dfeb516ee3ceef6bcd29699097697b8842656ce09b33eac3da2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 45.2MB
        • SHA256 f36ce4e39d03c2b20a2fc1a8ac231b4a7387a343c910b5298526dcb0ac5a490b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 45.5MB
        • SHA256 81e0bfaeb032205cf3cae4c3e6e79722d394fd764083f9e7c7d27667397cc0cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 46.7MB
        • SHA256 248e84e7a19e7d873017dd26f40d1b5a670d775fb8636c0c7f27350c6176c6ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 45.0MB
        • SHA256 6b7b6e9f54ed8683e6769a1e87a8adc0f4e298e5546a86f58bdcdd053faeacdd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 43.6MB
        • SHA256 38bdae61b9ea12a316a40954ec61b94e609b2480047836edbac2a55a3d87038f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 43.6MB
        • SHA256 216ed834e50115d5bd3dc4d394e2da7ceb2f5fd754639bd3a06405c4e10bec3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 43.6MB
        • SHA256 4ef42704159bf604f45948098c96da9d8c78eaeef811ac5b9a98aa3013ce7231
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 43.6MB
        • SHA256 d483b448bfbca8d7484b33a76a26968b722272c65492f00ffe4bddd7a1c7318e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 43.6MB
        • SHA256 e7d76218f7c430e00d4d54099bda63f61f3be158b5719c648706a83f52fd9c7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 43.9MB
        • SHA256 6f81e497d9af0485ea660a4bc96160a2659b50db7d3063c8bd3d55ea6f162001
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 43.6MB
        • SHA256 ab8ddf1b9fb497cc8aac3ceb24817e9c55adf441c9b83c9af60404bef1e7ef51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 43.8MB
        • SHA256 124346c2c509a24ae2762faefb63499c19c621e7f7dc4ae354050dc7b4b3b3c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 43.6MB
        • SHA256 77b7a04be129fe3918223b5f5d35a0db36d7e6d484ada2bd16fb0b63265aaf92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 43.8MB
        • SHA256 d4bfb090c2d7bb2beca31827536c74852b249e52f7fcf1f84de5caac73b8449f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 43.9MB
        • SHA256 0866240c77310bb2ddf94001b5228929645cc270e65108308d980964e7db7a12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 40.5MB
        • SHA256 0b61c17e0755722c0707d6f520e0fe64e023f77397290145279401738df927fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 43.6MB
        • SHA256 0ac6da8184205d88438e7424a4093115a0038fafb40f478195ccf037b7ad328d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 43.6MB
        • SHA256 1c454603299963dcb9cd2ecbe7782b7edf9cddf94b98b7ffa9011382df25cd89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 43.6MB
        • SHA256 ca6110b05fc9a3afa0772b48509c4e4c8db58a96848e247dc45f52351e629541
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 43.6MB
        • SHA256 98a19af683d678acb478684bd0f8e461c7057d8a0b3079c6b7c098c9b3d505b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 39.2MB
        • SHA256 416d4090d090763f1ecc2e4e116a526788125f11533d71f7488f3a986a93c42e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 42.7MB
        • SHA256 c0b33aad75318289825a6b062ef9065577594434e7d9e71e452f7cddbd15b858
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 42.0MB
        • SHA256 bc4767289a6fad9b980cc8cf5f3bb3848e57122d52addb286cc7b070ec23d868
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 41.8MB
        • SHA256 efbe428de7f34ca0d932e70b3c869a8bba059672217883cf3fe6805fd4c53fcc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 37.7MB
        • SHA256 861d911f92543e8b57064e07c37afa87a90729d0ece207ed57e0a9328212fbff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 41.7MB
        • SHA256 3ccee992ba816e81fa78e4520eefe9e3eddd2838a12cd44f0bfe3604ced877aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 41.5MB
        • SHA256 24e4bd8506559c9bd6cc486d85987068d49ce8db17fb078535306b5bd62e09fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 41.4MB
        • SHA256 96c3b48eef3d140ad49d6092c7c3d7c65a7cc44d60becc9c94f585594f6d55c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 41.4MB
        • SHA256 f5bd83b7c8d828e4e5de0d9b6630815ee404947ae8aa2da66f6e09b2e42d2cda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 41.1MB
        • SHA256 ec2ea7754e0d65410506095a40b617318c882bfc7f86d6e078973600f897c813
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 41.2MB
        • SHA256 05ad0b8daa9a7dc44ae4b1876a7e3ea06943eec80dfe32ae164ea74c8c405756
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 40.9MB
        • SHA256 1fe426c7d865f518cb6b0757532ef69f28fe25cbf11fabf090a2e89239d03f99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 40.9MB
        • SHA256 8dd354536358d31017fc62cf6871773b17c2fde89abdc2a0c52cf1612d33cd85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 40.6MB
        • SHA256 7d7741793be169938ab4ab1420eb2199ebfc96286882833bf072f60a3b1267cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 40.2MB
        • SHA256 a8ffc8cc7687afc02993cc639c5e46950c593b39c867dd02cbed1fd7f5879113
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 35.8MB
        • SHA256 961e3eb7cc3d16e6a1cc1f2b8d3bf9c91e8fd4258cbd788363cbe7795c206fd5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 39.9MB
        • SHA256 af09c132bc8b530d1b2883668b9d3ca8c4a7c4522d01cda719f5bca38f6d921a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 37.8MB
        • SHA256 affbb2b837027418d00bcebad0fbfb1f669de5dc797619c5bf5967e7dea80dc1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 39.8MB
        • SHA256 191de7565b54d41653897a71068ed659a9fb2c7acd3665423d54c07757a232f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 35.4MB
        • SHA256 5e67d85907c0376b23272ba02c80cbc2f7219fae5a7224cad84b0f58cc485cdf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 39.6MB
        • SHA256 8c1a86e77692e8f0ce55f5f800aab2be7986f98a50eeac93041f74581faca353
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 39.4MB
        • SHA256 1358c3115bb17fd3a652619221baba0ba95fd69793be6d47cab3af87994e5af6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 39.5MB
        • SHA256 7bb26909fca71cd57ed18dda1c801ce16054c37bbb0ab0d2d137596588ff2f85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 39.3MB
        • SHA256 ab226e590dad0420ea97a546ebe91954f8802bfca83cf6b4c249f5b7dcddd557
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 39.0MB
        • SHA256 59520cc2ca560615126155593bbd3836db304700f54d91bcae0540a9a8e497a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 43.7MB
        • SHA256 e99b475ae4a17178e0df8b189273995de5013047ff13119ab19e1878f6b4d497
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 43.7MB
        • SHA256 fa8274747e97aeee92356bac2fba80a9a34683dad4535158946d1957ef33eb5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3956-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3956-4-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4112-18-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download