Overview

overview

8

Static

static

3

2026-07-21...uc.exe

windows10-2004-x64

8

2026-07-21...uc.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    22s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    21/07/2026, 04:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-21_8446365be1f9603ea03822fc9186bd11_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
  • Size 25.9MB
  • Sample260721-ely51aet8l
  • SHA256 ed5da33345cf1899404de188a2c3e85b2cf786c939975a17dad7414152621470
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-21_8446365be1f9603ea03822fc9186bd11_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-21_8446365be1f9603ea03822fc9186bd11_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:724
  • C:\Users\Admin\AppData\Local\Temp\2026-07-21_8446365be1f9603ea03822fc9186bd11_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-21_8446365be1f9603ea03822fc9186bd11_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4120

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 26.1MB
        • SHA256 b3af114d4f95fda666403642bfa9f40f5fadb4f998399a93e09634a9810e99e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 51.8MB
        • SHA256 232e403b68f2a3f15c4723ef96efe57910f506312b3ca3f0ba7a1fa5fd889371
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 55.8MB
        • SHA256 dbf1c402951e38395b50a99bd388542e8cb295c8dc352ca4c3d0cd5c98fc4cf3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 52.1MB
        • SHA256 fcf0b89b74f4b873b18f5165f658fe94e855bb43f5bc8a014bb71482796b1a1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 62.3MB
        • SHA256 44e9a177819c98a830566df00ac7ab324c3a6699dde1f8e19bf6dabc70ad303c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 28.0MB
        • SHA256 f42ce6aacac13d68b14a8b58db9668c3f8f122999c1077735a3c74023989e6b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 51.8MB
        • SHA256 8e454524800bc7a0db56b8439a5411dada56c7f20aea6e4915163f5905109d0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 56.6MB
        • SHA256 fd6eab36e02a364d6d7e45b641763526c1af1387656f3ff8e9b98c58b3707b3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 53.4MB
        • SHA256 b74a2308814e338beb9c938858563c9b45003ee4f705e9b4a6ddbab4cec69f5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 55.2MB
        • SHA256 720436966a93f42d368265823c4b7fb86901b723176a22dc56203bdbe54bd32d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 54.0MB
        • SHA256 3c19cea8bbfdf15efded005d372d226fee0cfae04cd919651c3dc0f26294aae7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 47.9MB
        • SHA256 8700f930afd07334b7918c7f23086bdbf9027481b6f0abdbc6d62ddd70f4e543
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 50.2MB
        • SHA256 48fad059c45c79ed7fe2c71a0aa16f8d95b491ecc03b135bae33423182e0c0e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 47.6MB
        • SHA256 37052b30d66fa47e51061b1247793de2f1f26ebacb9a29db4482f9ff34990748
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 44.8MB
        • SHA256 566e3c97838d7e4ebee93d634bf86e524010c9094cfdafa6881a7ef6fe9a0964
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 46.6MB
        • SHA256 195191bae2e004204583325f01dc9d4f5b2734dc7ca2ce90ac41d86a5d4c41ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 45.8MB
        • SHA256 a2878e167609fe72351d0a647905cb1c499b514e71c38b2acaec6da32d3ec6ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 41.9MB
        • SHA256 e97c862aa9cbde287cc982dd9c787927956c7e1455591e91973cf198e8419156
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 42.2MB
        • SHA256 349dfa49920fc787cdd9be7263c418d9e5051be9e51dff0957f7874f759d8dfa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 41.8MB
        • SHA256 82caf170c02343675d82090af1f79dde8de75a6246f9ee5a8d7124b86b0dfe22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 40.8MB
        • SHA256 b218eb94e60e1e5835cc8976309211087564b004d0722491ba844ff71bc3243c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 39.8MB
        • SHA256 99448f9395788dc0599f18a6f12b936cb93d7ef3a404e68fdfc0312024a70440
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 39.6MB
        • SHA256 b64ecab6109e406cd78ee945334ac4dc8fa0c35730e045eedd698f730b3ce5f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 34.7MB
        • SHA256 c1b6f1af2d2c5553250ca440c8a5e055850c7a67fd5e1c60cc6efc80df166594
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 38.2MB
        • SHA256 6e79325c29a809d05ebced7a046bc0ffb6580662b3ec9e6f8ffe669e75ba8193
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 37.8MB
        • SHA256 8f7dd3331542cef099f9689aac5ab7d5540741b2dc1b5ab6feb6ac6acfb21fe2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 37.3MB
        • SHA256 9b879681a985967c74756ae68c580f9c48717f1b1d373d71b8e037925f8f67e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 37.1MB
        • SHA256 de98de37cfa6ca786aec9b599f74c76424d2b5b9f81ccddc31ededae3f1cde23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 36.9MB
        • SHA256 e04604d697b5939ea8d89f2297022fd8a5f26a1c2c8fbf7a9317a2f070951e50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 35.8MB
        • SHA256 f3096710a7a7dd85c5b05713cdf457ef2b1d1ffa29afe47cad50aa0161ef6cbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 36.6MB
        • SHA256 3d723c95913804781bc4f20e1598813731c867e8bcc0c0ff827f5d188dbf2519
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 36.2MB
        • SHA256 fd9a87adbd043dc1a9bf0229a6ddf13819a677e2b796187bfa8a5244ecdbd7fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 32.4MB
        • SHA256 f0394a3f0e6db2e42f794a6f691b11ee699e5fa9f1637fd21ba3955a9109e3c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 36.1MB
        • SHA256 dacf5872b6cc85eb6a88e101366238c79b3ee6f6ee1cb944e00921d2a4e058b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 35.9MB
        • SHA256 fbd51e1316e5099963edd934d23f1210c54c83429a7194f83a6aada801da126c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 35.8MB
        • SHA256 fc3e5c92f981e5e47e77e2a93825e07e056bd6ef25bd1310e683e3b2c3d43cef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 35.7MB
        • SHA256 8081e6282b054dda75cfb5f6e746477ca0c4ce207e09768ee67890dcabac2930
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 35.6MB
        • SHA256 08ba6ad89a61e2dd7a0d55534461514d958146123e88bd4174641bf95c94387f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 35.4MB
        • SHA256 496cd1b93fdf2c507cb1f99e54e71d548ebf9ee515da5f6643d8e71552aa323f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 35.2MB
        • SHA256 bfa1fd92f0a82c6c64c9cf2e085357093063c45172ad11e3b2c87d502818ca14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 31.5MB
        • SHA256 b05e70a69c53aa75595a4491fb3aba6b9ebf320bd775834580cd33af449deb5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 35.0MB
        • SHA256 509262d8ebba98c6e8773b142a28c4489b38fb953be1f77264fd9ef988375a45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 34.8MB
        • SHA256 c57fe7757a2fcdb6bcb4a79bcd193292459fce2660d615eb23a72803c9a1522c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 34.5MB
        • SHA256 ddac1b3a95095cb7dcdfc789814ec050eebfd978748f1d40a90cf67926551a8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 34.2MB
        • SHA256 f5afb5b3113962e409e9ecc0c6319df45934b8d57d9042125c19a794f6083018
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 34.1MB
        • SHA256 a34bcd6344e738f1dc240bc0a68f2bfa401fbd3fdf30349c36070eb1a6bd4df1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 34.0MB
        • SHA256 ce83a371d99803df09399039181e23a0c41cee3daf24afed88cb76584ae7692d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 33.9MB
        • SHA256 a5acc75807477d7636b474afe038a913846b199a5721787627b1a673c8fc680d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 33.8MB
        • SHA256 c7feea37cc5894f1fae9e20cc0c18af9b7b944279760e4d3a3ef4ad0fddcd97a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 51.8MB
        • SHA256 5676ef71722df258ae8fd1d4a1d5e8f20a46c7580ae44bea092cc7b17f283985
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 51.8MB
        • SHA256 e6b6b66b593a03bb52146096bf3cfb4985a01822144db5c0a8a65ea6172ecdac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 51.8MB
        • SHA256 869162004b989e045694d4113fcdfe34fa7bf0c97798e173358315da1087cff8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/724-13-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/724-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4120-30-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download