Overview

overview

8

Static

static

3

2026-07-28...uc.exe

windows10-2004-x64

8

2026-07-28...uc.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    33s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/07/2026, 18:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-28_e8f4dba26bec0e0dd48123d90103311c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
  • Size 16.8MB
  • Sample260728-wp8maasakc
  • SHA256 bf54d1f5c677089d035f0e3e231865070473e5ff84b530bb60984fdf4330d68f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-28_e8f4dba26bec0e0dd48123d90103311c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-28_e8f4dba26bec0e0dd48123d90103311c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3252
  • C:\Users\Admin\AppData\Local\Temp\2026-07-28_e8f4dba26bec0e0dd48123d90103311c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-28_e8f4dba26bec0e0dd48123d90103311c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:352

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 17.1MB
        • SHA256 79f2c0d1d84ea6fc6b05ecbbcf76b151da20008fb72df0ae9b838574eb54e5c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 33.6MB
        • SHA256 83129ce52b1f10a62719b5c91c16a2be83ea02fef2d0ae8a217fc9c8cedc6235
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 37.7MB
        • SHA256 06dd29e6298e1d169f65dd4324407f5debb2736944bc6d645530cbb57cf86538
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 33.9MB
        • SHA256 98abcf4a57bde5617a8281772b575200d0619ae75d7f35d9d21db1fe5f6b6804
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 52.5MB
        • SHA256 e33d63cde4e60bd1d4ace4e68d3758bb12b9537b8867b503ab7054a00af86492
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 18.9MB
        • SHA256 43200fffda24bc574e38e05620b74f79518b1dd628e781a074455e6c44e7d3f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 33.7MB
        • SHA256 83b6d596ffb9a8e6c708051f15951b29588eb3145c9c2ebdc56edc698073f2a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 30.8MB
        • SHA256 f612e357fd6d2094786312cf3a18edf1bab2eac0bf512085bd8c767abd22d3c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 32.1MB
        • SHA256 146be86154bf8c96cea0c7b1fa356b8ef1d1e0a80de390e6acca4d936c7234d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 31.9MB
        • SHA256 100f07404549b1db3a946a482bccfb590402a38ebc39b0192dd3878788dd6453
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 32.1MB
        • SHA256 65e52f1514d39ed1782af8a49f5440f91f5517c28f2711a8c2142f87274f3592
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 29.1MB
        • SHA256 cf6edcd54e943419b76fd70e777f326298a51d51530c62a0949103ef39616614
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 27.5MB
        • SHA256 314ecd9f8eaf2ad68538b88417aa8a7cd6d33be9ca54887e6fd0144ca131b085
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 27.3MB
        • SHA256 96dd283646a38313471ac95e9c0c72d1da9fa82c0e17ad3e697bf413f80d2a3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 26.9MB
        • SHA256 4ae6d0e99ec88b7672755a13a3163363476dd4b28e779a66e4ea19a2a17444fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 26.8MB
        • SHA256 cd10707b2a8f8de30c5a3d332e390f08f713a05d7eaea111fdd8a890ac0e8ebf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 24.5MB
        • SHA256 ff5d843966ffd8603d4bbec3a2c1dfb1076cf655e7a97a4fd983460e6709e9d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 25.9MB
        • SHA256 9ca343e92808c18ba3dc9231e5a7698c88a135dcc4078e66e91d479be1dc9fff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 23.8MB
        • SHA256 0131c3bcfd1eab582d99f2c49927ad2047afe1aac048b5049d9f240b5a35ea71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 25.8MB
        • SHA256 7d4449a72afdbc06f9cb93320dda6caba87afcb80b532dcbda0897557517d56f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 26.7MB
        • SHA256 4a9832c8a0302f206b7af4926d39c48c81050a1b7f2e9ee7519d93c0cd1ebb84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 25.6MB
        • SHA256 b6572464360edf077e40f25812b95c7e999cadb592290a3673592c4195da31ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 26.6MB
        • SHA256 00c4bc25e0521669b1df86bcbcecd92540f8a308b252b445c3aa7373b94c2b5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 21.2MB
        • SHA256 cb30b7c16baae836457a0c8a5f12736e5f247e2db9a015e47bdfbcf1d16a112b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 25.1MB
        • SHA256 a419c1209d5280ea35f79de63bb3ac33bd5ddddec45edf9d7a4e13afc8e63b1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 25.5MB
        • SHA256 c48e6fb23c221258c75d1072d8eb3a0c48a17449a5049e46f2aa2f6581c1be68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 24.4MB
        • SHA256 1b8c9ccd94e95b0d4d204e66e33f4441cb443c1b653859a90a2071cf6a3cd49f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 21.3MB
        • SHA256 816d663642d355e08f10a8c18a67f127a0fc8a9441a5c928dbcc38c49b8b5f6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 24.7MB
        • SHA256 69fa4c34e4cc11008df25424d5d0ceee0db26ec8a424085bb635cae5a03a553e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 24.1MB
        • SHA256 ff44e9a4e81a3538451632b116728990f24a15c98bfc0ffa299cb270eea09862
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 26.0MB
        • SHA256 0753e00a0f693a12b88feca90c41088e1f3f015d1f9afbebf6420bd0b2b6c657
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 20.8MB
        • SHA256 a99a8a99771cda361c2e0e8dcf54dd6bf8f460bcbd7a8f8d0a460f984b79d91b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 24.6MB
        • SHA256 39c23612c50add7e83377190982e87d44f6ac94d9774757d0600bca598f9f4ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 25.4MB
        • SHA256 e1f9701d75f413ff7ff209e05e778575ac8552450cafbe014fa524d982544fbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 25.0MB
        • SHA256 0b190b1e1a1598a0fdc7333e4c118902333525bded33979fb421cc9a0ed2c8ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 24.3MB
        • SHA256 a6451043c4406ce00b4d97ad9518c8d9a0dff0d5a1234c041bfda7bf0fc6e92a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 22.9MB
        • SHA256 1b5f528c6aa84515bee071505eee69e1a62f483f9b200e1f7d47c292b3c1360f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 20.5MB
        • SHA256 81226fa2860e20b78130102ae7895b83f3df90d20c05cf87c55d4e92e656d3a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 23.5MB
        • SHA256 3ff5640c519badc19bcdfddba214ca80092fd2b360534f9ff181cb291725a895
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 20.8MB
        • SHA256 424aa7e684136e10d5e8c732f754ad33ce436bfb5a16e7782dbfe4db227282d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 24.9MB
        • SHA256 63a80c472df2b26ab0b75560571720ba8d993415e8ad6120efc3b44f43cb7f33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 24.4MB
        • SHA256 87d0b93bae2f79ad95c4f9941d8615e6e0bfd93a514c4b43a3bc9b67092c456f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 25.1MB
        • SHA256 c6f9c955ff6d7832c6715fe14af015f5ab1cb0c2de51acce9257947a7634a68f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 22.7MB
        • SHA256 0f62881635e4761f781fb30d1910d6b87c5f577e03f1a6faf370d8bd7f40dc13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 25.2MB
        • SHA256 984538092c2296fdc761fdbc2415703709ab6271af7539b6df93f97753f55aea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 20.6MB
        • SHA256 20a93c0a3941477a80e59c8bbf07c20e6406ebd04f3658c7f961aa5399b91c50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 33.7MB
        • SHA256 0683ec8b02c68e95050cb672d2fc31d1bf69e37e6d1bc5dc0761fa2bf4739469
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 33.6MB
        • SHA256 49f7a1b314c3876705e6c0cc173f4369d30f7073571e284cfca0f5dd81ce7352
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 33.6MB
        • SHA256 f344c64a971368643027b2890fc2afa31534cdf6ddede86939bd9fd0a9acff76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download