Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 23:37

General

  • Target
    2026-08-02_d1fd8e5ae9d02a3378f490feedb8a629_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
  • Size 15.7MB
  • Sample260802-3mc6xstenh
  • SHA256 ccf51007049c1898c042c340765d2cd6cb58f8285a72bcb7d7e7934fbaf0833a
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Control Panel 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_d1fd8e5ae9d02a3378f490feedb8a629_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-02_d1fd8e5ae9d02a3378f490feedb8a629_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2752
  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_d1fd8e5ae9d02a3378f490feedb8a629_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-02_d1fd8e5ae9d02a3378f490feedb8a629_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2372

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe

        • Path C:\Program Files\7-Zip\7z.exe
        • Size 16.2MB
        • SHA256 eb219b56fac8cc5f113effb20b9c0f509087fd4a2d6312b987c5a051f10da16d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7zFM.exe

        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 16.6MB
        • SHA256 4d184afab0f35498404d67ea9f75d38d9d6d184006e52667848a1933d6e64e3e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7zG.exe

        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 16.4MB
        • SHA256 671afdba209267b54e6585e556247c0544bdeef4f0265c7fd5e248a007d3d412
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Uninstall.exe

        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 31.4MB
        • SHA256 8714ac7c254cb91aeea4915a91435f1b641e42cdd0b863ddef40396070c630fb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppVShNotify.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 31.6MB
        • SHA256 6e0178b3a5ef274c62b825f6cb225bd3489d9859e05a5b7d3cd71d4916d48823
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InspectorOfficeGadget.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 31.4MB
        • SHA256 126062d0c3320819dcf777a1e37d2ba7a19bcee636db700d23e1e83c90cf94ee
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IntegratedOffice.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 35.5MB
        • SHA256 af3d532d8c1fc4db758c6c08529dd3f612857314ded3be43db4e82060a5c8e18
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MavInject32.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 31.7MB
        • SHA256 299f7bff170d4d3ddb0eb043698086235fdf9c1c1a6ab5d589d4efec929754cf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OfficeC2RClient.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 54.8MB
        • SHA256 8712ad9bc8e20d451378e66d4c1a4f9e1ed3fb4e0052ec75c3bf8380ea64fcfd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appvcleaner.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 33.5MB
        • SHA256 b853d7f06a43c14ff4d3d79c18c01958a675bac311b0990e6edab54d1f198e3b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VSTOInstaller.exe

        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 31.5MB
        • SHA256 6acb1811fd80b90c2bec89f1842f618699d7398ec01a69a84cfe980776f5d85f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrmstp.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 37.4MB
        • SHA256 97d6626801bf4af68074330753eeb4fde592866c91f181ca0b6f34fe7941ebe9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_pwa_launcher.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 33.1MB
        • SHA256 14f5bd1b5d5d344be67668b334db8ad2c71966a535aa8e428b985247e028d089
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevated_tracing_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 34.8MB
        • SHA256 ce30d2a3055e0c50972cca1ef7fa2c0f35b8d8b0fb3807bc2a65a47154e14eab
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevation_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 33.6MB
        • SHA256 b376214239279de7b8504802a2cce9627082f22ffd4bf0e2cdf52eff9dcc7a15
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notification_helper.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 33.0MB
        • SHA256 bb0f0477905c814483f3e8d589ea6f98bd32e2b9c9ffec0ea42a7ea327395bce
        • MD5 SHA1 SHA512 SSDEEP TLSH

        os_update_handler.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 33.2MB
        • SHA256 83e30c232f3c7cae601fb8a07843f9ff4a605401247691e866bbb9ba2b5765fe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 34.4MB
        • SHA256 6a7d9eb235e3725efdbf4adb1158bdbb98b81f8b8005afe62466438ac5a287ee
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_proxy.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 32.8MB
        • SHA256 61b42191162daf85165d80d7d99622f158c2ae71349f3041b7600b15caa466ac
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appletviewer.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 31.4MB
        • SHA256 aa1be1beb2683d616f0bf4ba59467261d15d7abc7bbb2e144288c98e4d1f5111
        • MD5 SHA1 SHA512 SSDEEP TLSH

        extcheck.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 31.4MB
        • SHA256 2d13dd8bbbe00ad8e79909232cfc743a95776d5a334369090760ca23b8fce400
        • MD5 SHA1 SHA512 SSDEEP TLSH

        idlj.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 31.4MB
        • SHA256 7748c9ddf54728bf2fdf2675a6e54b8670ce9c4bde03ef92618311c11e0bc155
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jabswitch.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 31.4MB
        • SHA256 fe2d81a75bf037c1b1e85fc39c1a987669e9321a9fb1aeefd56461abe6665719
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jar.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 31.4MB
        • SHA256 335ef600f92c1288cb05c372ce3ce078dc914aebde72b3b45578b7a3be46c0a8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jarsigner.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 31.4MB
        • SHA256 ded95675674e8abae7e0c02f88f675e210b357977a961705f499c3511ca231ee
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java-rmi.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 31.4MB
        • SHA256 cf9dfa55f7dd7a8f70aae6131c813b1795dee8e8418b296d115f5b6f17dcbff0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 31.6MB
        • SHA256 00c3169ebf94d92b627d1e231ce4bc3393c5626ab97816356527d9455920066b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javac.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 31.4MB
        • SHA256 184d60678c8f953a645b2bdf26507272e03ec9d57314fd0804ed49b64fe9e0ce
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javadoc.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 31.4MB
        • SHA256 fb5eee70793b893d251b8d4ad1d73c52518d5fec64c0393cdc64f84da6e7c941
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javafxpackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 31.5MB
        • SHA256 042dcf65f3f3ff12e5180b9ac0285e1b7e3dbc3195906c75102a5f022c714438
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javah.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 31.4MB
        • SHA256 ddcf44ddd7f77c7c4b12bff064e2bc4d125ec522585c23c269a49ba3c295fc8c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 31.4MB
        • SHA256 f973d11be8fe662b4be5704333baefcd8b9a14076d0c9c42164c0783da7ea9a5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javapackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 31.5MB
        • SHA256 6a71929d9363b16b96bc8cc2dd159966a587e1bd12ff42944c3f9b9e19fb2180
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaw.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 31.6MB
        • SHA256 414c68e91b2a9bbb255a9ead88f4175d52a7b87cb3c080279f6a2f090f411321
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaws.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 31.8MB
        • SHA256 beb5292f9470b5d5c0d7b83229c9fee4b3cce78037320175f6e80683c86a407e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jcmd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 31.4MB
        • SHA256 ce2b371593da812279aa6789f4b98c4ad5b0f7b7f5309bad9228cb3bb9f0f6f8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jconsole.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 31.4MB
        • SHA256 638118ac7584f496ba44aa13ddc7c34af5ac10023ee99e286d2282f0895db411
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdb.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 31.4MB
        • SHA256 df326bcecdbbaf22538b63c6260cbf0ddeb85a2a13a747cf032c91de2032fb08
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdeps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 31.4MB
        • SHA256 5e80db735bc034e070136c6873176fb404063f1d934ca44f5561ba65275370c5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jhat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 31.4MB
        • SHA256 e5f1cfd7390b65337cfe03f8a23ddb94bf78652624cca297e56ec51024bc9958
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jinfo.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 31.4MB
        • SHA256 67fd211076dcd9a0ace138b51e51403012b23e290b86e8e9f2ab591d56e10e82
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jjs.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 31.4MB
        • SHA256 6f08cc0324252f33ab80aa10390e8a390b35c0ee21430b0b8f3430688aa315fc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jmap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 31.4MB
        • SHA256 15cd65abd79ca2e7455cc4026c212ec779d7c2aebdc74d8c117785e5ad07035d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 31.4MB
        • SHA256 26ffba0fcb1d1682474fd1fb18180b070a21973d36d2415b08c66699daebfe70
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jrunscript.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 31.4MB
        • SHA256 9d3beaf875c32b628075ba9b2142e8fd1ff9d9b3c4663514d540a0eff720b91c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jsadebugd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 31.4MB
        • SHA256 f3f79d28a84b5518c9c7b051ee59e5c0e4cec3acb4c079b95fd299fdfbfb0d82
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstack.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 31.4MB
        • SHA256 790fc674b50386cb0af82f3431f16a35566b3774985839abcc870b5acaa5ce22
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 31.4MB
        • SHA256 f9f15012b6a7c091899ad913125824ff5e8441c5c7c61c470fce493a3416b5c1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstatd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 31.4MB
        • SHA256 14930c7761b949e4e225cefcf6fd2d7fe9dd988728c571c2f59c52bd8b1b8e63
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 31.4MB
        • SHA256 b03b4126e3827dc9b9a665103e29eb9eb74b5e25547750ca1350da6fe2acbaed
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kinit.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 31.4MB
        • SHA256 b5796789554529113531d326dae67ac04d10cea2e94e8c3201e8bda9c5818689
        • MD5 SHA1 SHA512 SSDEEP TLSH

        klist.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 31.4MB
        • SHA256 7c8fe34cd48bf01d80cbc60f2fb34e4e1187961ec941e44d2b55739b2814cb3c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ktab.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 31.4MB
        • SHA256 5715a7af8c1a6bc74d15ee97bc8a5e514baf867b803bd65bffbfcf67297fa4c6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        native2ascii.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 31.4MB
        • SHA256 8ae2fbfbfeea6dfb6379a2f2f7bfa85b6d9d1b3678860f51fa1f34da319577b7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        orbd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 31.4MB
        • SHA256 57e2469538830a9d0e77475c62f7f4eb9693cc715b531a36769f8607c5b7d400
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pack200.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 31.4MB
        • SHA256 8d35c156469c981e6973857993b5b5846ab2661605dc0cb9f9a1d9bbd9f481c2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        policytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 31.4MB
        • SHA256 ff898d37aa79a6e3dd716d81c0f44f190a77d7fa3d97146b7bce9cc61906b19c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmic.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 31.4MB
        • SHA256 6ef254733b3f095ac766b2218023af37745e3feced1f5f76a34a5dbe62dfe382
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmid.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 31.4MB
        • SHA256 373b12892da7b9b65003e87115b78d86ebc3a6a5f5d378ca05d181eb3b6ca595
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dotnet.exe

        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 31.5MB
        • SHA256 9abe4c0a1886b98a0b8c657c22238843a59135b73cfa251f7fafc18c450ae58a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 31.4MB
        • SHA256 3cc1a848af91912f6c8f6efd64dedc2457b7544febe557140245e273228b7cbd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 31.4MB
        • SHA256 0e19fef860f31f8daef69a394b44b912a46e7d2465d620dddb08a22b68a93a57
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 31.4MB
        • SHA256 c11a44fd8aa0be8caf00b3e93102d717808382be8339327a19243fecef838526
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/2372-20-0x0000000000400000-0x00000000004E4000-memory.dmp

        memory/2752-0-0x0000000000400000-0x00000000004E4000-memory.dmp

        memory/2752-1-0x0000000000400000-0x00000000004E4000-memory.dmp