Overview

overview

8

Static

static

3

2026-08-04...uc.exe

windows10-2004-x64

8

2026-08-04...uc.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    111s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/08/2026, 23:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_3741c508503bbae1e81863dcbb6cf8c9_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
  • Size 20.1MB
  • Sample260804-2477yssfmd
  • SHA256 563365b57ff30af7d4a53ba71791b571da7d14215cb72592890d84abe81f0aad
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_3741c508503bbae1e81863dcbb6cf8c9_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_3741c508503bbae1e81863dcbb6cf8c9_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4916
  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_3741c508503bbae1e81863dcbb6cf8c9_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-04_3741c508503bbae1e81863dcbb6cf8c9_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:724

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 20.7MB
        • SHA256 85a73baa44f60762a535540f5a9cc072b48896bb509f04792bf4866e28708520
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 40.2MB
        • SHA256 26422161455fd73fcd155c0ba65a2869d2dd57d00d4be4833a4b908d06516348
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 44.2MB
        • SHA256 8b310b3db004b364c3e01801371c8e5ddb99f3654b86ea55fa1d587e472205ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 40.5MB
        • SHA256 a7aa4b220d79a0ba0394e06c36a1b84ca66a0ed2933ab6e2a33e8949b9679a53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 63.6MB
        • SHA256 94e0f137ac97e93c621e3e0a1529e52eaa0628d5d5d1f4eeedd7655e5c51388c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 40.2MB
        • SHA256 8e7411f7a08175bbcf8adda76f683c39e5ff89c83a0ab105ab7a902a87336b61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CompressOut.asp
        • Path C:\Program Files\CompressOut.asp
        • Size 40.5MB
        • SHA256 43cb2d55d228e5b7077b1ccea68323d46cd60c2d7ca903d7de680d63cd71634e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 46.2MB
        • SHA256 d4293d4e5854526c9c434ef223b4ea140d2a53c29a9e153485520b36369e8847
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 41.8MB
        • SHA256 27bd75f1371e89d8905d36d9011013d30fee4eee3857813afac41ceedfad1f3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 42.4MB
        • SHA256 40c819f7d730d34e3aa50d5aaa875d2407fc2c676a5f3677c7165fe8bb481607
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 41.7MB
        • SHA256 938cadc83de7e139f53b63d70f2a9d05b4c4c3094a3e10768b66d5436fa6623d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 43.2MB
        • SHA256 b051774c54a56ee8c80cbeb2e1a2304e9dc031da977162437c8fc41c07dc2b14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 41.5MB
        • SHA256 fc5a850a9c356d9402be676ee21ab6b231476f28d458ff6f1ba92762ba7ba057
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 40.1MB
        • SHA256 c75bf63f8797178e6660f67ac0b9881f26d1a93556ee1cbf4b488e158cbba9ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 40.1MB
        • SHA256 477f12698f0ac62683f134f3e51bddd03494ea7b17158bd573904d5882f8e858
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 40.2MB
        • SHA256 0dc1045b964761a0e5f485848d28e9c72020c776555c3d0adecff5021bb6dcbc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 40.1MB
        • SHA256 87be3789d02ded379fc5dc3bd1ab375888e9c7d7eb9346db130e18ddd9d34348
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 40.1MB
        • SHA256 edb754b173db9c796b85e53428e797055e1b4f078c3346a4cc37b09ef1aef610
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 40.4MB
        • SHA256 3ecb971a3073765dc53ff265aabbc1230ee76385d42a963f1f7e38662f751d12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 40.3MB
        • SHA256 710fc57490007b5fffbd3d9b8c27763dc07c93ad6d07a9bdbd7d1da8b0ef8fe6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 40.1MB
        • SHA256 7016571072a5b5f29d63f1be0bd794ddb2962e6a6acc89a312bfb394578d8954
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 40.1MB
        • SHA256 7dbd8c1c2f3336134a66d1d63b3d2de174525dbc5318670ada2c920c878e40dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 40.3MB
        • SHA256 0aa705db268a6fe7887be892867a2e8cee1cdb4d67b4f38c5bfb785d0d6c81b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 40.6MB
        • SHA256 31ab4d90313dc5739c9bc9cee8c0e0bf45ff2ec768da88a12b9b53b92ff708cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 40.1MB
        • SHA256 84697188b9a1b449d90353aa7203f1f32f92d6635dc14702943429327c131fc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 40.1MB
        • SHA256 c8c9d9a092f5cba4e259f3a4c5efc2f6c5ac3f3e0303ca1bfef9f71fa19fec46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 20.1MB
        • SHA256 baf773e97ea76996f18282d13410b9ce52dc0dc6e336d644f6b09e6f6eaa9d8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 40.1MB
        • SHA256 63d129852c1f3439e022cf7acc650c25742ba3257b245adc3f92dbfe2896dddc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 38.1MB
        • SHA256 92f973f2d19ecffa3f80c7bae8dcbc1ae8fa002bb0d0a704f748a0ccc6752e9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 38.9MB
        • SHA256 e0b5278b0598aa719e397be41920012bee09433eb30ecdfb19786ef7c55dab8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 30.0MB
        • SHA256 20df7cd648794170e2b48b7e43948246d759475c328972ecbe7a6548845da8c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 29.8MB
        • SHA256 2302f1b26fbbce6537a21c5465b7c339fc94bae159dc20b47fa2eb66f44cf797
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 29.5MB
        • SHA256 cfb03773e459fdd4014b194c7cadf2c0c19be9ed713bc309678faac618e18bad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 27.1MB
        • SHA256 f3ef5c30199dce33f4786cbb304e4d6f30e35311b52b82fb5722d14dfa14c46e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 26.8MB
        • SHA256 543f59f98281141ab0ede03dc79ac2a942e2c64206746bc8325978908a9c94fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 26.8MB
        • SHA256 9a1347a144a1b8bd2bf8a8c670acdefa55fb4c74cc159e6351acca0eea2e924f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 26.5MB
        • SHA256 82f7a82ac84c24e751a3ce1008c2efb600f3a1f84acc4378ef1e456506646bc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 26.4MB
        • SHA256 cc568c8573dfce99af2eceb1e6cb3404d811e8eb55b1e125c8979865c4c6cbfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 26.3MB
        • SHA256 4e7001abb027dee96ef266109e0d247967c7875c0d4a8343be3471ea02c6832b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 26.2MB
        • SHA256 ab0168c209a2a8bf82884b1820ec24b8c128c858a92388839abf3c88c7815d36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 26.1MB
        • SHA256 7d4b07f1d54bd91b6bd605d9a644b8b70b0f61c9bb30bd564233e79e6557559e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 26.0MB
        • SHA256 3ad3a0c194034896de4d2fddbc484b73716415bde2a2f9889e07ca7ca7e6f7e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 25.9MB
        • SHA256 cb0340b3173580ae886f07c53bc3e4d0646914c15129d64097882d0ba985d33c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 25.8MB
        • SHA256 d7c8e1726c6ff100e9e9a744bc723583c2cbcce4ced760a9960cda49e1e8f7ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 25.7MB
        • SHA256 52a89517cb5e0cad62d5b6330227ca64aa3e805874ade77ebc1f80a3593e265f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 25.6MB
        • SHA256 13c4804d9d7ec61bd09a525321c844b1f467d73e50c20f51b96b903faa2e2960
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 25.6MB
        • SHA256 809844c0ed011b4ffd2ee5279d6dc62e51b31bff8df731fbd1ec8e4bbcfd881c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 25.2MB
        • SHA256 4916d29e248b63e82a13dfb868881c33d33be75fd8285096d4c6d3392c30313c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 40.3MB
        • SHA256 bd10552b13483485b408c6a86ac050b047683fd8ec0ef18fb307ffd87254a7db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 40.2MB
        • SHA256 1192efa967af60b33b2aac9c76ea408db64577f729a194598b7ea5c57d399632
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 40.2MB
        • SHA256 8ca50e4cbcb9f533f58bb95a8e3ec0cd7c30948186ddc39b18219f86ea4c33c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 40.2MB
        • SHA256 c87b9f8433fe9683d94e0fe1a4279369d2330f6da39b947fd521f8158fc4be5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 20.1MB
        • SHA256 563365b57ff30af7d4a53ba71791b571da7d14215cb72592890d84abe81f0aad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/724-6-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/724-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4916-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4916-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download