Overview

overview

8

Static

static

3

2026-08-04...uc.exe

windows10-2004-x64

8

2026-08-04...uc.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    22s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 23:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_3741c508503bbae1e81863dcbb6cf8c9_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
  • Size 20.1MB
  • Sample260804-2477yssfmd
  • SHA256 563365b57ff30af7d4a53ba71791b571da7d14215cb72592890d84abe81f0aad
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_3741c508503bbae1e81863dcbb6cf8c9_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_3741c508503bbae1e81863dcbb6cf8c9_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4852
  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_3741c508503bbae1e81863dcbb6cf8c9_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-04_3741c508503bbae1e81863dcbb6cf8c9_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1864

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 20.3MB
        • SHA256 7b30d654f67f85c15e8757dc5c3d19c33ef9d618398ef0b28b51b3c823cfa7ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 40.2MB
        • SHA256 26422161455fd73fcd155c0ba65a2869d2dd57d00d4be4833a4b908d06516348
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 44.2MB
        • SHA256 8b310b3db004b364c3e01801371c8e5ddb99f3654b86ea55fa1d587e472205ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 40.5MB
        • SHA256 a7aa4b220d79a0ba0394e06c36a1b84ca66a0ed2933ab6e2a33e8949b9679a53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 51.0MB
        • SHA256 9e84465da48874c9d0f5199b1f5b37f1297ae49b1468c8b426e3586eb3726f4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 22.2MB
        • SHA256 ef277671b3c30068cd82ec317843e63abf700225cc6df7d2795d5ce88aa1b817
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 40.2MB
        • SHA256 8e7411f7a08175bbcf8adda76f683c39e5ff89c83a0ab105ab7a902a87336b61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 40.4MB
        • SHA256 b241846638083602fc8644ddcbd1422436f4973d9557835d2a9a8f112b985c9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 34.2MB
        • SHA256 bb903231b32d9da3661903cbb50ff2a326c77634d0686b426a38da8911e1f743
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 42.1MB
        • SHA256 a1b3a7652d16f5c953887bd249a5e11ef64ba105ce2f3dde699a794329db557f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 39.4MB
        • SHA256 111ff9581074bf21821e90deab9e52c8dc29dded44874256fa375a9c624ed50c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 37.0MB
        • SHA256 0bdd9b9b91cf7854b2b6f56c3f6ee07b559560cdae5c376fd55ea280baba8da9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 38.6MB
        • SHA256 de36b9931f6af29893ff02ee3f8b3e20c2c8fa3618ee0fc0168bdad05651c911
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 36.2MB
        • SHA256 ddfbac14f39a536d70e607d81b380a6f87374b22e6c6874dd15c72996f0a8a0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 35.6MB
        • SHA256 5b4501f299971fd6046f85ef92c3c8ddf5770e1623e9855aecef3fe89a38b62d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 35.2MB
        • SHA256 fd07a8f79d652716d32124eadb0fda49460241b272407eb69cfe3a38b98ef9c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 32.3MB
        • SHA256 8dd82e0529553fe3748235425f6a1df45320131c80e272823ea3d001c73155f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 34.6MB
        • SHA256 4143596d3ebc05d61c07f0dcaaa5ac50b1403a4eb590caccf8c605f004bade03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 35.2MB
        • SHA256 df8227a290105247f18d7c3e676eda47cd1626aad38f5c1f72b3aaa04ad55642
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 31.0MB
        • SHA256 3ae696f166cc8320b7ab5be25e641d4b71d4e94f2c5b95be1dce7baf5cffce1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 31.8MB
        • SHA256 0e2fd881d109a4af6132654658e91bf044ec5a64cc33a941b0451cac751a2c56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 30.9MB
        • SHA256 b1e09f4451a0f3662fe41029f4cf4609c4312107878bd370aec34f6878582d4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 30.2MB
        • SHA256 8b8f1f8a447c33bfcfe9ceaeddf3db12d2562f1448d23790e2c3b1ec90fedec3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 25.5MB
        • SHA256 9df12a629034c17133ddfeb1496494047c8fd1ee51b93fc57aca5d4e9711a82a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 25.1MB
        • SHA256 45023e3c98d289870644e29cd4d3a727ab1b844f6b292584a2ebfbdf3d142047
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 27.6MB
        • SHA256 6868cff20943992c0117eb6037156cf247ec0d65d449551a5953980947725c97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 27.5MB
        • SHA256 275b32dcf32c2771efcfd600b9cb061517070adecca61fb4377be634490a5e01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 27.4MB
        • SHA256 78c54cfb61265cba35e4216bb57c01d5fcf605f7c1e54d651664a7eed65b35a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 26.9MB
        • SHA256 0bb361e941fb52d22f75745ce97cbe096ee7465b2e051b0377878b076de3bc70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 27.2MB
        • SHA256 6aa8ae768c06024dcf9a4eaf5d805963d465c37c5ca6e098550640a98be145ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 27.1MB
        • SHA256 f3ef5c30199dce33f4786cbb304e4d6f30e35311b52b82fb5722d14dfa14c46e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 27.0MB
        • SHA256 6ee1973a7c1c3debba5b826f14d867629d7f0a07463131ab2cfd888436e51a9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 23.4MB
        • SHA256 489e724242d84c397ce5a44d08590a9dc52cd5dafa202a6a4c72edee197be069
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 26.1MB
        • SHA256 7d4b07f1d54bd91b6bd605d9a644b8b70b0f61c9bb30bd564233e79e6557559e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 26.0MB
        • SHA256 3ad3a0c194034896de4d2fddbc484b73716415bde2a2f9889e07ca7ca7e6f7e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 22.9MB
        • SHA256 402314f1a7110852730b9c0b7b018e9a33268bd7dc42fa96f6fa2c4279ccd253
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 25.8MB
        • SHA256 558b941eca0862b73da9edf7e5014bf8180b135cf285828282c46fcb022ea0e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 22.8MB
        • SHA256 d673c4e65a9fb5561a004d23eaa9ff3aa56fc570688188b28d5c9168e14c28b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 25.6MB
        • SHA256 13c4804d9d7ec61bd09a525321c844b1f467d73e50c20f51b96b903faa2e2960
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 22.7MB
        • SHA256 e214a865115639a4b35e1b82b735c57cf0d898bcec138abc95da08d0a39b47c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 25.6MB
        • SHA256 809844c0ed011b4ffd2ee5279d6dc62e51b31bff8df731fbd1ec8e4bbcfd881c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 22.5MB
        • SHA256 06d03f286300655a2bbbebf0693de474fcf6bdca030391b13ffcf3d2e2ff6d2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 25.4MB
        • SHA256 ba6ebdfc1ba746cc8e44fe829217d61cc383bc574d5fb9d6054ebe1cea1c0a6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 25.4MB
        • SHA256 7c0dacc2e4789a1050f454a240990873f2ab816606c75d9d45b99b3edefca45e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 25.2MB
        • SHA256 113097bd4c71722072ad30cf028172e0e70e7ff8083da6eeb29cc28f42104851
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 22.2MB
        • SHA256 3a27e7c87c9f4898801b3dcb70a7927197784797d4d87aa167deac242025c8ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 25.1MB
        • SHA256 e3dd65388c01b26f5e77c5ac66d091968a86fd20ae9e0f046ed8763c7283fde9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 25.2MB
        • SHA256 4916d29e248b63e82a13dfb868881c33d33be75fd8285096d4c6d3392c30313c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 24.8MB
        • SHA256 d766d37441e8c1da9cd7c9ef5e6b98e91887f622df112ee224430b439d8dcd36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 24.9MB
        • SHA256 8fc6018c8816e082b25ffa3400aa3add731114e0fbddc96439ad12b1cd4b5094
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 40.3MB
        • SHA256 bd10552b13483485b408c6a86ac050b047683fd8ec0ef18fb307ffd87254a7db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1864-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4852-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4852-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download