Overview

overview

8

Static

static

3

2026-08-04...uc.exe

windows10-2004-x64

8

2026-08-04...uc.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    47s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 23:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_1df0843bf70d909c604cc215100390ac_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
  • Size 26.3MB
  • Sample260804-3ax1kasgrg
  • SHA256 80883afba3d5846cb7bd2e3e4472fa4ff5a468f4da735ee6571f3e45c1dc5ade
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_1df0843bf70d909c604cc215100390ac_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_1df0843bf70d909c604cc215100390ac_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:244
  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_1df0843bf70d909c604cc215100390ac_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-04_1df0843bf70d909c604cc215100390ac_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1860

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 26.3MB
        • SHA256 80883afba3d5846cb7bd2e3e4472fa4ff5a468f4da735ee6571f3e45c1dc5ade
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 28.4MB
        • SHA256 6b172cb562c32ce7739cc2c62e1020494f1a19925971327aff30791987c04936
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 34.2MB
        • SHA256 ba6eb414c315ba87c51bcae26d519bf8ad2c512827f887220b0e4945bba66a4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 35.2MB
        • SHA256 114e6c3e1c9cb19d6323a5f803d497b1a57921251b5949077224dad30643e3e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 35.7MB
        • SHA256 22890b78b28b106342a754d0b7891f330efe4bc2ef93dbae39ccbabf888dde14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 31.6MB
        • SHA256 0ce36454149a28b7ea4c60424459e670a865e05fd2cea39874fcdb605825862c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 34.4MB
        • SHA256 e020851f41828ae18bd27d982671a8ae3913233d50d6c6f71cd99adcd2dc80aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 33.7MB
        • SHA256 3a44d77c935aa7544b934f2febe87dbaf5fdf93d5957874004731e35be587b38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 34.7MB
        • SHA256 0eea41649490b7f1086e0fedcb4af35d9e2a3cc8f4f4dd45487bf663c944a22d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 33.1MB
        • SHA256 aaa4f803fa9c6aa3af85572ea8dfdd8a6c952ca212e1b638230888196fbea3ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 34.0MB
        • SHA256 3670da9d8b6f1065975b09dd4ba6525fd5bbe956f6c2034df73c6dc3f20f6ab6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        HideRename.htm
        • Path C:\Program Files\HideRename.htm
        • Size 33.6MB
        • SHA256 2e8612cedb4588726cd9e64b1135d56db36f982899f033b44dfd84589b8be25a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 33.8MB
        • SHA256 3a3a03f6cfd9af5a9cc132efdfcd03d5b19339c4c9824be025b657940483590c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 33.4MB
        • SHA256 94bba46bdd5b10f9275e121065d0e6d56d1bf7fd72980213d07b117aa75f6698
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 31.2MB
        • SHA256 fa18b7277d9aa6a53c977ca47029a22016814350233d65d04ccf1e82dc965958
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 31.8MB
        • SHA256 b383efaee0435ca52ed2d7d61422f3319a7dfb3b313ce380088ec1d10ded6e9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 35.4MB
        • SHA256 b66b88011259b12feea96257acace4b12a2e43deb6152b104cdf4eb9c0285f06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 384KB
        • SHA256 144c4713f378ec54938375c9433afb979bcdaf05350d70c3d422e883e7e60d15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 35.8MB
        • SHA256 7a29b585d73fe01904bc948a966d6b32400009d65b5ed4300291cadc33ec870f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 34.4MB
        • SHA256 bc025d2c70d668cb7f79c10196f974a9149dead24ec7bba8b5e0f2d33c5d805e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 33.4MB
        • SHA256 c0653de4220ea48a68439a6766aecc0cdb183e9f7db36b400e3e98e6bac274cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 31.8MB
        • SHA256 4792cf169f22a0f5ded865d28f0cef7e62728b326edc8bf06209562f9fef3911
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 32.2MB
        • SHA256 d2dcd2e55c1ce3094f593b26ba3458dd670d9c0c59e72924ef95ddf32231719f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 32.8MB
        • SHA256 fe98e2b47237ee756e08d4915f3441fb5285f92179c18dd80b44a69bbb1f3c6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 28.4MB
        • SHA256 9426d31ad852f436c2bbd070879a43e4921838825e7abc3bf70c56aea2071ad9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 31.2MB
        • SHA256 b24d893405a0c0d803129449a7da4780b4f048f0f829616a4642ea4e4a03d450
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 29.2MB
        • SHA256 4ed04ef561ca4ef278e34c4c1311fcc339b23694030dd583dc16d8a5b82ae489
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 26.7MB
        • SHA256 0ef99b59cb93b8fe7649a3a6f5c36b2736d0acb3996e2e9cba6cd34ee8b2782d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 30.6MB
        • SHA256 f712b1d625c89d5556c9b9c087083e962dbbd671d3bad18465170560e27309c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 29.1MB
        • SHA256 1d400c27f316cbef00e83e6acfcf53527d9ff48a877fc1555eda00df8e180f26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 28.0MB
        • SHA256 7ab50137cd375b634f746f31d9e91672d9ad9aa5f5094119f5512c1205b7d6b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 40.1MB
        • SHA256 8c5dd54b047875fee67caeafd59508f3897adc9b200d13789c32e7f3d6577eaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 39.4MB
        • SHA256 0aab12de8c1ad502c0c4e91a63c4f27f2c822565ec3a382961211ffcbda8be22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 39.3MB
        • SHA256 b0c0ad633e68a378af97a4006ac6fac3cf81f6c645503dacdf5cd9cc76da541c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 38.3MB
        • SHA256 59a1cfc6f9a69018816d6b57de05eef3da19cd98c7401821c5ed8cb5dd8c7d8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 38.6MB
        • SHA256 398b03deb24ccf152a2845a79bdfb8b77562d5f59a8923561dfb9b7976b639f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 37.3MB
        • SHA256 74e29080947382a28bc4dd85676116fe08b51b4e4d9bf7612bdba296901c857a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 38.5MB
        • SHA256 9f09c6db20b1a90fb2a43f4e16797e75ae5622b00ded4e6970f6a05d7760c34a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 35.0MB
        • SHA256 e02bb2606011caa1c43c8c60689b0c06be66919237a08af9634c8bdd41023d47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 36.9MB
        • SHA256 e75f4e214ef8aee443b1ef035d1dfe3e21c26192074e91d432e24314c3fdc5b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 36.9MB
        • SHA256 9aad54ca0ffec0257ffb130c8a36674bf1b290447ab4db73876f08bc7beb690a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 36.8MB
        • SHA256 fa492a9a7163776da3a11017c8d35c92c8e962b84719df94d76cf8bd7438733b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 36.4MB
        • SHA256 5dff6c4caa98b9f7fe18d9992ea4b32b7126fd7319b760987f5810fd670b12fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 26.2MB
        • SHA256 f7cfe743f6fad7eabfde3ff5fa4ebbc6b98913a54be8f6613ff95d2a03c1a271
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 39.5MB
        • SHA256 3db60274c4d7567cc23953ea4f199a8b0ae8d1102483814040153beb0f1ab903
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 37.0MB
        • SHA256 f9b7d2ec72fd5220e0d37274e67e38da74ad9fa2a2168d7c081101890b8e0709
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 40.2MB
        • SHA256 de137fbc9d5cba06ecd51452d0d5cedc462c4cc899da8765c5c9c5032e8bdd69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 37.1MB
        • SHA256 47910d5d04c56b7b39393b148078566c9dde36500aecbe1e38ea5bd53f426cdd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/244-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/244-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/1860-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download