Overview

overview

8

Static

static

3

2026-08-03...uc.exe

windows10-2004-x64

8

2026-08-03...uc.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/08/2026, 09:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_cb9f099b8a0e03798402c2a44113add2_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
  • Size 23.6MB
  • Sample260804-ln7cqaxake
  • SHA256 f13896fb80c08f389ecbb9ec94e00406449b558c2b0bac17bf50b6b0a85486bf
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_cb9f099b8a0e03798402c2a44113add2_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_cb9f099b8a0e03798402c2a44113add2_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4896
  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_cb9f099b8a0e03798402c2a44113add2_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-03_cb9f099b8a0e03798402c2a44113add2_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5340

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 24.2MB
        • SHA256 e362e7b4ef6c81f8d62ab63f582b560bd44f4abda4194c8217f25e17062d2be7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 25.2MB
        • SHA256 4307e602ce6d654c9880026e68e3241e7938b4fa3cf39a0f73ea7d023b4bbcb9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 23.6MB
        • SHA256 6ae342b651ffb37ea3280f159adb9f7dbe76228aea187da792762faa0119db2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 23.8MB
        • SHA256 9086a01a1755b368d2ce8ade6dea73d5e002c771f60f2acf800dc32f08f376e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 23.6MB
        • SHA256 81e6ff6b543dba5890a8a1c51c0cef72aed4f6e6a61d7d1f57444cb2274eaacc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 23.7MB
        • SHA256 ea535d50c714fa88ebbbf9127f9e293af92ac5cb6ef5741e62d94f539c91d91e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 47.2MB
        • SHA256 896fb58563ff486904f34a843c83217efbf21a03337b2e84b57e17f5d5098582
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 47.3MB
        • SHA256 689b1343ffa109075a0e4c98be501f5a008aab98928d4a6ec7fc26732fd50cea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 47.6MB
        • SHA256 42f6a54699b350ad1b53efecad56524621059b427fa7c3d9cf23aa5892d61182
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 47.2MB
        • SHA256 aa083a5b833f7c063471ac499464e2c605f323eab27cbe8e97133b0a273a6c43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 47.2MB
        • SHA256 b4757158b2fec8529d874f956d1422704522105300adea03d023071b37e2f53d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 47.2MB
        • SHA256 e1d9390804566602b4e1ceb8cff3d95b546d8f3ba016989786f2cb445354eecf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 47.2MB
        • SHA256 0608479ad35f459fad57a06310958d481508a3f0dffc6dd5cca271d48998aee6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 47.2MB
        • SHA256 0ad7cd50e389326d5b700163edd296ff663d27e2953c8d7beba57ea0bf06c0fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 47.2MB
        • SHA256 fc01cba1047288cb6a04841cb074b14c62b3fb5f8e0a07b47c054380dd5b640b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 47.2MB
        • SHA256 a1539a9b67b7135b16becc1ca793ca23e6d4a311719f8dac7b95548f2ce03453
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 47.2MB
        • SHA256 9bb88d3b1bd2714fe3121c8785931c92516b2a72aa654558aa68b339784aab4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 47.2MB
        • SHA256 c02b005361e5872d81e3e22abecba714dab015b56da5102baebdadcf789f8c51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 47.2MB
        • SHA256 7b77458acf98f41d2096e1fb4f9e0a18b29ab69c0885e502ab9d233e773bafdf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 47.2MB
        • SHA256 919d2ef5739f93ffb9415b672db7604b4046717b028dbeb0ebe5460891cef7e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 47.2MB
        • SHA256 5a8f6b3dae708cab0761a80dfdb825b457bba11ce0c9c05d38606ece2808de0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 47.2MB
        • SHA256 2098176e2eced2e8a8e3118d5c81211da6e0b19d4ce7535015ccacefe7a4bf58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 47.2MB
        • SHA256 f0493260f88de1c7569cec6761cf76a796166c8847cde2002f20bcd3d811dca0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 47.2MB
        • SHA256 0d2dec1cbf86bbc47d86778e1ac110b9a546c77e578c331660d469fc3ca3d57d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 47.2MB
        • SHA256 30b31edd545cdf5fe0c67375b133ba79bda4bc3558cfadeda69a530c1cd98161
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 47.2MB
        • SHA256 2010a995d86527862f92580e4df426e4841eb8b8f86ab6e51e68e9db323d306e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 47.2MB
        • SHA256 a4a7ecada75f2028117123d087d2baea82f5f7015ea57b4217e2b6670462dcfd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 47.2MB
        • SHA256 8979357005dc8563215ec92f502c1b9fcbe64e48116d90bc46e759cea429ffef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 47.2MB
        • SHA256 6f329ae94a6a52311fcffc893ee827c206af41801c6400955dbd984305103cdb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 47.2MB
        • SHA256 3dcf2efc5aeebb8b0b6ec2eec5f97e00955e1fa78c3971b053dec50b82ecf0d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 47.2MB
        • SHA256 7c792f24a8fa0e764d5b1521dd7bc2be8e49f3914910fd088f934fd31b798c41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 47.2MB
        • SHA256 51b461946fd6cf88f3dc56aaaa05cde0c5e7beff115d35c8db10ec1c75fb90e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 47.2MB
        • SHA256 6bad10f3397c8716e391756ca6274857f6d568196a7ab44899336674345c8441
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 47.2MB
        • SHA256 76dcea6a6b3f39bf48ad7e27a05dfc697e8393bc94f6c7e24954cc3844eb6bba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 23.6MB
        • SHA256 11254558c33d7449c41640d34cb31aea47c1563c168ec51a5c230135a160d26c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 37.4MB
        • SHA256 d3fd97550fbdee67ac8010f8f705a905d691d7d83c5f0524b7009d32671dc8fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 35.2MB
        • SHA256 ded5a6efaf439a1055cc76216568c01729f574572c5f0a4e90733bd3d862a767
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 30.6MB
        • SHA256 a7051bad6804cf89f044b95771149253b33d371cae2b08ab6730fcbb923c9f43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 27.8MB
        • SHA256 7d1e9ba6e4db7d4521d6bad09a0aed9af6f069d22eccd24224c3dc7b00f86528
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 26.0MB
        • SHA256 4dd225dfa3252b7a016b2d2bb123e420438bbe2cf133606c5be682b28543da7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 21.8MB
        • SHA256 65a7b11da0918d6721b28ddda9c9738c9e0859260d97b059c1bed9637620f723
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 20.7MB
        • SHA256 f4a826c2a5f6e19b7eb8bcd133ec2d69bad8d07123da5de5f252671d10d8b841
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 23.6MB
        • SHA256 f13896fb80c08f389ecbb9ec94e00406449b558c2b0bac17bf50b6b0a85486bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4896-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4896-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5340-6-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5340-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download