Overview

overview

8

Static

static

3

2026-08-03...uc.exe

windows10-2004-x64

8

2026-08-03...uc.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    38s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 09:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_cb9f099b8a0e03798402c2a44113add2_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
  • Size 23.6MB
  • Sample260804-ln7cqaxake
  • SHA256 f13896fb80c08f389ecbb9ec94e00406449b558c2b0bac17bf50b6b0a85486bf
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_cb9f099b8a0e03798402c2a44113add2_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_cb9f099b8a0e03798402c2a44113add2_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4064
  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_cb9f099b8a0e03798402c2a44113add2_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-03_cb9f099b8a0e03798402c2a44113add2_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2728

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 47.4MB
        • SHA256 1bc0c5d5e2b890f2e4195e940c5af5c5277a8d1b3794aa46dc4bd3b72083ac24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 47.2MB
        • SHA256 ab4dd488aedf62f723f2f335777bd3aa04964f43043b9c4c61d44c0bfdd3b23b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 51.2MB
        • SHA256 99189db55490aef78b36edbf7240330f885d6a4f400a0fe7193d177fb88d7386
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 23.6MB
        • SHA256 f13896fb80c08f389ecbb9ec94e00406449b558c2b0bac17bf50b6b0a85486bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 25.7MB
        • SHA256 fd276cde441e49f7898eeb028d36502b56f530da86448249def0f6f473f471d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 23.7MB
        • SHA256 e46081e48885dffdac5387a050df64470c603569af92df085f7ddb180ebedf4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 53.2MB
        • SHA256 ee8f6dbac9ffcb31ea8a06b3bbcd10322b386bdeb6a3f205d16d2cd9501c8bf7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 48.8MB
        • SHA256 a2b496362b053c2fa3fb092ce5bc8304e68e4e645b135f5cc976dcb98b79c969
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 50.6MB
        • SHA256 43dcc497a89e334602d47d1ab7a335f44407bb4343f95730bf932bedf142b9ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 49.4MB
        • SHA256 89b79fda1d109a3fff80db90e304eec6ffbed2d2733c4247186a7facdc0ec73f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 49.0MB
        • SHA256 4390a400d711083d62b4985be316bc776015c1d9f3741da4426978f7c7ed91d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 50.2MB
        • SHA256 77bc2d79274250cb4764c89da57d89319321fab3a04861dca3387e968c8eaf13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 48.6MB
        • SHA256 dbcea5bb577dbc464a7727eb456d8f3000f2fae1748f95aaf5dbfda4f9c2282d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 47.2MB
        • SHA256 dbfe3cc5c6ec692ea34498b0e8f5aa87ef2cc43329aa79de40174ce98ef4c292
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 47.2MB
        • SHA256 370a47fd96f16dc94efa429f390fa9d12297d5b5525d23faa0dee90ce09360b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 47.2MB
        • SHA256 fd5d31890f7890cff6852ef8eb0a8a6ee119ab6ff315891cf0ac86eb3ebb6eaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 47.2MB
        • SHA256 a756618e42c1d1260fa6e2f29baa11e46316e9a81b96fc110e143b28bfba8036
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 47.2MB
        • SHA256 6c50180939fbe73b993baadb217b84876a4aa1ad39583cf2147270021e2e9983
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 46.9MB
        • SHA256 914b1552f018f56a5a48e026ff29c59362ea0247dca74e3f1d7a238b417a30ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 45.6MB
        • SHA256 7e8ed731186f32881e28535fb090a46c2584f3eee2ef8b8a07f28f81f9a66685
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 44.2MB
        • SHA256 78c98a69f14cda6af0877f14c894786d7b2b9e25b38cd46afefd97a2ff6837d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 43.0MB
        • SHA256 76245924466e2a8e09e3edda44c5a5287b17a6f438debc234d4d02c3d69ed7e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 42.3MB
        • SHA256 0d3d836f24b7ae8b8dfc62759aaadc192ece6461e5ff76266fbcc05c29bd81c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 41.4MB
        • SHA256 8a4b3904c0aecb6b5626e8083793af86250646580bac23218fcdefed0ba684f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 39.9MB
        • SHA256 fe5384d25e7f08c7695197edec09e421c6f154f5463933851cdc7c1df478994d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 38.9MB
        • SHA256 1752ca5541bd8092386b060bff1f0288fbe231440fb21efde0dcd16d49a0eb80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 38.6MB
        • SHA256 e9e05e736c1e6a0e8de51d0fdf32dda58bf24f23f680026aa5cae2b081a7fa2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 38.0MB
        • SHA256 2aff64f82291f84082465b96462b8cf0090a08985f9766a1b955e97d81231460
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 37.6MB
        • SHA256 2ed440d08aea9ddfabd7c459dbe85707e432d46ce98a3d75e2a14c00d006d6ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 37.2MB
        • SHA256 33f95019f25fd7e6e7e36569125e9e19e6561dca7c1da341e01b7ba88ea25334
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 36.3MB
        • SHA256 dff175a3fbbd773099351affab84051c92751dce7b7a85e46bb5693a6cc93ff1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 36.1MB
        • SHA256 eb87505e0b84c73d7c3ac498754fd1619042038fabe43b5d614a896754ed5d50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 35.8MB
        • SHA256 ce5c0e1606e1cccf1086b1453a488a98f102127dbe931c4d2a6b081ab69cb3c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 35.7MB
        • SHA256 f829b15df46d7f1807a1ee56f969335bb3eb024e3d027c915f721618174526c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 35.6MB
        • SHA256 eb5347066b767f3147da9b72b39e3ef6f8760da1212787b531f3bcd2e9bf9c7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 35.4MB
        • SHA256 32acec18d45e6dccd388a6cde637fbf655e30ca41e7cb94318f516e5e3fddab2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 33.4MB
        • SHA256 fb86c9a9b1211e9c328a3c4142fe678e8bf9daf29407dec8b1a5d5924b27c338
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 35.1MB
        • SHA256 e5aeb00b698bf4272f53f03240fd3e86f3726f47abe9ce0588a4491d3a0e7d95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 34.8MB
        • SHA256 a3028d3d5f5de313ac3b37ba82a76378b7571898bac431e4907b125fbcc55246
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 34.9MB
        • SHA256 d73b13d3dcd4daefe63fd91ce9ce672572f9e3206adea318b083d51a7fd73cbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 34.6MB
        • SHA256 9b01451e7680ccff2c7c6056086ee047faf34eb6997a4726e3fb96f45dca8d5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 34.5MB
        • SHA256 c0fd13e07228c67e4895c4888c5be670bebb371c53644940c01ce807754ac473
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 34.4MB
        • SHA256 a3822dfe9498c168667da037698dbcbdada3debaf5d0832a5200decf5e58a914
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 34.3MB
        • SHA256 769beee3dd6ca4e8c0372e1803ccc3a62e73f91cf0289cff6f969b182e4f66ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 34.2MB
        • SHA256 d647cc59663f2dab5dc31ba5e704c8611ece13537850cb4da018922c4afe9cd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 23.6MB
        • SHA256 914103f8cfe83b986d9e1e720e861980a5c19a1619502edd0df1f50fcc149f33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 23.6MB
        • SHA256 0ad6851d3bf0a73c16bc4b8120e70f1af821e8e2c3f8fd40b4cf92b5d53751a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 23.6MB
        • SHA256 48c6ae75ad16e5a447d98b63382ab6d7fbdca69a4cc68f55a9e52e09e5a0678f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2728-6-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4064-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4064-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download