Overview

overview

8

Static

static

3

2026-08-07...ed.exe

windows10-2004-x64

8

2026-08-07...ed.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    51s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 00:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-07_becd62fbe20b3634a6dc1dca57b8d424_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe
  • Size 28.5MB
  • Sample260808-a3dheaep8w
  • SHA256 c4cc21f008757ba10d2136ecc55ecfb18157ad469cffa47af2ace05c2f9dc103
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_becd62fbe20b3634a6dc1dca57b8d424_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-07_becd62fbe20b3634a6dc1dca57b8d424_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3352
  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_becd62fbe20b3634a6dc1dca57b8d424_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-07_becd62fbe20b3634a6dc1dca57b8d424_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3308

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 28.7MB
        • SHA256 0bdcd679fe600dc8a9848ae40ac459bed455092098f7d4f91845ce44609de5bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 28.5MB
        • SHA256 87e9ae8ebe1aff0e42e20c2487b42c7e73231f35732fd31ca67ad883b6c9a33e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 61.0MB
        • SHA256 1f73812e1340cc7a6bb0693dec8f94aa114f8dfb567548a85538258a1c261247
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 57.3MB
        • SHA256 4801a841a38ac8d350e6a8ab53a7b811d07f78d4691d37fa7ae4ab5ea4f0ec4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 30.6MB
        • SHA256 cb5986c045888251e89bc5d1e9c7f2477116ba60635d2dc18b49ee136c1d5a36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 57.0MB
        • SHA256 2852ee5b4634172914755ddd2e016f4f78b72f26ef9dea88a2749e3f25365087
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 63.0MB
        • SHA256 213ea2cb5b8ddcee58ac615a4ed278a0999484439e416c0f11ccfd510164ef46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 58.6MB
        • SHA256 d0d12f7b9120c45db591dc7d22fcfed84737b7173f4f89b81a27f134400967e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 60.4MB
        • SHA256 d5cfb4aa073309d327f53c157b0bb0fe8d6cbf703a188f7eddcc2a310274447f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 59.2MB
        • SHA256 90915c9ecb281efd5bf84f8c398cf8c1a35694eec57e27c01a0cde31a5df0fed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 58.6MB
        • SHA256 9b7d8b8f12f0773bc8a76860525e15b88e164aa49b7a3e645a836e7a625b28eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 58.8MB
        • SHA256 488c65f1a7d893ea1932f1a223b65d8d85070910bfd1d5c570f8c858aa234ef0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 60.0MB
        • SHA256 e711b5de599bc3a67426cb835c732540ca5ed7193f61927d8b2d49c58b19c185
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 58.3MB
        • SHA256 911740410021478b48470b8d99bef91fb5abb4460dfccf9288a07554e87b66f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 57.0MB
        • SHA256 885d1187a46120984ddab1ffbe5fef2db7e510f76ebb7466d301080c1b127494
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 57.0MB
        • SHA256 75c7d907d88c13b019573582c46a8787a1c5ce142641e170e8075f1dae87facc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 57.2MB
        • SHA256 5f2a0f9821e3772d4caf9081071e1d32d50c839ab2b03bdbb3b9850b249d6d54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 57.1MB
        • SHA256 5e7b764f8d5dfd9db7f2642ccfc07fc8f5d7baf6f92bfbe0037616815ed9fd2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 56.9MB
        • SHA256 c57a7bbf72348e25f37f8c67bbaefd613d94f078b632a295c50760d6ec329e8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 52.2MB
        • SHA256 9390168ffaf84e054f61dcbaaf750fdcb755cc030c3d0f09b21938be1b660070
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 53.1MB
        • SHA256 3a078db6faa254293ba892b40eac2b0beb387eca18bb79d701223dbedd08836f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 52.7MB
        • SHA256 2895be77ff40fd92ecbcf3da9d814f015a896cd71d14af3b0486f03b0775bada
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 49.9MB
        • SHA256 e214049bca1a79588a5414251b6c6b52ec2a526a7cf66e32b5876145e8dceb0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 49.4MB
        • SHA256 920cf6a50c3a5fdd245abd47a81f40f0448eaeed243ab9464a3b192928bccd32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 51.4MB
        • SHA256 13a614a977594b87b373ea8b5bd7d4801488c36eccf0b486c9c4aaeb0d334ed9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 46.9MB
        • SHA256 3721680ce4b2d12c8e8a22c075e1546099d1b244655f8979f8dedfcf6e1dcea8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 47.1MB
        • SHA256 e4f73898f1367e2845def8603830353622bd9d2cbede8ad510b587f18608fe40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 44.9MB
        • SHA256 2df2373b61b3fc9c97e676d9831435770bb0cd7ee1e995ea3de1c4e3aad4db0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 45.1MB
        • SHA256 e8cf1b0fb43879558a38c46d7223f2eb75f5be2e064a5232b215464fcf972b96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 46.2MB
        • SHA256 bd8e5f15bfbaec0992f500ffa9ea8f177dba3451a9695b3d3c693f64f6f29d14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 44.1MB
        • SHA256 da6cc16a40d2fb9f240d5a5a8fa3dbb71e476f7d1b26df77d9436b07eaceaf5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 44.5MB
        • SHA256 5af53a3c9f20a5769519184dafe3fff3094e8e94aeb536bfeaa04386ef2165d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 43.9MB
        • SHA256 1303b6ce6ff4cb1e6e7bd215d3bb0a465d736ecf80495dd1e7410ccd595ae1a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 42.6MB
        • SHA256 893a59b96c81e9d9704a1956604f0ad6f9574d4d2f8a6e7acf2e00406823fb44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 57.1MB
        • SHA256 8e1fe7aec548ab337fdbbe172138c5ce54879cd63454973d00418c0e100513cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 57.0MB
        • SHA256 3e832fb1cc532e7c776314b90c02751fee8a2de72c8f847398fde1b44b29a6a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 57.0MB
        • SHA256 61d916725a0a0e858c2bf33c8f553b571ce31c15407ecf6d204766930d56f39b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 57.0MB
        • SHA256 7d6e662c5b590d46604b0b6f5d7c8033847d4a856722c7cad4458024f2e59cc4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3308-23-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3352-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3352-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download