Overview

overview

8

Static

static

3

2026-08-16...uc.exe

windows10-2004-x64

8

2026-08-16...uc.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/08/2026, 01:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-16_d44fd6fb1051b0bd3370ce988629d3f3_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
  • Size 13.6MB
  • Sample260816-b89y8sbl2x
  • SHA256 c6aa422801800e9bb8c4a4d8d3200dfd854d5c06ec6844642cd66d3912bfebdc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_d44fd6fb1051b0bd3370ce988629d3f3_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-16_d44fd6fb1051b0bd3370ce988629d3f3_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2884
  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_d44fd6fb1051b0bd3370ce988629d3f3_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-16_d44fd6fb1051b0bd3370ce988629d3f3_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2804

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 13.9MB
        • SHA256 14ff87ca4c0b4f9557fd60124764dca77c15fe16a8ae23e2f70052bcb4ae51eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 27.2MB
        • SHA256 5f8d6e30e6a99ac2d300ee41008e014b36f36384e1e16b01d97460aad805bbc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 31.3MB
        • SHA256 f687cb2cab521846e73c28fb36fb500fcc88e1c0276955431f6ec35b635b1bfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 27.5MB
        • SHA256 782bc1e5f46f31d7cfd7135aac25bac25121f7702a952fc81c169b76546874d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 50.7MB
        • SHA256 dcbab6fd8925f5c57b32c3f45cc6df1de205c49d88937c8d9d2a449391a5ee5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 15.7MB
        • SHA256 d5b5a1866f9aa44ac186cff6c378229227143580e6414f3533c06f2e2cec887c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 33.3MB
        • SHA256 e8cae68d477607579ec8be753cd63fe407735e5a682358a50b1bbf8379ce3bbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 19.7MB
        • SHA256 3d50d262640e95219097addd2e9ad79cf5dd4d8819c3ae761087874edaa15cd6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 15.4MB
        • SHA256 76fd8599ae85218e99044e8ccd1e14414847fb31b01e761ac335033b86dfdc4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 16.7MB
        • SHA256 444dc4cde008ad0d23a6675d121ea9b631c36a6be998cc2c94d49e44d31d1b68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 28.6MB
        • SHA256 2258cc88dc4c17c296f593ac7ac5e05796bbcf1a852c1e7fc8fed1031081b0e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 27.2MB
        • SHA256 dbca563ed8bfd354a38a1f0eb015c2a6bbda03d09a8bf97589cc6f05e2147843
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 27.2MB
        • SHA256 acae4730f105eabe8b9c71d600a85e21642d0269515f14e3dfe8220d6ea80fe8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 27.2MB
        • SHA256 9d10e5455baea69dccf84b0eea329281e4b25a3ae3b2a2d894ec1f7eeb618b12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 27.2MB
        • SHA256 cc456b22e288377789025b804dc118e2774ad7e8863bab95779da9bec729c377
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 27.5MB
        • SHA256 7c3c0748ef882ea9696731795c351d4d4b767e28c4665fcd5f5786016774e954
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 27.2MB
        • SHA256 9ad7f306d7e399f2a43f06d15e1c8ddefabcc07ea79c6f9fe4be7329e0718aef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 27.2MB
        • SHA256 ffca4bbe0369846818fd3a4acb218c67a6cb2e48601b5d36f9fe25a7a1e65987
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 27.2MB
        • SHA256 64a0216838465ba9f2a41463afebea4cdef36789d5c5c210df0f4fd6aae2649d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 27.4MB
        • SHA256 8c5c774a7c5db9274c1b25a9ec8dfa4163bdd57e85dfae190c7adc04d34a7684
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 27.5MB
        • SHA256 b9712f839152341942c12fa822619d7747d605eb4991627bb21aa88c6fecb5b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 27.6MB
        • SHA256 bc525388f84b2cbffa0507d480bec9eaae8db4cd5739e4979baeb0caa627cfba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 27.2MB
        • SHA256 95bc5c175d08d76ad4017693a475727c0806237273073fe55ed62ee17a9e777b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 27.2MB
        • SHA256 046487c1fb85dbed4294d71d7c65989d0c411626493c7f2d7627240aae5db36e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 27.2MB
        • SHA256 5cb9d06d8f51f4f85f2ee8b64045545eb08305882890884511aed2407e4bfeb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 27.2MB
        • SHA256 ec201a38a184f58b3124a35ef8503e168d58156510aa544fa0735cc11ce5a9a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 27.2MB
        • SHA256 a19f5db681cd1107b70974f8b44a1eb340fa79adc6d10de246c6307eec60fbcc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 27.2MB
        • SHA256 c5878d6d902659405051c18ea2abe994cfe37ee01cffd238b2bd418cc7b5bda3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 27.2MB
        • SHA256 44b5f5a86e9d6c6a862dd3a53b4fbe6821b2a0bca7ce72f61e9a84aca56770b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 27.2MB
        • SHA256 21dccb9c947809cf64fde76b6dcc700f153261c2d2af4c67528ee1dbb98da6e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 27.2MB
        • SHA256 66ffc9739229588dffe3634d917616893038996a6a418389975f668080092645
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 27.2MB
        • SHA256 e511835c408a9a6698e5616cb8d0fe1aa0301098c85ceaddfdd6b4849bacaa2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 27.2MB
        • SHA256 27458223aeb9687c79f5f1e7547cbaf2062a86dbb154cdd91c93b0333ec818ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 27.2MB
        • SHA256 7698d697b3263b07d6ffe593672ad4399f41fd1c31b294f4bce02a709ec688f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 27.2MB
        • SHA256 415eb6c55901f50c0ea97414ef150d4b29b3e9d94ab44937f181da316876a483
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 27.2MB
        • SHA256 5339e6d596c7cdedde177237792c0aa3b65d53ba4c055cd45aaee76f7e2bcc0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 27.2MB
        • SHA256 888595691b36d9e69b59ffc26486f1440a40fefbaf25b75fa90c21e6c139f0f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 27.2MB
        • SHA256 0537eb5e47adb22ce76f8eaf0464deaf40ab5d1d7f54f8f4d15d86c624746eb8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 27.2MB
        • SHA256 44c9f40db91abb49c752b6617fd131f795564fba38c937e29006c12e624df075
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 27.2MB
        • SHA256 558fcd54c0102cfbd2f606714b46169c58f26577f6a6e28fcb8cea8f2bf74800
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 27.2MB
        • SHA256 dc2b08c3405f36a2ee702beeb2cc84e62a11223b48765ed2d251b0c12e5cc956
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 27.2MB
        • SHA256 8d552458bbdfb043d917f793a990b8c325c201cb6b9538d1c015e50a9f57ed81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 27.2MB
        • SHA256 9ef8f9e2c2919a992f10f1b5b949c141a821b260e70e907d88e269becdf400e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 27.2MB
        • SHA256 57b4fcf5d482b98ebcceca64e547daf92a1e920273a305a2ceb0cfdfecc14ec1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 27.2MB
        • SHA256 9ce475a070fe0e233cb4be4a26e19086338d6468c834f6e46427d44f15f6c9d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 27.2MB
        • SHA256 1c1bd5d3199d27ee77f63c99889731625f88c4223a50ee7a735e4251cfd4332a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 27.3MB
        • SHA256 646576c0e10da8077a510976db049c9b5cdead2e50230d652daefd2d1788c9d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 27.2MB
        • SHA256 3ad14b8f63bda2e0af76c1ea414bd9c93bc5eecbf462f07661bfc9fbb896195b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2804-19-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2884-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2884-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download