Overview

overview

8

Static

static

3

2026-08-16...uc.exe

windows10-2004-x64

8

2026-08-16...uc.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/08/2026, 04:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-16_520dc14425dd1c6dfb8cc78d5119a32b_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
  • Size 11.8MB
  • Sample260816-e8qgdazdld
  • SHA256 b28295a98114a9ea83d523ce3e74a342aae66240644e575a5c997d695d843eac
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_520dc14425dd1c6dfb8cc78d5119a32b_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-16_520dc14425dd1c6dfb8cc78d5119a32b_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2452
  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_520dc14425dd1c6dfb8cc78d5119a32b_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-16_520dc14425dd1c6dfb8cc78d5119a32b_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4568

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 11.8MB
        • SHA256 4b6aaa7372a35f8e97a51cf8277fbee01182ac83534112a5875b3da9b45c7ae2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 23.8MB
        • SHA256 bc063c87335708be49b76a0faccabe8ecb411013c4fb5c257b12ba873aff5127
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 23.6MB
        • SHA256 49b1c063dea2f53de840b9a549abe2813a65aeead8a1dc6beae6075fda81d0a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 27.6MB
        • SHA256 47c0f67074cb6e0e4d5ac1ae7e024e4d64f3de899dac475ddb47fd2d1952f508
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 23.9MB
        • SHA256 83c3a30e79d3c0c48b200afcfc684b977037880631e240038418e78a1627752b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 13.9MB
        • SHA256 4e74ee356d3ec33ee9d4c504dd6b778dd0f64a5a68487841152e409db8d582ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 23.6MB
        • SHA256 b31cf066093d7e062b31cee591e8266e2d63405178881dedab061f5d8abf40ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 29.6MB
        • SHA256 72233b4ba58da20374f905c978c8fd395cc3d0ceda9cd4883749c5407331a8a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 17.8MB
        • SHA256 43a52ca2e6edd60dbb733078804d0652902af268e3ffb9917acd05d792edebfe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 25.2MB
        • SHA256 19ff7084c227f615c4fd990170fe3dfea69136b85c2f8fb75369559d8ed60ee2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 27.0MB
        • SHA256 7263b3b944fd5908fc48c543a40fa9bf55bca3a20cdb14f831854d0b026b72ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 25.8MB
        • SHA256 4c6a7634d8541a011ddf4f4c20a8d60e5e799605643a7783e88d6d35ea40cab3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 25.2MB
        • SHA256 dae5db58a26f5b14a885bce6b6e530049bac05e2af1f286d772d05dd13600b53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 25.4MB
        • SHA256 91b2bba8ff1c91d4b01ecefc236ad6ba07f499f9448a93220a5022140a37ca79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 24.9MB
        • SHA256 667ebf0f8c33af3686597082e58023eb75ed4a7699928cb9b487a3e6e7e69f81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 23.5MB
        • SHA256 3aceb17425a1c1acf02f881ceafaa20f8451737a83669ee0024852dcfd54bc1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 23.6MB
        • SHA256 6be3e0a4d5d018920da5536b734c452fd385e567589022b4641844fd64402383
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 23.5MB
        • SHA256 cf7923dabf095518cecfe3e5a7e85f7e10506a87a635bf6adf046cf5d19ecc2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 23.5MB
        • SHA256 65f179a5738535bbbab4dc329a27e03568e2516bad593c0b283275329ca7a6d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 23.5MB
        • SHA256 fdb8447b0d259b3cdc45fbd4c4a43f258f7912d1b414d67c19b889a96b61566d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 23.8MB
        • SHA256 03f548a7b6a58ddb07663874c2040b4564b3e516979c1c199c2197ed9d082d35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 23.5MB
        • SHA256 0fbf1dcf5a22047b6bb0dcc896604f81c719d798f4122eb8117630b30a21c46d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 23.5MB
        • SHA256 a7c58d5ce764d4d92ac20421c99e0fb07fbadb1a652a0f899e32668a370e4284
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 23.7MB
        • SHA256 4a5283aed5db69f5486b0213f9d67c2fa5b889917ef03cc729f2c773daae2a93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 23.5MB
        • SHA256 992c815e3152fe9932152e78ada9ad48698403bc2f943a78afea801b81857778
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 23.5MB
        • SHA256 0e6eef0ebeda2b01102c0b0157efe5d3a70d9d150228ed9cb54f58e01d7011f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 23.7MB
        • SHA256 acfe6e7f4a8b630488af524dbe2f6c436a9821c481a55ef9c6558cc22c64a4ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 23.8MB
        • SHA256 5f07ead05123efb60a68ef4fa00df41b0f24b5b085030dc16414cb49b71f9071
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 24.0MB
        • SHA256 8c5265c0d3dc47c77ffb2d7462fdd1f7e742c4eda5d8ebf9799670029cd420d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 23.5MB
        • SHA256 8c428a83d06dde9d167bade79cd6f228a5e9f43d56aac2eb2d944e912c0e6cdb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 23.5MB
        • SHA256 4e21e4f00766a61b56250dcfee9721129734754def0fa22bd1348faee49455e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 23.5MB
        • SHA256 f8bb584a264113a9e23a2cd9a757afb4f7e44854f5317fe774d25ebe79147393
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 23.5MB
        • SHA256 a73515c40f2810ec6956c92afba157f18ab3506bf6506874cc3ea029515aedbe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 23.5MB
        • SHA256 050153938abc16ff41b05e227f6e8cedc482cab1965b39de8e55bdefabdb9893
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 23.5MB
        • SHA256 0aedec72395f77ee00228585430ae5fb9201ae02f15b9a16abc12a60f1cfaba1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 23.5MB
        • SHA256 d7c1ec216947293e9671a2dba899f6481e03b5fcbb0258c749129c1c8ae996fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 23.5MB
        • SHA256 c243921c24fa54e436b89dd5099b6ab9535aa1b3a70af7d7f5f0fe3cb394f2e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 23.5MB
        • SHA256 a31e974e1225889e66cccef9c9b66595058bb25ee086777c91effdcb11d35e93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 23.5MB
        • SHA256 f7fbcce94d624aac0c068a687d309c2e19dc019e02582cbaad37d691797fa306
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 23.5MB
        • SHA256 8fb095caa0db76b078acf9953e2af1ef11259c64e3cbf0534155f515a46ff7bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 23.5MB
        • SHA256 76c41d10280820552289736193550cc8b6532442344550845c6998cf2da44de3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 23.5MB
        • SHA256 eea21ef564694c076f39a5368f9d46d95d563ba43a780a22d02e27bcfc9b018d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 23.5MB
        • SHA256 ae5a8fccc03fbff63445045cfe6e8063c5bbea3078a885b76bc08611efa2c844
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 23.5MB
        • SHA256 e5b2cc22867b2f2baf8c58b6be18c7236371124d5340273b71f179b7e75f518e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 23.5MB
        • SHA256 ee5ab07a6025cf5ddd6db7c6f06e87c56b40778356c488d5008ad14c13ed2282
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 23.5MB
        • SHA256 ccba332cb6e55f830ba316419ea3a044484c47d85d7580f3181064ba5f2138bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 23.5MB
        • SHA256 e695c4736e7999714edd4abaeb568f921aea2f2ea51b1b8e99f4461b8996b421
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 23.5MB
        • SHA256 0718f78e3abf208eb221a90520c9262aa17333147be43150f527f86c55c250f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 23.5MB
        • SHA256 46b4bd7ffe1d82cf88de1baff06926c321da184146e3758c01864e9de13c272f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 23.5MB
        • SHA256 aca5872367ede1a8229876e2001d1413900919a90f05905159a816236f7fd25e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 23.5MB
        • SHA256 9b4165c4aa096524397d03a1da88d35e9ce143652bf20d38d6e5be6cc1471c0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 23.5MB
        • SHA256 a7c411d3950f6ac0ef8e270665b06dc282145a440b943bfd2003544fe8c9a6b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 23.5MB
        • SHA256 d9fb92b019a9de2da126ea9a8a22b2412e4d7f0163c5ffa7ed264fcf8578ecaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 23.5MB
        • SHA256 8b328cfe2ccdeb125069c29421b6bc80b752f6267a62667e5cfbf065bd85bdda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 23.5MB
        • SHA256 a4134ee73108be0fb12639881d8e2f7aaf9fd5533cb0eac4e6d96b505248bd72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 23.5MB
        • SHA256 0487db522b4e8eabb819cb7e995eb7fe840ae14ead4ab9ca8f46bdbb86b5bd04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 23.7MB
        • SHA256 f5d09cc8bb750ffdc097a51ac218099c5adf2aee4cebd2b7666fd9ee54089244
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 23.6MB
        • SHA256 052edcac823f0f84b70f305d952c3f9295031d9dc9e216f09690c854c15967c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 23.6MB
        • SHA256 190a96c7a03be9d6acfc67f2eed2af0009d37174aa1d2eba9b186f78338b3b53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 23.6MB
        • SHA256 c17b130afb0499d5da201d921853d82155a36b0fe038b3758b8eb0faf4a69ba9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2452-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2452-19-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4568-37-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download