Overview

overview

8

Static

static

3

2026-08-16...uc.exe

windows10-2004-x64

8

2026-08-16...uc.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    119s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/08/2026, 17:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-16_8962c7624d34fbc1b9445faff19dad4b_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
  • Size 11.3MB
  • Sample260816-v3c7vsfl4x
  • SHA256 c2765ad5ad8628873a5dd36586433ea12df5434f321f5cc09d1769dafb8781f2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_8962c7624d34fbc1b9445faff19dad4b_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-16_8962c7624d34fbc1b9445faff19dad4b_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3828
  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_8962c7624d34fbc1b9445faff19dad4b_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-16_8962c7624d34fbc1b9445faff19dad4b_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2584

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 11.8MB
        • SHA256 fdae66771140328efd289d8304a3a2a7f4a3995d081bc94f3a8afcf3f4e62205
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 12.2MB
        • SHA256 b2d782ea1f9d948d30f79362143de398fcbe70cb1ce82ded63079016a72892ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 12.0MB
        • SHA256 d6803aa58ba8bbf6fafa83fa4fa967692f757d92c76074ac48b63be09470640c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 22.6MB
        • SHA256 5d26c5de39ddb315faa5a7d6e3c7b18c17b39426da36f72f5d346bb4a742382c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 26.7MB
        • SHA256 b26dc2c216c82a4551658e92c0a8f702d714fc42697c28f7d3dc55f4aa9f723a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 34.8MB
        • SHA256 8f5c7775539264cf4a6663cb9e22206717f9e42968ae00c0d70a9715a81e74cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 24.7MB
        • SHA256 229d50ae528e40a8514304cad7b66fb25bd7f2bf276a588c27e5c1aa5ae8be0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 22.7MB
        • SHA256 e3a538cb22f079f5e9a0deea0c181092e283ce172265b8ad8dfb4e7810993332
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 28.7MB
        • SHA256 51bfee333c3d99483aa5c774fef47b2e26b4a34d93a066c9c38bf8660942e041
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 24.3MB
        • SHA256 c2a541bec1cf03bb26477a5a555471e7bc550e697f417edd816b3672c0f68ec1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 26.1MB
        • SHA256 531f282acbb3e5b17958b331a7ab968885f1ef761a22eba1d707e8e88cb66d21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 24.9MB
        • SHA256 061c383587b07f7b6abbf101ce6c2db182b20449884d578f39788e27f222a042
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 512KB
        • SHA256 54a9cdeaa70d56716fea0c2b033f8174b1495f38e428abc781f5cd97cc816efb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 24.5MB
        • SHA256 c27a71099cbd34659d220509996f77c1d5613018a1ac5c39cfe48fa9bc306532
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 25.7MB
        • SHA256 2f3e4eeeba98ce63150a55a007516e0e136c53015b980048f1f3e72d1568fdb8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 24.0MB
        • SHA256 0aecc4166fd5c351e4834b6c7e761e7d26bd031b8466f02d1e72a66ef19fcdec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 22.6MB
        • SHA256 829c24883fb8d1f4834c8be88834dd88a903e169698eecba9b80dcb57b0d2c53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 22.6MB
        • SHA256 5da09702f714afbc9288449ff40dc06130dc04a92d3e6c2a9157c251283af2b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 22.6MB
        • SHA256 25f753cecbe69a79a89947572b0547f527ec95fcac5978979d3f07b9838d1484
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 22.7MB
        • SHA256 4d7ef0d993fa4fd80761495e51299fefe94baeb51eb11554aef202bdf47278e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 22.6MB
        • SHA256 95d6f72dcabc352662ce3b36f1242f61404df67a7c7eac5029a08c56bff5ce08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 22.6MB
        • SHA256 0807a7ac265aeb262a3576ade6b4f6dfff15bbc9158197f01a0a875c4445c6cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 22.6MB
        • SHA256 ebdd8501c5b0900d77554dc79a54b8de7b6d5114a33fb40e7a22c68710d7046b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 11.6MB
        • SHA256 c082d914d3bd03d8b5333bd8ddefb9f3be8c035902b589fbc4cffd84d0da274c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 64KB
        • SHA256 d2eb08ebe0c7e7ff2223b6feb8c95f679251883e0b850d913bfa4b604432b861
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 22.6MB
        • SHA256 f97287e1e3600facb33475a5a8ee99b373e19aefb3b609faddb1b687d05c489c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 22.8MB
        • SHA256 e5c88dc989731b37d62958e9294dbca34a8cabb4fd3e12082d43aefb21f94b2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 22.6MB
        • SHA256 96a539370b96809f74acd980c1adcc99fcdfaf32fccc58dc6f40ba5879261bb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 22.6MB
        • SHA256 7b429724944db0cf3aad4c91eaa8ac41e50472b03ccc48dc786f0e5e101ee9f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 22.8MB
        • SHA256 8e5a161b9db5d78d86bed6680cacee880d3019932f402f4004f8e315bfd0cdab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 22.9MB
        • SHA256 09d4769c89391756a4f81c77f7ac0aa557a9fffcaf0c9c1331e3b39f6fa28207
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 22.6MB
        • SHA256 104ead3958387f34e7eac86d0cc7655ec44130e2e0092ac13f60024f63d0801d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 22.6MB
        • SHA256 10b801892c5b670a5a3866ef5f7db30902cf443a44efae877f7f4e87dc286216
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 22.6MB
        • SHA256 81fe60ce5701ffcf51d2c895293953c501a944cdcde1f236bd345bb7ca91fe49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 22.6MB
        • SHA256 3588fcb1493977194481d5fbe9a208cf3b5b17228ab7acf80a77d120d402d593
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 22.6MB
        • SHA256 1ec85b38b881f074617d49a8a4eefeb483415d3e063c8ed0f62274a557e0e9a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 22.6MB
        • SHA256 bc890f100c05b45933e58dd149b6b2635fd0b7799bf049b04a311bb21fb5e66a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 22.6MB
        • SHA256 0cf21460921b515ce51c23b4d5abecb89557a661630cb6f51d6ac6cac212a39f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 22.6MB
        • SHA256 2a21623e84c718c8410b578562b90011e43a6c4b92d3a75d002637f649edd3a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 22.6MB
        • SHA256 58095689271d5d20ed31a6faf86762d3ba6cb436431dc3732a978d0ca8d7aa32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 22.6MB
        • SHA256 f6eab7aa6297fbc056c45d3a6b7037072a83d427019b30891ced195aa2f42e82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 22.6MB
        • SHA256 90e380ee0a0c91f2f5730b50db4ae4a4c8ce5277cdaf0c3e93e3988be2c9eb17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 22.6MB
        • SHA256 4e3482cc13dc1a69e8f1edb7ec47282d8b657259204a138642690d68cb3c9a03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 22.6MB
        • SHA256 2bfdb1e307e9380ec402c7d075b727e2016f19916c51da3eb62a652c6510e5e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 22.6MB
        • SHA256 fd3f6aca394e003f66c1f151dafb0e23413b086d92017b2e7d507ad6dc3c67b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 22.6MB
        • SHA256 0c8f1a9ee2105e658f14d147eadb9527c5b8c90a1fb24eedc0701f428b81ad48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 22.6MB
        • SHA256 518920ca56c1fe38374d725f219c328044cbd1b13e2024a8ad45a927471e605e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 22.6MB
        • SHA256 bbb2c81e91d0dbbaf4b8eeadb5edf199c46bb624f1578cf96a9702347a1b9a0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 22.6MB
        • SHA256 ee3bd06ffabcd01bebaa31f93a52bbaac4af62a0a22c08d6a577309397bbb98f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 22.6MB
        • SHA256 ff344311bc4eff0dfb03f4b83040fd98951c64995783c319d9c4da65a2eeefee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 22.6MB
        • SHA256 9439ea7c1910d3de148b07aad6460cb7a4800af0ad7648186b8e6470a6042384
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 22.6MB
        • SHA256 2d1b54d42c2bfcef8929f0f5c88f874edb72af0b4b212eb7e6c94396ff683f38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 22.6MB
        • SHA256 f119be0f999e74152057d06aa831bb2b1411cb8c65a8c02998d8a789faca0a2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 22.6MB
        • SHA256 35a2b330f06df95577676834e1748aa1940943a21d99e4adf373e1ecf9a18352
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 22.8MB
        • SHA256 ae02f0b3bdb58403594da33f7a6108db2d84aa8c06ab34fbb7970ae76d140d35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 22.7MB
        • SHA256 5101adb9aa5b8eed8064855ab31cf48fcf1650a36ce0caac3a49baf44d6a9163
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 22.7MB
        • SHA256 2c4c7330e08234d6831321dde9b650bce28783a74946c432660f420cfe0062b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 11.4MB
        • SHA256 5ac3fd8eb3c5b26a8ba5b05c32880b980e3a90cb7c33c1da89ad3873d097c4c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2584-8-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3828-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3828-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download