Analysis

  • max time kernel
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    19/08/2026, 22:32

General

  • Target
    2026-08-19_883f39b7b42154f95e89df9529db0062_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe
  • Size 7.5MB
  • Sample260819-2f3mkavdkf
  • SHA256 112a111159cf79481225b3858ce74b798f299a4f988d383b6b6e92e4642bd93f
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Control Panel 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-19_883f39b7b42154f95e89df9529db0062_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-19_883f39b7b42154f95e89df9529db0062_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3368
  • C:\Users\Admin\AppData\Local\Temp\2026-08-19_883f39b7b42154f95e89df9529db0062_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-19_883f39b7b42154f95e89df9529db0062_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3432

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe

        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 8.5MB
        • SHA256 d92fb65fa5e9d44754e7c37e0269c52d199209bcc58de560454b6461194825c7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7zG.exe

        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 8.2MB
        • SHA256 b386135dcd457db425015f1be9ad084e87fb51fc73bded46ecbcfe73f5b8f4fa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Uninstall.exe

        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 7.5MB
        • SHA256 c0f66c51d9769a4638e4559166b41c411ff516a2bbf1ac77f5fb5016296b4118
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppVShNotify.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 15.3MB
        • SHA256 d31a35cd40254f955807ab03e7a9120052791435a242fa29997e78e0cdff00c0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InspectorOfficeGadget.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 15.1MB
        • SHA256 f02e079bf87a626c0a75beaa9a3d41e769118ebff496cc3ace4e9d02ce2a2ca7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IntegratedOffice.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 19.1MB
        • SHA256 8a952b428728cfdcbd969060116c81fa02dc8209046d0125107d3af99cd9a798
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MavInject32.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 15.4MB
        • SHA256 649e4fae27f76996246de05547672ac89edf2ae24a2a5d491fdb63c3651f6003
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OfficeC2RClient.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 38.5MB
        • SHA256 6e5d367d2c7d1666a9a9426efddf511b448c1b113e6a592ea94ff19106e9e7fd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appvcleaner.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 17.2MB
        • SHA256 3146baa13ed978c141cd43c372606b147eaed17af8b02712ceca784b3f5cec90
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VSTOInstaller.exe

        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 15.1MB
        • SHA256 be87acc01fcb6047ed997051fdd710477ccd5ab4f3eb7939559bd1088041c288
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrmstp.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 21.1MB
        • SHA256 92e1d6b351fa5a4681cfaa1aec25be061015e2f1879e9596e7b7c1ff6188e029
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_pwa_launcher.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 9.2MB
        • SHA256 5097b8c6c809371cd61f7efdcc4e5124b77c7082b590789ad2f2732bd244b9c9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevated_tracing_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 18.5MB
        • SHA256 c58a3874708e869700f90688cd0acdb27f6eb4b64fccc125e4cdddb69fa1b818
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevation_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 17.3MB
        • SHA256 6a826737c26e04d42a3aeeaf2e93bf9c428f0c81e974208688b7d6abd5a023b0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notification_helper.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 16.7MB
        • SHA256 14da1270ffbfeb065b1223c1d84bd8693f6ada5f93395769c6c2d642ac5a28cf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        os_update_handler.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 16.9MB
        • SHA256 e7f0c7e1b8d6c60a2d919951c46fa28aae358787660a42848e349beb5cf23209
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 18.1MB
        • SHA256 901aa0988ce1957e220c8a3551c60ca72049f71f9d291e7e355dc4ab594d6d59
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_proxy.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 16.4MB
        • SHA256 6b41b2f8d23f3705ff8aa6ef7a065dc10add95676a5adc39ae6fc14627577281
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appletviewer.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 15.0MB
        • SHA256 808830b550338b4ce8d64331f0bd0283e166ac35cc49122e982d41f7e3d1819a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        extcheck.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 15.0MB
        • SHA256 88ca8d48cbfda9c513ba8783d7b524c9dedb16638e5dfb55fc7e989538f3618f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        idlj.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 15.0MB
        • SHA256 01469043461addd7753458d825bb2919679ef94998792cf33e7d39241269ddc5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jabswitch.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 15.1MB
        • SHA256 7d35dc2557381c6f5928994584b646672cc79ed67e7a933c850a510e1d8af098
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jar.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 15.0MB
        • SHA256 79eaf71f61e0dc1a70db9dda7d7da68680d4b5dfe7ce8a1bfb21d2dcb545d4ac
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jarsigner.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 15.0MB
        • SHA256 2ccc386f7ed201cc54bd5a4615febaebab7e13ebf8b5d1061dd7b6caf4fdd696
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java-rmi.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 15.0MB
        • SHA256 75bf5e8446b6c2bbf0329f20a6ca370313fbf890d1d38219503b4b0e3292be02
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 15.3MB
        • SHA256 1fe9db7ce1aa8e60d0f04a38797f4ed55c83e67a6dc0fdd80615187abdd98f92
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javac.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 15.0MB
        • SHA256 7e4635f7a1b1b636be9f9b3b86633a40bcc0210608fd2ce0fb3af6338455f26f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javadoc.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 15.0MB
        • SHA256 0a6660661da1dcf0ad0f256f478e1de6241e1f4ff77b0475610d07b2cce6f3e6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javafxpackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 15.2MB
        • SHA256 6ec8e951599f81660d555ac8c197ed317ae6c09666bd08d7f3dc7c5990836ab6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javah.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 15.0MB
        • SHA256 8166a3c26e0db94ea1dd2cb2ae7817f6c9a171a9ae44c59cdf7d11f8ee0cb712
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 15.0MB
        • SHA256 d3c3f3efa8f8af19b785219ec7af4aa10282319453cc6cdd6a6005bd4b1d151a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javapackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 15.2MB
        • SHA256 2997c3b31bbf992fff187dd37433fc6070c523e24a283fd638df0fdaa23435ac
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaw.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 15.3MB
        • SHA256 4f06566894e97d02f809c33477efff7bb5930242eda602456c0a514258bb04af
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaws.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 15.5MB
        • SHA256 f4a6c06cd9122c5a916153e5a6f07c3111d46c361bb117eccfc355c847a3e185
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jcmd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 15.0MB
        • SHA256 4dc30b99d627d95d26db93eed84592ddf0f4b85ffbf8cb3d85e7703cbbd67891
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jconsole.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 15.0MB
        • SHA256 debfb2462fca75144a4f43970e26ebf0d87d67551ba54555f1c77a6ce6a52f47
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdb.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 15.0MB
        • SHA256 7bb03bc81e415acb437ef715bbb9c2aa7a91f637797887c9c0ea67bfaefe48e7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdeps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 15.0MB
        • SHA256 f360a238345ea59106fd817df571f71afcacfaa36786c142dcd7cceb50b9f3a8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jhat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 15.0MB
        • SHA256 1e351c98a11a156733cba933ef5ace31292dbc2b6c6208881bd3ef1acc2f46e4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jinfo.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 15.0MB
        • SHA256 eb5bfe9fb6653fe65dd6d60fc5b08eb0bea08fc950c9f27c1341b8a9adff4e78
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jjs.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 15.0MB
        • SHA256 056e9f222f573481492955128a6c0502812be4d6e49243935b9a5aaa1789e382
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jmap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 15.0MB
        • SHA256 9fe655efc661ba28fd5f2abaf534e342899104fd51600651586309241356db90
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 15.0MB
        • SHA256 5ab99fdd21def1af07d16a72b8478109338802258c75e9cd91bd7e46c905fe1d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jrunscript.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 15.0MB
        • SHA256 4bb08ead8ba86f01d42c25028f0e20a4b1c16f028162018f62a71ce7f6665ae3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jsadebugd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 15.0MB
        • SHA256 bf93944e55ac8917117e6923c14bb0a411db7ecfa06b6a70fcc6c565a489d36b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstack.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 15.0MB
        • SHA256 1fd0068297f0ede4d90f7e1cb81717297bfcd837430a1ab35dd4da0af2c5c5b3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 15.0MB
        • SHA256 093326485c2ef1b20f2965e1058d3d9ba910f2edd3828e5b7c7c3d0f8d3b265f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstatd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 15.0MB
        • SHA256 48f39cabb7bba94ba4d361a52b47a88636f6c190aa9e1c1762b74d70f64f191a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 15.0MB
        • SHA256 df09d3ad79247872fa33684bbd7691799942def418ca297f6ab92a44540a454f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kinit.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 15.0MB
        • SHA256 5002bd89ac9951f25d5fa56e3b805e8b80c730b2b2f2d5756cf47aae46c7df6a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        klist.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 15.0MB
        • SHA256 09fd64ae5e91d1b8e8ec7b291d219c2a95cb2882aba529c59ace0f463a3a7690
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ktab.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 15.0MB
        • SHA256 1e0c0e6bec2f0dbbd74f7869297815fcd7c6a93d43be1aade3946bfdea22b6d7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        native2ascii.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 15.0MB
        • SHA256 d1c840ab2dd46de18bd900922f5624c6595f4c3d064b8c8d24bf5416f8deba75
        • MD5 SHA1 SHA512 SSDEEP TLSH

        orbd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 15.0MB
        • SHA256 d5c2453ebb6879d41a3c602884f68753bc4a4f2cec7812513864aad2605bc3ea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pack200.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 15.0MB
        • SHA256 fdc20a5f5649cacea2f34aa3bea273438bbc7a45bc972e1e3e2b9b61480ddb41
        • MD5 SHA1 SHA512 SSDEEP TLSH

        policytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 15.0MB
        • SHA256 427f64e30ce42e87c56b1ca779bfec0a528c576441985e026c292421b883824e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmic.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 15.0MB
        • SHA256 7dc41ce624da3a12f324497c6cee81d1074b1ea50d5c4e23d61c3e479072df88
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmid.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 15.0MB
        • SHA256 4ee935d7b0b6f261752765d025f097a2c17e49604648042f32e3ee5a1090d905
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmiregistry.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 15.0MB
        • SHA256 a45d97f8d41007ba79b6490959744348b670ce78352d8a34186c72912e9c758b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        schemagen.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 15.0MB
        • SHA256 5a4664a3194421241226d030f0ff07fb157835177409b6aa42da8a69a3bedf38
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dotnet.exe

        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 15.2MB
        • SHA256 143f433b703eaf8b6878fa53d6c40c6fc0f5b523c9f14fbbdd7ca172108e4941
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 15.1MB
        • SHA256 84ccdcc745140e3f3dc538bef4c2cf15361fe290c53b4322a6b460b3e36efdb5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 15.1MB
        • SHA256 4a39b37a45c8309f43512c4b00235238539389c41f43a1f9d089c455f1aadb34
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 7.6MB
        • SHA256 531b933c6e467a57881f1f4c51386ec8378ed4465cb9178c29ad6f9966fd91f4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/3368-0-0x0000000000400000-0x00000000004E4000-memory.dmp

        memory/3368-1-0x0000000000400000-0x00000000004E4000-memory.dmp

        memory/3432-7-0x0000000000400000-0x00000000004E4000-memory.dmp