Overview

overview

8

Static

static

3

2026-08-20...ed.exe

windows10-2004-x64

8

2026-08-20...ed.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/08/2026, 07:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-20_0a4559c9bb4192c3a59ec1cc1ee5e11a_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe
  • Size 11.8MB
  • Sample260820-h66mcsca89
  • SHA256 b2b3900ea659204cc840395a3e3c45a86a55b99064a9f26656d7d3294056c8e0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_0a4559c9bb4192c3a59ec1cc1ee5e11a_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_0a4559c9bb4192c3a59ec1cc1ee5e11a_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5356
  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_0a4559c9bb4192c3a59ec1cc1ee5e11a_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-20_0a4559c9bb4192c3a59ec1cc1ee5e11a_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2200

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 23.9MB
        • SHA256 7f2531e797c0c09f7bbb65baa38c5c8228e03761b793eaf0ee1c9d07fd127418
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 23.7MB
        • SHA256 df4574be68989c8f502b12dd8a15a65e6f07d9f837ea214e7eadbb3cb16e6dd8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 27.7MB
        • SHA256 993517bce42bfe68956de686c39acfe6b717fb3453842343b6354e8f465af7f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 24.0MB
        • SHA256 3a773232daf1cd6ac711f4d0ea9fce3878f41da3314b0fa55f54a2a2983f96e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 47.1MB
        • SHA256 2e2164326f66e736f8cc779d57f0cd29f5d3c0f4030b8a10989ff60e75146e33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 13.9MB
        • SHA256 fc9dd5f8b932320ef75716fdd7258b31a2bc25333c4a5feb9797c600e97c4c36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 23.7MB
        • SHA256 cc9722ddfb3308692d4e12676b4f5b641c36c14d5d97021f6b2aaf59d74b5876
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 29.7MB
        • SHA256 bb411194e7d8cb5c0a4c520dc747bbb8dafc8eff807bd4705ed9d6ee10045f80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 25.4MB
        • SHA256 a7b1eefe7cbd07cc94666e7e29e5e67f7d5202fa07aca2decfced0f9f561c106
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 448KB
        • SHA256 30fda89260062596f8473df15f576de632ea44d623bd575d46ec46d32766b91b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 25.9MB
        • SHA256 1be5c81cda9d042b3bb863050b692f0e436b6eb5f616b0ea7aad93c40eb16919
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 25.3MB
        • SHA256 ba6d780163998dacaa831e463d3b70b43a3c3625a1f87b51cc96015dc792a666
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 25.5MB
        • SHA256 cc67d357e2ee09863082704d9c66de9f3147b56ad3d1d10e78e7c78d40319479
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 26.7MB
        • SHA256 02f1b2acdc5d746ab9dc2bc6282a240121f581adba06754e3dc41122af12db6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 25.1MB
        • SHA256 08ca971ef1cb6644e7cb17ec36ba5e17e69df11a8f0eb57b75cfb7a44b5a0c57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 11.8MB
        • SHA256 84a690bac30439fa45889e1cc777a5267902d6442ae69ab8baddd4cf336cbb22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 23.7MB
        • SHA256 41587eb2e139322690309b1d0544bd71309a16a8783b75a69ae3110c06943b0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 23.7MB
        • SHA256 ad7dcb2b43d768a5feda62f474f7475a0eb9fd78afbcddd1334de12f6a974e64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 23.7MB
        • SHA256 e87500222ca8aa632f53fef6a3c474a1924f68c389a9452923b523a3278a8b66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 23.7MB
        • SHA256 a6a7a436a0b3ac759e3863d3f1bd0b5c3fb6dd31b86b088283acfd5057210608
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 11.8MB
        • SHA256 085cdc75238565ce2bd1c31a1007c88a503802a8d727901c1f73c3112ed46a0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 23.7MB
        • SHA256 a49bbdda6ed59259ed3c8ddd7a150f0234c487aa2a2b38d5ed962c4a6dddee59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 23.9MB
        • SHA256 c41fb19312aa1b64ecd66596dcf9795306c2fea345a9a1cb9d5e5286cc65065e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 23.7MB
        • SHA256 551d75ee8451b4ab750d4c694b70e0081b50890118cff263295192fb2213c71f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 23.8MB
        • SHA256 81ba7ea543cac40332c4124f8e721e8363ca08031bc15cabb410695a66628aca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 23.7MB
        • SHA256 b50d771a94a931da5afe462a67be84ca2379a9495228d871dc30cbf351d4a64a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 23.7MB
        • SHA256 6a62af556838d7346d63857696705e4946913bcea5f90469bdf789f926626fdb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 23.8MB
        • SHA256 d7b4320246941a431c701abea44043b7b4e993963520d066dd93bf188fca8df2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 23.9MB
        • SHA256 849672e4dde203f788ea9afa30d2bbce400ef3a25f014067195a74038ef0e5a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 24.1MB
        • SHA256 0fd11c305e0b30d024d5f0414e85688191250a1326328068e025bf9364aeac64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 23.7MB
        • SHA256 bdd44fdb83a5f5497ed65cf9ab0bd4bdd4f69cc178705673f49102d4bc9fe91e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 11.8MB
        • SHA256 7c6eacfaae86a7f5dcea8c171a0a3d0c3beb10d693ba2a0615b7e4d45da08054
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 23.7MB
        • SHA256 281620faf5eb17d731d29489c4b984c34413b275005b920c697c6d8f1b50b52a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 23.7MB
        • SHA256 3ca488d2a499d9cdf7ad3d5b288997ab3bc7ad9b4a00262272cbdc00bd712c8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 23.7MB
        • SHA256 18eb28ccd11a9f89f5b17bfa7b40ef880690d45bf9203c3d3a6e55b6a8d91438
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 384KB
        • SHA256 144c4713f378ec54938375c9433afb979bcdaf05350d70c3d422e883e7e60d15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 23.7MB
        • SHA256 fc5bf94f0a72a699f781c4ff718bc72eef1bf059bdfab9969159e100685c83c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 23.7MB
        • SHA256 e16632626a4a83f590a082ae2698c512c871d5995591610e96cc59630b37f3bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 11.8MB
        • SHA256 42cac0013641da55c0378de654a978f6c6ff3e4e808cd38214544f02191af1ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 23.7MB
        • SHA256 836c5a4b33b9ca26f35d3b16c9010c5b8464d57a075d504d6f96a0f0abc9fde5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 23.7MB
        • SHA256 0e4e822314f4a1a462715dd4f4a848d756970867c77cd4d7028fd0d15b2d3fed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 23.7MB
        • SHA256 0c3e27cd259e26c0aba76f7de5dc27813b7f915d859c7c6b7e00c9e747ed9bf1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 23.7MB
        • SHA256 323901e734bbe811300233df704ff7fcc17d7f4e1f925c3ef88dce6c843cba33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 23.7MB
        • SHA256 0d47c4072a3d88b22926506336e38aaa2cc4a7637bc0554a5588f6b80599599b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 23.7MB
        • SHA256 152d78b92b1717e37dce63428cde8399f0319a53ade9ebc157e502c0e9d25c7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 2.0MB
        • SHA256 80a28befe46c727efa2c71e06670692e1be7a172b8a894fd5e9302a2a23205a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 23.7MB
        • SHA256 3b80e7cee1cd3277d12744f9217b6c34f853f851cc1a970cd5d05e843d052fdb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 23.7MB
        • SHA256 78422beea6d9aac6a3de7f01c33251d7ae69263483d0e127f27c52e7351ec4d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 23.7MB
        • SHA256 94e61ee8e4340bb9bafc360c3e75d22ee5052669fd5618f4e5846ab73bb263cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 23.7MB
        • SHA256 8381d99e8a81b9ed6b942d9cdef6c4ccf7868d3c335e4ae8f26ac661307a90ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 23.7MB
        • SHA256 56743c08e2048f54f17d756d0f02d795851da006b6e3ea86c1bc86e547c5a1f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 23.7MB
        • SHA256 ad91a0172854efdd0c470a091de524d18108ae0a98542de968fcd418221d695f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 23.7MB
        • SHA256 994641f284ebf1b8f5602a6af39c4268c24ba90db16c5ac925877f2e475be168
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 23.7MB
        • SHA256 f9d0df0ea058e665bfe1439c9b17e23b0853c838b12783b00b312b23933fcb23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 23.8MB
        • SHA256 3d9097da69a892744f7b65f67838d2c2e69fe048af1ef896c9af5f1d8a4c25c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 23.7MB
        • SHA256 e0280428eff9249d71c68e761af496ad9182dba20296bf69500896d4d42e0bb1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 23.7MB
        • SHA256 8552f68cc0168804e62486ca8f7ceda91a7cb693afcd0c5f1df5bd6fdf9ee2ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 23.7MB
        • SHA256 0dd418b17d02207169f2bbf7109073f1d1cec960ba95f48bebb953cd1ae33ace
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2200-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5356-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5356-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download