Overview

overview

8

Static

static

3

2026-08-21...ed.exe

windows10-2004-x64

8

2026-08-21...ed.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/08/2026, 13:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-21_6db4a122f4fb353916e1b8014aa23130_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe
  • Size 28.6MB
  • Sample260822-qdexyavbrd
  • SHA256 616de6610f57d2fafcbe11f787c876ed35d028a19feb8ad37ce2a00b2530d610
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_6db4a122f4fb353916e1b8014aa23130_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-21_6db4a122f4fb353916e1b8014aa23130_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5840
  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_6db4a122f4fb353916e1b8014aa23130_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-21_6db4a122f4fb353916e1b8014aa23130_akira_amadey_cobalt-strike_elex_emotet_hijackloader_iced.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3688

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 28.9MB
        • SHA256 9451d3f4d9f5a18501d4df733521cb95b31e5df6062fe2fc283e3e361c3c809b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 57.3MB
        • SHA256 7c5647348581cdc22e40ce8091c4027b179204b04e08de69655aeb7dcbe92c38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 61.4MB
        • SHA256 544f7cce6d1c0d8b215c5bd33d3b5fd9d01de50cdbcf27aa9b6d5e6eb61620ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 57.6MB
        • SHA256 d8f4cae81d07454a64822e0ccc2e33fb4bdc7a9245a4a12ce7d62725f92dd098
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 52.1MB
        • SHA256 bd2108c83285071a21470e8bc0e5c9643fed94cf086f6f7bc7cf12a92545f5c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 30.8MB
        • SHA256 75a0d6764ce567b947da94eca20de229cfa79c76ff5935c4fc8e0d1c173b9acc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 63.3MB
        • SHA256 2021bd444b16c9ff0f38923397bff86ffd57f393ac50a6ca27232acb9310bb61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 59.0MB
        • SHA256 5019d2983dfe09ae31d6217b524aeb0d54b20c51b4d6db3c1032267b8b8bdd16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 60.7MB
        • SHA256 9c17a21bdeaa2031af2476ecd02bc5d6b6421c0d8ebc80b74470963a4ae14719
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 59.5MB
        • SHA256 95be5549730fdc17c417e30e5ef96d4bbd0b5523893f6b20da0cce597c61dada
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 58.9MB
        • SHA256 88217cb812b170122267bccb9164244facdfbe7a20ba8057fb3d66609b879ef2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 59.1MB
        • SHA256 b7751724594ca3f9633bae155efa1208886de88420684021afdbe621a6f8ac31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 60.3MB
        • SHA256 728444069d734ee0681200b8a0e4326291d52966543897dc4d4151362bef7dbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 57.3MB
        • SHA256 65f6106a26656eec1dec5d4b96b00dbb97959e735ca2d06aaeda8b06f66569dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 57.3MB
        • SHA256 b2035e03caf16db63c98a0600a94453dc0ff419676f8357bf672fa4d2d0c9d49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 57.3MB
        • SHA256 d355f30746f716533b6ba5bbe83c3e59ed1434b292b3b8c565e26674d595d522
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 57.3MB
        • SHA256 baec67d29159d4cdfcfaa29efecdf4aa52c35f24edea457a48c4b8009a29c318
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 57.3MB
        • SHA256 e380c57698263e814a1c2d31ba2e3d161b192f1253a26184bbd27322da153703
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 57.3MB
        • SHA256 8a6d7f33911749d131d1b6dbcd27ed69f579341b3f53ff70f82e803ef17164ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 57.5MB
        • SHA256 5cea9a67a96cc1807867a1633a22d6d945e2b9741acb529ce1fecc43e6373071
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 57.3MB
        • SHA256 f298b211fdba67abc73bef03d977f7465c43849fc3ed2586eea4d77e7d97a716
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 57.3MB
        • SHA256 72fac4ae938f5ca77db02f955c5a8d6b20225f1cb60f5dc00ca5de646c334aef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 57.4MB
        • SHA256 f52df1782d3ddb710f53bf85a7729108317c8d60af9b000488f50e7fbd0e00c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 57.3MB
        • SHA256 fc42dee343def1bca88119c853daddb3d67cd072e6d42a79ddc5cd72cfde53ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 57.4MB
        • SHA256 064c4137dd69e3bb6f549c60b27ffa3071d4800e8dea0f3f921f299d1632f76c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 57.7MB
        • SHA256 bc2d4e45c0f334d8913d3d11d52514d256d2de215744732cffbfbcf275224415
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 57.3MB
        • SHA256 12891f4984e7075cdd97e0c42795c7bf97e25d2de600bd63910040fe043729e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 57.3MB
        • SHA256 a60b90c5defeaa84dc26722c773319c114cf253d4981308d815bb1b8ec585d67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 57.3MB
        • SHA256 4444076d22f94d630c99e070fa35da288cec87536c38312ed8da46044a3a3028
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 57.3MB
        • SHA256 986c96b45beec00f635d2e29bf51571faf9334148e955bb5c68475896db951c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 57.3MB
        • SHA256 8b27077ba98707c71bceb82c3f1e5d8090bb4c7a5e9d887292d0e7bbec0494c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 57.3MB
        • SHA256 5255af4e645906aab56b4ceac4b76e98927a59b60aa08819f1694c9017a5d0f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 57.3MB
        • SHA256 40b9dd49dc3c8ae90a401bbd017be535c1b2c4f343a54c409fcf8d5ac1c685e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 57.3MB
        • SHA256 e127000b193c0bf3590ecc24618620d2717086462cafedf485d6338bf82bc383
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 57.3MB
        • SHA256 cd24a8da628fc4a0f65fc53cd5011b6674b723a9dbae16dddf617ab03698ba62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 57.3MB
        • SHA256 ee3927b20d6c17317d0785e3c61687d6215f1a388346d4ff109570a4bd684aa3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 57.3MB
        • SHA256 6752687ec9a188065625982d389e42ea67de51f3e50588e326e02541c388287c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 28.7MB
        • SHA256 6810bb080b490146338ee60d8f6b100d647b68ff9fead464403de8534b49b439
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 57.3MB
        • SHA256 9c05843230b6a2a0b87d9dd35308e30a88840ba4cab1ad85c254059946e9bcc4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 57.3MB
        • SHA256 aafbc4ac7894a0524ff024e61ed4c460a335e6a153f126a177e7bb72793b6e02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3688-34-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5840-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5840-21-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download