Overview

overview

8

Static

static

3

2026-08-27...uc.exe

windows10-2004-x64

8

2026-08-27...uc.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    28/08/2026, 04:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-27_de4eea3f4b549473a4235be7957c4e2f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
  • Size 17.6MB
  • Sample260828-e2e23asycv
  • SHA256 ab1fb51d64ad5fddef58afa0dc497134121575661481a3ae549121e6c6045c16
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-27_de4eea3f4b549473a4235be7957c4e2f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-27_de4eea3f4b549473a4235be7957c4e2f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:832
  • C:\Users\Admin\AppData\Local\Temp\2026-08-27_de4eea3f4b549473a4235be7957c4e2f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-27_de4eea3f4b549473a4235be7957c4e2f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4228

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 36.1MB
        • SHA256 19279dba793ae88af5cc3b43b803235f3e5a04a80c9e96c2a72e5d2f7b2ce64f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 35.9MB
        • SHA256 98fac1e3521aaba3c9cd9e6380f11b291fa9e57ae983803c74ce3475e63ccb15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 18.3MB
        • SHA256 3a364ab49be603c2d486b9aaaf8d61c4355563142a9fc38e5513b2eb6040e52a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 35.2MB
        • SHA256 bc003f88580631bfd701af4a3c4c0b450eb9225cacc4aa9a7dc22b613a97ca9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 35.5MB
        • SHA256 3459fe09a49cd9493c700170c18cc950bee1027c5d87625a6045ad5aff164fb8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 35.2MB
        • SHA256 b6bb3a18c839c84d2c6340348e36748e3e573bf9feebbf3d613078f9fdcbc808
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 21.7MB
        • SHA256 47129b4ffc17da44799176b9f5be1fa08a826f214b3ead01e479195e14812c47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 35.5MB
        • SHA256 b5ecbcd49de4ba66531df15695c05083ff44a6cebce8e87fe7cf891c984d19d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 58.7MB
        • SHA256 cbc273a0311502dade127c1cc2cfa2ca102625db9e92b4b45fddba402c634a10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 19.7MB
        • SHA256 425f1c6ead6a86d13c3dc6d46e389d803216b3dc1d5c39cda98de7be05dd65d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 35.3MB
        • SHA256 09bf917256ac4f213b8d965469ec662177036bcb5da34fb04a67fcffc3ade6dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 41.2MB
        • SHA256 65355aa3cec7432590c1bdd74298db776f6cccb650299780381f0cda07ea49a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 36.9MB
        • SHA256 e044504f7a3d4a94e01668907f2c57509799f2ec32a2259cb148ba2f534a7bd3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 38.6MB
        • SHA256 65710b8a396db871dbe1389b6d89227d2e2977a158766159f9f020e43bb11a48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 37.4MB
        • SHA256 1c50ceffd3827d30d298b9d13fdd31180203d8740817b3cfbfb9a7354ae472f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 36.8MB
        • SHA256 a27ac19eeb4b57c096c42bb7b993b670b6287bd87d1ef0aecca45321eebd5ff1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 19.4MB
        • SHA256 2c28d22cb3758d53350f0397f0655664b3a9072c13bf9c2ec97fbd714d53f009
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 38.3MB
        • SHA256 45d0564d968f90f941d3757ed8ccb6940b0782172a3dbd24c7f55e82cdfc32b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 36.6MB
        • SHA256 6fa33bb4eb0aa13d5aa404dd75e45f41746484bd699337e5d77b40e31eba16f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 35.2MB
        • SHA256 4917e526eee41ebd34c0b70ac9fc8fae633959fb765e60f3fe65b7ccd5513c53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 35.2MB
        • SHA256 511184d8431e301220b7f6cbb4803f3872d8a099e47f831f3cb95eb08fb7b637
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 35.2MB
        • SHA256 2f420113f7518447e0683c736ec9a54f0057acb311a9371b54f68a3fe270cd6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 35.2MB
        • SHA256 93ac52c8db1e7f15da62c2fc9c1f432179bb06ac98bb429217130e7a88e2e4d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 35.2MB
        • SHA256 0347ceeebbc904bce4d269707ca180a0bcb1bf6798b487fcd3e173fa64b99958
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 35.2MB
        • SHA256 4198b5f7c46b740e088fbe0b936169d9f778ebf89f5ac989a922d3a70fb8571a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 35.2MB
        • SHA256 2b92ee12f2b2f42473becbeb92861427f57d779cacb48280006fdc125faf0d93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 35.3MB
        • SHA256 4ba8e5361ee43f02f5dfbd50f04805ab04b29b7424b1ebdd2fe20fe775f84a24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 35.2MB
        • SHA256 598c4c363351e2ea13bad6d4d4ce4abc1e6a65200bb387f6ad5f7f37cd216c52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 35.2MB
        • SHA256 cb7b4a2f2611a2bc774af2cf84904cd01855b0403866af00c50c08b5f86ff59a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 35.3MB
        • SHA256 826f0d7c56366dc68cf333f58ec508e90af3bc9ce0e6656aaa50f00f1b68ba70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 35.5MB
        • SHA256 f3f3c356fa2e168f435802f439c84a27c8364ad0a6b0781f1a69f353da547b32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 35.6MB
        • SHA256 820ea14d959ecec788a32baca52e8bb0f26326015079afe9f9df09630fff82dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 35.2MB
        • SHA256 05834f31ba4a379b9cb61a1cdbc724705297e95b46f4876c2607b93cd9846da3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 35.2MB
        • SHA256 c758ad8647c6deea037c7ae60bfdc43bb9e437ef29611830d5d6853010a05a4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 35.2MB
        • SHA256 f0588fc51ef6594358087d90c7141cd4f0dc9e373f3694297c08b6135d54edc3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 35.2MB
        • SHA256 31005362a78dadfa72322bd0d175c48500dd7afd262f089284fb9da9826cc15b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 35.2MB
        • SHA256 9f0f0504e05bece0d68caca1098fd43870a9099f7f08572f710a086d4e36059f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 35.2MB
        • SHA256 f2c0c7135589297912ebb8725cf11863b355b4dc45f7e4dd61a65200b4d6b3e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 35.2MB
        • SHA256 ddeae13eabf074164118f4d4f541e94fc53819514985dcc924f8fa563f8b713e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 35.2MB
        • SHA256 5009da81834b55d8f99c809232fe44d1ab362bc8c0e8eb750184fef1be1ebde7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 35.2MB
        • SHA256 5fe597aa9940a23f6adf0a2132935659175384ed534b9115f007ef25b2f51fe2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 35.2MB
        • SHA256 432ad76d146d00a61193f8460e93b5959886eac2cca1178c6d9fda8f2c1759e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 35.2MB
        • SHA256 b311b80d54f032a676a1ae8060a5394e9ba390441a0135195e847da8772f7173
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 35.2MB
        • SHA256 37b53bf5e0bbe541f587748d53f19f525ca7f5e4b33f5021fa87b67b4b488224
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 35.2MB
        • SHA256 81d6bec906b7eaa8c71a350d59790dde0d50cfe403bfde8a5d7272df973bde6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 35.2MB
        • SHA256 24e8468f3ea9d4d78732aefc84884dc15a50495ed315ccb401cafa10c832c909
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 35.2MB
        • SHA256 b7027f746f4d721c186b20554093647ab1e7d032f1c33c069434fa7b93389d20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 35.2MB
        • SHA256 226922c21250d154af5a0263920945e3a57f6d3f95f2272c61dc999e57f23563
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 35.2MB
        • SHA256 f0f263f3f67076459d8bbd1896c4b771ae339b46c08dd850780cc16edf3e459f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 35.2MB
        • SHA256 619bc14ab5cefe97377233db0af5a912e6a189d261cebb8e7719c9be3c000d0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 35.2MB
        • SHA256 be1f301d66dc13ca20496ab5f01063e95f00d465d01f9f3d2659a72816760ed0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 35.2MB
        • SHA256 9204174fe7986d89faf6b1ad0e59763db02dee7accf92daf584f90bb6539f263
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 35.2MB
        • SHA256 74d94e2a60240c1189bbd92abc62975e33bdf6fdc5ffa8600c4e8de02889fff5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 35.2MB
        • SHA256 895857e707e7dc16ad96949fcf8258f0a34ccae1fc0379fc26e70d5a62fa5080
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 35.3MB
        • SHA256 3af54c10b5c88d53aa6a902195fd1caf509f1e89b197f33bb150c5a721b417bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 35.2MB
        • SHA256 3787657f9a6776a95fb3ff7f6ea188e1317de94567624880d29f74be26774d0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 35.2MB
        • SHA256 9b553476c4dddebb5c212126007a6c837a90d879d764b1fc10b1547bf5163272
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 35.2MB
        • SHA256 9178651e76bbce88999f7e3a2e605db229434816ddfc12594299ea3b6c84173c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 17.6MB
        • SHA256 ab1fb51d64ad5fddef58afa0dc497134121575661481a3ae549121e6c6045c16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download