Overview

overview

8

Static

static

3

2026-08-27...uc.exe

windows10-2004-x64

8

2026-08-27...uc.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    145s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/08/2026, 04:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-27_de4eea3f4b549473a4235be7957c4e2f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
  • Size 17.6MB
  • Sample260828-e2e23asycv
  • SHA256 ab1fb51d64ad5fddef58afa0dc497134121575661481a3ae549121e6c6045c16
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-27_de4eea3f4b549473a4235be7957c4e2f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-27_de4eea3f4b549473a4235be7957c4e2f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4116
  • C:\Users\Admin\AppData\Local\Temp\2026-08-27_de4eea3f4b549473a4235be7957c4e2f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-27_de4eea3f4b549473a4235be7957c4e2f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4916

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 17.6MB
        • SHA256 ab1fb51d64ad5fddef58afa0dc497134121575661481a3ae549121e6c6045c16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 17.6MB
        • SHA256 8d47532c31a0e6faaedeac41c6824a7407e27dd8ab62806b0711926e6f132ace
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 39.3MB
        • SHA256 a0262813705fb0a9383c0d6609e65307ed38b050f3e238e8b18de08600b2f7cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 35.5MB
        • SHA256 b5ecbcd49de4ba66531df15695c05083ff44a6cebce8e87fe7cf891c984d19d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 41.1MB
        • SHA256 f8dcc15c5cba3952680b9b13bd40117462abf4191b171a37b1e8f19c54dafaf1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 19.7MB
        • SHA256 425f1c6ead6a86d13c3dc6d46e389d803216b3dc1d5c39cda98de7be05dd65d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 41.2MB
        • SHA256 65355aa3cec7432590c1bdd74298db776f6cccb650299780381f0cda07ea49a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 36.9MB
        • SHA256 e044504f7a3d4a94e01668907f2c57509799f2ec32a2259cb148ba2f534a7bd3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 38.6MB
        • SHA256 65710b8a396db871dbe1389b6d89227d2e2977a158766159f9f020e43bb11a48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 37.4MB
        • SHA256 1c50ceffd3827d30d298b9d13fdd31180203d8740817b3cfbfb9a7354ae472f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 15.4MB
        • SHA256 e3832c093d83486fd4e9386dc67c8e9f98021ea3848ade786d423102d086039c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 37.0MB
        • SHA256 fac928c14d0f5c97da973075666e7a035ffaad2f6edcb298fcb2792390bd7860
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 38.3MB
        • SHA256 45d0564d968f90f941d3757ed8ccb6940b0782172a3dbd24c7f55e82cdfc32b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 36.6MB
        • SHA256 6fa33bb4eb0aa13d5aa404dd75e45f41746484bd699337e5d77b40e31eba16f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 35.2MB
        • SHA256 4917e526eee41ebd34c0b70ac9fc8fae633959fb765e60f3fe65b7ccd5513c53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 35.2MB
        • SHA256 511184d8431e301220b7f6cbb4803f3872d8a099e47f831f3cb95eb08fb7b637
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 35.2MB
        • SHA256 2f420113f7518447e0683c736ec9a54f0057acb311a9371b54f68a3fe270cd6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 35.2MB
        • SHA256 53a32d30297f6e75d57b22c57df4f8de9a1289c89a94831e08a3ecb6737fa2ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 35.2MB
        • SHA256 93ac52c8db1e7f15da62c2fc9c1f432179bb06ac98bb429217130e7a88e2e4d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 35.2MB
        • SHA256 0347ceeebbc904bce4d269707ca180a0bcb1bf6798b487fcd3e173fa64b99958
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 35.2MB
        • SHA256 e2ae5a52a1d36df90619287dac0694b330d12ab7623589ccf03dc29b4a3dc844
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 35.5MB
        • SHA256 581a3f2e65a4a1586e6a8109b02a8ca743d2c68e68ae855731b4a1ba66cea7c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 35.2MB
        • SHA256 4198b5f7c46b740e088fbe0b936169d9f778ebf89f5ac989a922d3a70fb8571a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 35.2MB
        • SHA256 2b92ee12f2b2f42473becbeb92861427f57d779cacb48280006fdc125faf0d93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 35.3MB
        • SHA256 4ba8e5361ee43f02f5dfbd50f04805ab04b29b7424b1ebdd2fe20fe775f84a24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 35.2MB
        • SHA256 598c4c363351e2ea13bad6d4d4ce4abc1e6a65200bb387f6ad5f7f37cd216c52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 35.2MB
        • SHA256 cb7b4a2f2611a2bc774af2cf84904cd01855b0403866af00c50c08b5f86ff59a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 35.5MB
        • SHA256 f3f3c356fa2e168f435802f439c84a27c8364ad0a6b0781f1a69f353da547b32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 35.6MB
        • SHA256 820ea14d959ecec788a32baca52e8bb0f26326015079afe9f9df09630fff82dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 35.2MB
        • SHA256 05834f31ba4a379b9cb61a1cdbc724705297e95b46f4876c2607b93cd9846da3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 35.2MB
        • SHA256 c758ad8647c6deea037c7ae60bfdc43bb9e437ef29611830d5d6853010a05a4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 35.2MB
        • SHA256 f0588fc51ef6594358087d90c7141cd4f0dc9e373f3694297c08b6135d54edc3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 35.2MB
        • SHA256 31005362a78dadfa72322bd0d175c48500dd7afd262f089284fb9da9826cc15b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 35.2MB
        • SHA256 9f0f0504e05bece0d68caca1098fd43870a9099f7f08572f710a086d4e36059f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 35.2MB
        • SHA256 f2c0c7135589297912ebb8725cf11863b355b4dc45f7e4dd61a65200b4d6b3e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 35.2MB
        • SHA256 ddeae13eabf074164118f4d4f541e94fc53819514985dcc924f8fa563f8b713e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 35.2MB
        • SHA256 5009da81834b55d8f99c809232fe44d1ab362bc8c0e8eb750184fef1be1ebde7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 35.2MB
        • SHA256 5fe597aa9940a23f6adf0a2132935659175384ed534b9115f007ef25b2f51fe2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 35.2MB
        • SHA256 432ad76d146d00a61193f8460e93b5959886eac2cca1178c6d9fda8f2c1759e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 35.2MB
        • SHA256 9f8257b8296c9c8cc705e4bedb0e996d0a7994d3954d8bcfed699e31fedec69d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 35.2MB
        • SHA256 b311b80d54f032a676a1ae8060a5394e9ba390441a0135195e847da8772f7173
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 35.2MB
        • SHA256 37b53bf5e0bbe541f587748d53f19f525ca7f5e4b33f5021fa87b67b4b488224
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 35.2MB
        • SHA256 81d6bec906b7eaa8c71a350d59790dde0d50cfe403bfde8a5d7272df973bde6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 35.2MB
        • SHA256 24e8468f3ea9d4d78732aefc84884dc15a50495ed315ccb401cafa10c832c909
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 35.2MB
        • SHA256 b7027f746f4d721c186b20554093647ab1e7d032f1c33c069434fa7b93389d20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 35.2MB
        • SHA256 226922c21250d154af5a0263920945e3a57f6d3f95f2272c61dc999e57f23563
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 17.6MB
        • SHA256 76371675fb9c17e1e7eeafcbfe795c28ce5d44752dd5444b2dfe6a67bc94b35a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 35.2MB
        • SHA256 619bc14ab5cefe97377233db0af5a912e6a189d261cebb8e7719c9be3c000d0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 35.2MB
        • SHA256 be1f301d66dc13ca20496ab5f01063e95f00d465d01f9f3d2659a72816760ed0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 35.2MB
        • SHA256 9204174fe7986d89faf6b1ad0e59763db02dee7accf92daf584f90bb6539f263
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 35.2MB
        • SHA256 74d94e2a60240c1189bbd92abc62975e33bdf6fdc5ffa8600c4e8de02889fff5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 17.6MB
        • SHA256 560af0cec6cf90a755c96e75e7d45e4e999f03de91983312fe513a5d2d4528e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 35.0MB
        • SHA256 d020eb9e505df430d0ae2720e1d97637a83f63313123bce77b99322e7f1f9e6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 35.2MB
        • SHA256 2ae5b1c5ba1ce8550414293469c3fed3a2dd3cdb8d74a36c2e4248ebf7f66a17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 34.9MB
        • SHA256 c0028e8c9f7c0eadc767a0c6a57206eb205a175e86a58b50d525b1c71df735fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 31.6MB
        • SHA256 8099cc1a6fdd116f81ef14aa4142a1bf553c23a3845aa5dffc54be404a8474dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 30.6MB
        • SHA256 6265abdf905e91a435ab879ff620dfadacc5090c5ea67d24267434d78a0f139f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 32.8MB
        • SHA256 02d9b29cd4d6d911d85d6edc2db9208b8b90dd244f948f7573b5854f191bd5b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 35.3MB
        • SHA256 3af54c10b5c88d53aa6a902195fd1caf509f1e89b197f33bb150c5a721b417bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 35.2MB
        • SHA256 3787657f9a6776a95fb3ff7f6ea188e1317de94567624880d29f74be26774d0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 35.2MB
        • SHA256 9b553476c4dddebb5c212126007a6c837a90d879d764b1fc10b1547bf5163272
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 35.2MB
        • SHA256 9178651e76bbce88999f7e3a2e605db229434816ddfc12594299ea3b6c84173c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download