Overview

overview

7

Static

static

3

2026-05-27...al.exe

windows10-2004-x64

7

2026-05-27...al.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    143s
  • max time network
    119s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    27/05/2026, 16:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-27_9954d0326c3eb1e5ce33d51e10d7d9c9_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
  • Size 8.5MB
  • Sample260527-tf47dsds7v
  • SHA256 8a32ea34e63d067d3fab47918f8f4ecbc31dd6b3d5416044cbf5c4760c2d63e5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-27_9954d0326c3eb1e5ce33d51e10d7d9c9_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-27_9954d0326c3eb1e5ce33d51e10d7d9c9_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3752
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3184
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5072
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2960

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 9.1MB
        • SHA256 4542b5dcc279a183870ecd6386c7386a061240f05dcdc613400cedf5f6a737e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 9.5MB
        • SHA256 d01296a0223a5a2a1d3d5a2a3bc00cdd055079c3166e75028e92966167cbd777
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 9.2MB
        • SHA256 9567ea718ff9f2e364e3f50b62bfdf627678173f9cb0316e0b56b040adb2bd18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 8.6MB
        • SHA256 cec3a2ac2f78a69a2949c3758882927c24b33a94e5eec02c8c829ffb6dd29642
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 14.6MB
        • SHA256 a3c3abe7afa99547f7f6b372ea00ad74201627e5cac2cbb04e36ed0f83701ac1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 10.3MB
        • SHA256 65e86346037716553ad47292e22b056118f62da3cf9e9ed224b6d4ef7c76e9cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 12.0MB
        • SHA256 5d6e3e35b20b9b8501e3a8c4e880bad1b1f15e25c4347f4b0d1ecc34f86aa1f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 10.8MB
        • SHA256 84cde65d469548f858e80880d12644c016371c8ecbaec21872c3bc21f474a85e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 10.2MB
        • SHA256 eb8532beb6e209803e332cd61c7db8d02c1cbc086a90f7ad58f1642f17336f35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 10.4MB
        • SHA256 b785805dfc83b0b09b20ef6caa1c948d007fbdb7034e4b5f0e089967444514db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 11.6MB
        • SHA256 109a5e644bef6a573255e9bf92121f488a4905e7595bd657e2a6a8eccb8afb65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 10.0MB
        • SHA256 4e670201766af82392ba90b806eebd4813b8471f77a77aba454547f24eb0434a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 8.6MB
        • SHA256 c1903044c0ae9e662e3d32acf03de14a7b9c87914647c201de31b4cf6fab9c66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 8.6MB
        • SHA256 fb9b64eeea87415c61f0c6e15381e9bf4538b5c7c80a1e03b2505d66ee04479e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 8.6MB
        • SHA256 ac6478a685e81e03bbc70189579307eda8bfa58aafeef223fdc024e8792b3c7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 8.6MB
        • SHA256 c4170b183a58af35344be8a6ba94629b15fec01f8d3ca227293c793ebc64f07a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 8.6MB
        • SHA256 af287afe15dd9ba85b2edbc4c167a8bf1c979177b9d55fcdf7796ca15b539f97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 8.6MB
        • SHA256 3555e80883f7d01744355974c8be84ced514052b013109cfef22cecaee97dc6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 8.7MB
        • SHA256 d430dc45fa08212f42925051fa0a88b2b3951d4e19c6c8ede669df9495564ca9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 8.6MB
        • SHA256 0556bd6217c0b75a8f434354ae886f637b9dc8cbc3e4632945361984cc3fb1db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 8.6MB
        • SHA256 2d066331c23ecaf8410dd39b15f256c54c921188e79b1ffba7f753ee5a16ee4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 8.6MB
        • SHA256 db7aaca6d77d52242b52f2bb30c459e6f7830e106525b1e380753b2e1a6e9094
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 8.5MB
        • SHA256 8a32ea34e63d067d3fab47918f8f4ecbc31dd6b3d5416044cbf5c4760c2d63e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 17.6MB
        • SHA256 7e2e1e9354076748c0a1c1f2bba588fbf9cccfebd5950f57806c7818fb602996
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 17.6MB
        • SHA256 e66660ac9d719ba4759c903acdd70e6c664df57980822fcd5413fe1efd7bb03b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 16.6MB
        • SHA256 e3b7d521f6a5eb94ab09799e00c4700badb99df0013f4e9987ef01a136268c5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 16.9MB
        • SHA256 bae71837854dbe6f387f0700cf7d879935b935ebf79824b605ab084c9cb0cae5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 16.4MB
        • SHA256 48ef04065a84ec76fa205cbd4b89a9ac591bb37d1fb2be2091fe0de82177fd3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 15.9MB
        • SHA256 8ce6db2f5e2152d41b2fe128bcdafd0e727131bc90bb467b7968e698600e41cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 15.4MB
        • SHA256 9fe4f9251aea51e129dd0b4c018619a89325a52deaccf6b5e329a19191b8cdf4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 17.4MB
        • SHA256 6705616b7a8741421e2888709e09b4d0d2ee9dfaabb3f7d5a8bb372c6c572675
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 15.9MB
        • SHA256 8cea235a8913b9e0e732c408622cfd1e0ca85f9c506c6263be47abea65fa8f7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 16.4MB
        • SHA256 ddffe53dd4cc55bafda48d8f36dcd130373c49909d59579f4d841d72fba9c62b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 16.1MB
        • SHA256 774649da79717921203646ca8b137d96ead6409f7e44e19a7994ba2300cea432
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 15.9MB
        • SHA256 76b6bf2ceadd30bc845863b9f4ad7729ea312a56d4549ee615e04f839de20318
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 15.9MB
        • SHA256 94ac143a0beb55991e4a4b7d6c9435b4c339f1945b2bda35271dae0a1273fa80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 14.9MB
        • SHA256 e216385bde6bcd772a60a360d8e35c9b9c8cde54d06044ab189e19ef04b6b614
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 15.4MB
        • SHA256 113385411024007e6d05091ea2a8d43ebe6aa3de57f592630bb94bb58e5f58d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.5MB
        • SHA256 68bb068c55f8ce1ed9d2b1f67426edf5738a8b8c462b9efd9afc7982a5a2d4c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.5MB
        • SHA256 931578d04151b7fb63289c22a3b5d51139726dd13f601ac3d4e1db8c781847b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.5MB
        • SHA256 3060e51ef09d77509dea226345b9265899e5afa9e4fed49934cc2617930fd953
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.5MB
        • SHA256 64461dd190f7a1e08fac8ffe8b62e7fef4bf5165f9c4120fabbba915f1759584
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.5MB
        • SHA256 d587caf00cc62b7c35e53fb1f42734851f4230533327d4b67ad612185e5a07fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.5MB
        • SHA256 5d2388a879615dff7c69b3e8d041119037fb8ec3b5f0e5be48c1f49ecab354ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.5MB
        • SHA256 0eafb1219d8d20cc9cf651dab04a45379691da24d6cf11c93067bba4a9b87067
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 8.5MB
        • SHA256 8e9b734a273f2f4e1d3b64602e2f920d87958e9012328041b7e950cf8a5487c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 17.8MB
        • SHA256 bf402b82166af664812c01787c2b695838a57bb9a9b6b86002997d3575d0acb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download