Overview

overview

7

Static

static

3

2026-06-27...st.exe

windows10-2004-x64

7

2026-06-27...st.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260617-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/06/2026, 04:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-27_a7ff52ec28fd758cdd758e2aa5609974_cobalt-strike_coinminer_elex_hijackloader_icedid_luca-st.exe
  • Size 7.7MB
  • Sample260629-esslssd12p
  • SHA256 17a4f0fb768c4ac810e60c00787200259a1cc7da53cba299a6564d5e1a83aa63
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-27_a7ff52ec28fd758cdd758e2aa5609974_cobalt-strike_coinminer_elex_hijackloader_icedid_luca-st.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-27_a7ff52ec28fd758cdd758e2aa5609974_cobalt-strike_coinminer_elex_hijackloader_icedid_luca-st.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5496
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1068
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1372
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2108

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 8.2MB
        • SHA256 ceb2fbafcaacf45a6a56f83998567b8cc8bad9616f8fa520f7e93fc289176d54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 8.6MB
        • SHA256 708ae5b5e88ca9293b92babeea44d8d7ce362254b02e8c6a1bb202df5fc21c43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 8.3MB
        • SHA256 c60ae4d4664415680b9e6bd8566e977b8a88ac1d33b888be48af53f4ff85b3ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 7.7MB
        • SHA256 514247be19cb86ec0b96817e7264a72bb8b534e3ae555f85a4d33c2b0c8a51b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 9.4MB
        • SHA256 9c4a0828356176ed23a57a3570aeb0a0c1f6f5891f72fea72dcbd0b09437e7de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 11.1MB
        • SHA256 3d2ad4077b3643460b48064b18cf72c5b934b7a6ff440c57cc374bf6a182e9a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 9.9MB
        • SHA256 7b22b91c1fdddeaef0ae1d1044941498d4dafbe119d291e412bdf0dabbd3239c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 9.3MB
        • SHA256 9a40e6c26180bd573e318afa8ee3590bf3d8f768a54a287ba35819a379e3f453
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 9.5MB
        • SHA256 a5b036c2cd5af1eab0ee73e749e139441717e240e2405f5f2b98136f6a759858
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 10.7MB
        • SHA256 fb601d353fc1392efc693a64a240f49f1e355d8b353a3702f57793336954bc61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 9.1MB
        • SHA256 6b308b120a0df25ef0d9702877799eefb4c72b4a49bc82316c7c0889ad02806b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 7.7MB
        • SHA256 8236906e3c627eec3f6787274c9c513c32bf1a8bde077a988483d09429c98994
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 7.7MB
        • SHA256 a779393154429118fea89e19b0bf3d989b6757349b77fbb4d73f401a6f78a7fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 7.7MB
        • SHA256 11ddd8b190375377245e4804d24d1ce2c3c2b467200dd0c5eda561a2d1c08864
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 7.7MB
        • SHA256 b25ceca99bdd69ae7dbb6ad8beec62bde1bea3fb1e3a7643b7213da6263d5a9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 7.7MB
        • SHA256 b53fee9a556344be42dc733bea4274e5de7802a61cc1c712454f3be26c97ab88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 7.7MB
        • SHA256 e0e04fb1955521d5b34e59384aa6bf216d16f5dfb26e9ecf928032cb3c71247d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 7.7MB
        • SHA256 a05ddd5ecae767a719bc52daa7afc5408f660f4758a520d2b24527f1ec9e9487
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 7.9MB
        • SHA256 4519e8d09b877628a92243e73892d6ed7347e95c2d439229638eef98d2d42f2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 7.8MB
        • SHA256 0f2f4db804b047779e8652e5ec77551def6e6ae19f02da369afd86209401927c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 7.7MB
        • SHA256 d9ea44c07411fb2be3cb56d24e66d4df464eef31b37dce9f9967092263b2edcb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 7.7MB
        • SHA256 bd320b3cab4ed313a261de355e5c2680b84897c01beb2cbf9dd9d0f91033e084
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 7.7MB
        • SHA256 714eef8d2dd7b8f83242cc31dcb1aa25ab2ab615823198bd846d5a116482d23b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 7.7MB
        • SHA256 17a4f0fb768c4ac810e60c00787200259a1cc7da53cba299a6564d5e1a83aa63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.7MB
        • SHA256 aff8cf2f619e18562d1f18881fb317660feff2357c3a3ada2192cfd6ee8dd70b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.7MB
        • SHA256 047cd606cc4a5a9a349bc3220d77c38b71ce85e5983eaaba61513162406d6035
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.7MB
        • SHA256 b7c15a1abf9de49cd9f501a40817f80598935b3e20dd1ffd483eb15539f60818
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.7MB
        • SHA256 8c9fc19619742d34876aa48b1d9a23d0216a132ef018d299b401a31bce1593cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.7MB
        • SHA256 1975ed063c6418a31704d5af387a153bdc867d69aa0a512160885da61b1d55c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.7MB
        • SHA256 3e8a5ec26f88d301baa6ff2715eef494e77e6fd811b5af28911cdb21d6c18179
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.7MB
        • SHA256 27e0c35f19bda45d179f59de89127047debb3ea528692cf407da018875069785
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.7MB
        • SHA256 0c3cc87c1949f092acb95664adaa585218be937dbcb568e645416b4ab941dae6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 7.7MB
        • SHA256 5795827804466e0bee1aae5fadf1fa06836c5a395f2397a69d863c386be9942a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download