Overview

overview

8

Static

static

3

2026-07-01...al.exe

windows10-2004-x64

8

2026-07-01...al.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    124s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260630-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/07/2026, 13:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-01_37180c745883f6406b5858dcf38696b8_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
  • Size 15.6MB
  • Sample260701-q2rawafw5k
  • SHA256 3be421fe466699a341d9238f5f1c5d0129bb0f947ed1de56f67de8fe6b0d071b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-01_37180c745883f6406b5858dcf38696b8_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-01_37180c745883f6406b5858dcf38696b8_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5728
  • C:\Users\Admin\AppData\Local\Temp\2026-07-01_37180c745883f6406b5858dcf38696b8_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-01_37180c745883f6406b5858dcf38696b8_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:6812

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 16.1MB
        • SHA256 7b6cb5f6bfe01f5e2aa6aafa2254888aa0350b2d2c9248427c7aad8d31961ea8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 32.1MB
        • SHA256 73648d7dffd16ac33caab6cc7e4837098a7e85aa538f8313c4b990e721ca3ff0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 31.8MB
        • SHA256 bb62f7c2d8172918f7a29b79269969644acc6e2b21a6876546a4b1a9730ca816
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 31.2MB
        • SHA256 83170364e1648976710110b806d7901a8bcbae0a09e4bd35dacf51e0cdf2c219
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 15.9MB
        • SHA256 867b2d0d3478f266686f2436eb92032c9a8cc6ab13e8a670bbcc9656998d87d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 15.6MB
        • SHA256 0633bb3ebbfcbb2f49d489baae7dba1d0e210d218bfa7584463621b2d79ade8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 35.3MB
        • SHA256 20f3bddf3e145fba88dd420badd1b37fa3b96600820446bc54fef203a121f0fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 31.5MB
        • SHA256 f21ddfa88001c7d927a74ae6a31da7884122e352245a610d0ccbf5ee75cab587
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 54.6MB
        • SHA256 8d31d71b063a8aeae2d94afeed1dc52c80e29525ad1fac7713b85999d546c633
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 33.3MB
        • SHA256 da79cec512975ff3891146228f1f0d7c6ebf0b2055ddc493c442e6e545a02852
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 31.3MB
        • SHA256 e1720c3217cad54e0483da4f06cd7172136457c462b3ce83cb3a92ed3a296c20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 37.2MB
        • SHA256 d39182f720fbc54bd056ae3a0a25f0ce7b5dfdf76cc43172e9cbdc60c04880ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 32.9MB
        • SHA256 fba92dfd26953c9366a8327600200fcdc5fc8b99df1d87831a3f370a1cc1a5c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 34.6MB
        • SHA256 5df7ea65fec91330ce9c65ba5e909825f217cf168901144e23d3188238b9a893
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 33.4MB
        • SHA256 805ef8bafd78f672bb15df99483bcf1b677ed2f480a4a54541341e20a35f6b4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 32.8MB
        • SHA256 a7eee59f1e5cae800554b6fa7727327accd869a5cc670bfc8d237c2bc20fa869
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 33.0MB
        • SHA256 ddd1634e65339ac35666ce520f6acd5c2c7199a1e669ea14b977dcb1d24511fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 34.2MB
        • SHA256 e26d83dd5c39d56db1a4c39c116a653469dc855e395caad801c5e42c945dfdab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 31.2MB
        • SHA256 10147018e64e8afff0b8f209a2f35f8a91518e0df5dad4dbce422e0da99b5a0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 31.2MB
        • SHA256 cda64ba8aa620553a3da0273a563bd04062743fbc3a07adca8f90aca89a6b0d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 31.2MB
        • SHA256 c73a15bfb6b953e92ca139e18e532ef8d7a9d8d2260e7c623cd7c45c5df67205
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 31.2MB
        • SHA256 38e3a512fb5acd398b397b0e8606a4a0985982ee1f36b830199297b3d340bcdb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 31.2MB
        • SHA256 75ef29d131897ced2fdf77aaa2bb050ad1c7b131836c23a8cee7f8f5a4082470
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 31.4MB
        • SHA256 72f687783e19b894d67e559ab714b57724858950f8aa6e97e73da9da33c6a252
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 31.2MB
        • SHA256 3f319da098849cb6438aeb14f3863718cd63ea77fa9dbbbffda859c20ad06295
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 31.2MB
        • SHA256 78b8162d6b19214c24ac015bbd9cc033f8b8db61832943968b2ed9092400df37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 31.4MB
        • SHA256 bf184d12be10e40bb77ce386c24496d5cab8e051fce17c333a8358f486e5d15e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 31.6MB
        • SHA256 de83173d653b576a9587c68ff6ac3300b94407e6353e241ec23d9ddfb98e0a96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 31.2MB
        • SHA256 987fe6796e0a18747bf8283d8fb0543b4a6933619c27f25940997ae2c6315abe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 31.2MB
        • SHA256 100344e32c29d7c5d886b866c0a9cda361cc47d07d0730b89a15274784fce5b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 31.2MB
        • SHA256 60c6e0f20719667d5771ec8f3713af71630fb5e53b81a374710924696c98202b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 31.2MB
        • SHA256 194934c217605bd9a67325be9d54ea1f519394cd1f043f6759bd6fc212606382
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 31.2MB
        • SHA256 b7c1103fb053540e1202565f86ff414940891570a8bf1c5ff7aba768ca533333
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 31.2MB
        • SHA256 6a09055c9f8d9870d6cce24cc8dfa1502d1d70f636dc63be24f43c054bc66bdf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 31.2MB
        • SHA256 b9a1eb591c133a1b18655a3e4a93a95177e62c4a3d1ec8f7f2796a5a5c94299f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 31.2MB
        • SHA256 aaf90f2136baf70fef2d57dc79c4cdd83a870720fbba0c474f2eec8605d29e0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 31.2MB
        • SHA256 22318892dc059f6f920d28f082d0b2bcdcca621760a392b41f0309343c616678
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 31.2MB
        • SHA256 272025c5c8dc2d813a830bde37999085e62d211d786ecaac710c9ac6cd4bf25c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 31.2MB
        • SHA256 8a396272fec270f2b98fb3ec404375d74845ce8fffcc00f1dea557c53be5144b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 31.2MB
        • SHA256 7cd417604db3b08ee9880866cf56d2850269d7bfeca01f825df036fbc7fb5245
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 31.2MB
        • SHA256 5356e6f82d9fec11e9491d134d5c8081ddebb98bfaa2bd7c2bad89223e813419
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 31.2MB
        • SHA256 1699a385939ac25231842e8c2ca318c200884935e4541fd99ea8c7fd57d76160
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 31.2MB
        • SHA256 3db61eba105629a06da0e69a7387abb0f7fbcb3115ffd551e6374654f6d82657
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 31.2MB
        • SHA256 a26e8b9e0cf0ea2dedd0877a2507ed2ccd7a0eee61c1ad3ca6291b5fc5130329
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 31.2MB
        • SHA256 88d3c9379a3296fda1e197bf01c65cda1417e1759021c7735ea26a9e4543fe09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 31.2MB
        • SHA256 975e55d3bb720dcaa0ddda1708e5867de57d396cb73a6ab6e18fb23e1bd165d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 31.2MB
        • SHA256 040fd2346869622836e9993013c01993aaead33ce53b8c4f6cf0bb2cf5c8569d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 31.2MB
        • SHA256 88bbd7b1916116d3b55a6f39907dbafef8fc7e77c24bc28abe26d52139d6eafc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 31.3MB
        • SHA256 b09908809d15394fe375a664bf84f99774b6db8fea278a41eb13ea6c1a9fc81f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 31.2MB
        • SHA256 2967dbb6fa17c5ab0b40a64008420150acd082bb727d20c8a0e6d2271e104fe7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 31.2MB
        • SHA256 da3b2bd2ab4ee356e417659f470bc05483598a72183f346622884b8b2cf60725
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 31.2MB
        • SHA256 96fbcccffdcdcdf6313ebdb503aade6557c3ac5f4fa904c44b16ed1c26191c2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download