Overview

overview

7

Static

static

3

2026-07-02...al.exe

windows10-2004-x64

7

2026-07-02...al.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/07/2026, 20:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-02_6b59ba156ae962b05d596bd6d292d4fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
  • Size 39.8MB
  • Sample260702-y8rtzset2v
  • SHA256 87f70b4c2e97d3cf6ea6e6a22d2f610e874e2d4f0fe03d4e41f6c5d372aaa1ea
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-02_6b59ba156ae962b05d596bd6d292d4fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-02_6b59ba156ae962b05d596bd6d292d4fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3860
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2152
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1572
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1568

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 40.7MB
        • SHA256 bc0d1147aaf8b698815c6f01bfe0232eb8f2beabbb4969a2269db04038d62999
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 40.4MB
        • SHA256 b35974191ac6bff03f2be044a46bf8c493f12074dbc18a0cd3c25d942ab4e9b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 39.8MB
        • SHA256 ebec879e31ad8c518cd171828b8d0f40f8d4d87aff50a4160dc3e7342cf3f1d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 45.8MB
        • SHA256 9f7fec214f562dc3d5c3b71a1039f413ec176ab7c1384bfa5260b425587121ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 41.5MB
        • SHA256 1062160b957f60ce252125557151448a0f6e2025d6754dc6fa0489f13a5c156f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 43.2MB
        • SHA256 55e2d840214248f423647725e4e795cf625cf94e19d7db7032e898186c4a8993
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 42.0MB
        • SHA256 25eb6c0f62c80614e5e7caede9dcaaf3ad51dd8c7afcf3f34c7d40ccecb82012
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 41.4MB
        • SHA256 718c5e5610102294dbf406ccbc61984850e0be5d6a84b0f7adaf251c533a2fec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 41.6MB
        • SHA256 db9646cfcaaf489f2b03de37f2add068f5941473ba6ba84f32ee0407881b2496
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 42.8MB
        • SHA256 0900d8098472ab389caf09a104274227eba2c64da0fae3f2ae6db6224c58b2a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 41.2MB
        • SHA256 ea37be5017e062e9bada0a7e44e4a6a045703b08c3466011399b7fc13204afc8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 39.8MB
        • SHA256 07f53698e2ccb2696206dd4cdd2443b1200dc54cb10872d8e5f785be80efe3d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 39.8MB
        • SHA256 5e43577a7b58a35a2267550004ab94c30ddb6beaf3d01c87fa255c2008601923
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 39.8MB
        • SHA256 634d7b690e411910c8d53065e080996e30c0c41d526a5af3d196fceb192c6a7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 39.8MB
        • SHA256 3d9a616bcf298789d69dc015f7975efa0a03b61792e88e6bac1fee13e7ec16e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 39.8MB
        • SHA256 ac8a37aa7eb92ed19ebe4f76bb42f51ce1c4524a443a93196b6d448bf3e900e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 39.8MB
        • SHA256 729ebeab462648b08e4dc41a29b63c545ddd59ca5802b6c91cee5dee69df876a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 39.9MB
        • SHA256 0b313517cc5470808747035c8cc3328fdd60812c770c71d88d6aa30f49d78f2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 39.8MB
        • SHA256 320b68ce632a6b668bc7b59b2e489dfb69ef4ae9051de051f612e70aac3bb044
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 39.8MB
        • SHA256 c128dd92437b730d4b6849b76193e5aba6b96895eb3a5f7dce25c8b646b61cc3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 39.8MB
        • SHA256 5d454551c6bd31cbad1bf84617bb7cb257f87bdfea0e84ed6fceb1225b045df8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 39.8MB
        • SHA256 87f70b4c2e97d3cf6ea6e6a22d2f610e874e2d4f0fe03d4e41f6c5d372aaa1ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 58.2MB
        • SHA256 534a477b7240786ed74f3f8adcdd33ae8285c1746e1a4da04dc550634c393cca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 56.6MB
        • SHA256 ccdb76b7c6c65d810e276532a9b95e20bcfbccdcdb21aa5f7278080ee90437c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 57.1MB
        • SHA256 9a1f31eca417af1604dfef4210130473d68e5dcea967a6362ff1049b2ec57bca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 55.1MB
        • SHA256 9aeee20cdf1a0ba5743bd92b54cfe59a15786b268385e7812c4ce18cdf5aade8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 56.2MB
        • SHA256 65153e4d19163bec0f2874247c80e38aa5c63a32e9a9a295e5ae597a3bc54063
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 57.1MB
        • SHA256 9071648e48061ed3bd77fc8049c24e947b1d6719afede19febc9954e628d8361
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 56.1MB
        • SHA256 5b667c330268b81af098193106ee2a3fd3658906cd16b92053f3c82af57776a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 54.9MB
        • SHA256 89b73792696269e034e1c7015e805ae12b8b66d9f688ef75218404bec09e0136
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 54.3MB
        • SHA256 ec0e3eda88042a1675fa7e9bb4d761d432e4d794adc975df1ca179b6f25c0c84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 55.4MB
        • SHA256 229e8e93e02fa6ea5efd2979a5b179c3be19a6dc7c7ed5ae1b068bb0d775f636
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 51.6MB
        • SHA256 2051899a1440ee5f25ee945430b2bea171e4e066c2877cb8dfa4b118e17561d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 54.1MB
        • SHA256 e08f062ad6a3b04049b080a2ea5d476ddc3dde3f512412966aacb7dd0c2dcad4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 54.4MB
        • SHA256 fd5e8e4dc8fc2ee018d98cc7cb220d1570253697b42d58df9d0a97d47e67f22d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 24.5MB
        • SHA256 0fe8c3c978279407e0d7df0c3cfaf672237d870f0a365b542d64bc007e101530
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 16.8MB
        • SHA256 74133d880ea0156e87a67585255fbc54176bb923fd3819c78ad0ce012d48a452
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 381KB
        • SHA256 0b832610ef5749838abd549bb3433294c8160f01c7abb87415c8a4dc75b46a03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 80.1MB
        • SHA256 10542ce754c73194b3fc084dce7ae5a463240abc41281185306b023117259172
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 77.9MB
        • SHA256 f391d41c6b3deb09de8953156d4f15fbd4ecfaedb0cc90fe72fa5520dbe4f514
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 74.4MB
        • SHA256 1d934112ced1f769381130985a2c68979e8d2e548d6f105e78bd35ed185cf75c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 73.8MB
        • SHA256 b2db3499678b27ff3fac81e3d07018e5da274b41e0bb5b4580926fe114ba3714
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 69.6MB
        • SHA256 19fa737f57bfb0731420bcee37ec110e8f43169e86089d68e18e3ac2b825a6f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 67.7MB
        • SHA256 83d05f89a0d2d78ceae5e427ad4d97de4ef72e3f0ef4841434daf87747b74094
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 68.9MB
        • SHA256 ff56350d6660b2144f5ec90e0587c55ccfb7bd82896898bcdc0970d8b69242d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 67.5MB
        • SHA256 b3d6b1d83e2926742cb579afc37a6d62977c89cec1bf9c86e57f986c5c8dc469
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 66.2MB
        • SHA256 4ad2fa0eef4073bce03cf088147a637a4df6c90cb45991410b1ffd0e787cfdca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 64.0MB
        • SHA256 c5ba6e77b3082861eb3ae5e58330757b917c020be7544d82ee77e1c5cd7bcd72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 62.7MB
        • SHA256 95add77e8fd8a680056c4b66b6fc72736c327e7a8cc4a4680b49684050255ce5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 63.6MB
        • SHA256 b510bb5a6f80b749eebb842c47cf80dc52776313be68d60b5af08aea85b2a2d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 62.9MB
        • SHA256 6cc6b8266c4acbf738cfe2f961ffea5c56e1baf2dd6ab4d0b4649fd54b99dc18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 62.2MB
        • SHA256 366bfb8ee6d1991f221e6da49eea823b8045cdd72d6b355ed96a5c545181e445
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 62.6MB
        • SHA256 ec427b5a4da63aab2a5b69186bc95e1979645761afb2a31bd801212bede16ce8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 61.6MB
        • SHA256 2866642250a5374b3c539a89e44423371ca8e2a738bfd74643f0988495505da6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 61.1MB
        • SHA256 b02940899f7971d9a1b034bdd321c7c12a020e1a97a8f513114d1890e681ffb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 59.1MB
        • SHA256 c2bf7b2dbb16abbc177d30f48064c85f625c82c65ae7bdcb817d11d5ec08ab22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 56.2MB
        • SHA256 2ba711d02bc906b965cef03aa9f29109b5dbdd6de802010be55b0d816e0b38d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 57.9MB
        • SHA256 993365e1d12d083fe1fd25df22cc6f0aec48cb58e94edf0615876950158763b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 57.1MB
        • SHA256 4b0c256c5d58a0e19f8c2a03f658590301a8744cfd3605a6dde0b5c9856aad91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download