Overview

overview

7

Static

static

3

2026-07-02...al.exe

windows10-2004-x64

7

2026-07-02...al.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/07/2026, 20:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-02_6b59ba156ae962b05d596bd6d292d4fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
  • Size 39.8MB
  • Sample260702-y8rtzset2v
  • SHA256 87f70b4c2e97d3cf6ea6e6a22d2f610e874e2d4f0fe03d4e41f6c5d372aaa1ea
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 60 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-02_6b59ba156ae962b05d596bd6d292d4fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-02_6b59ba156ae962b05d596bd6d292d4fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:6056
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2376
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2840
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3628

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 40.7MB
        • SHA256 bc0d1147aaf8b698815c6f01bfe0232eb8f2beabbb4969a2269db04038d62999
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 40.4MB
        • SHA256 b24238fa94e8e308f310bd4ad33fb540ae037dceb0cf1280c02facff9f17a886
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 39.8MB
        • SHA256 ebec879e31ad8c518cd171828b8d0f40f8d4d87aff50a4160dc3e7342cf3f1d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 41.5MB
        • SHA256 1062160b957f60ce252125557151448a0f6e2025d6754dc6fa0489f13a5c156f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 43.2MB
        • SHA256 55e2d840214248f423647725e4e795cf625cf94e19d7db7032e898186c4a8993
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 42.0MB
        • SHA256 25eb6c0f62c80614e5e7caede9dcaaf3ad51dd8c7afcf3f34c7d40ccecb82012
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 41.4MB
        • SHA256 718c5e5610102294dbf406ccbc61984850e0be5d6a84b0f7adaf251c533a2fec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 41.6MB
        • SHA256 db9646cfcaaf489f2b03de37f2add068f5941473ba6ba84f32ee0407881b2496
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 42.8MB
        • SHA256 0900d8098472ab389caf09a104274227eba2c64da0fae3f2ae6db6224c58b2a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 41.2MB
        • SHA256 ea37be5017e062e9bada0a7e44e4a6a045703b08c3466011399b7fc13204afc8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 39.8MB
        • SHA256 07f53698e2ccb2696206dd4cdd2443b1200dc54cb10872d8e5f785be80efe3d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 39.8MB
        • SHA256 5e43577a7b58a35a2267550004ab94c30ddb6beaf3d01c87fa255c2008601923
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 39.8MB
        • SHA256 634d7b690e411910c8d53065e080996e30c0c41d526a5af3d196fceb192c6a7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 39.8MB
        • SHA256 920ccaa26ed2ea4d4bf144cbdea11d493da60db3bdcf9cb6e5c657c3faf553ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 39.8MB
        • SHA256 ac8a37aa7eb92ed19ebe4f76bb42f51ce1c4524a443a93196b6d448bf3e900e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 39.8MB
        • SHA256 729ebeab462648b08e4dc41a29b63c545ddd59ca5802b6c91cee5dee69df876a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 39.8MB
        • SHA256 4ce0654f013888bcf9a95bd83403b13edc52c904725d605bc45dccdf144b17e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 40.0MB
        • SHA256 197af760627f4872b444297f42408e4b47ff237e161a1f42eb3a225565129a9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 39.9MB
        • SHA256 0b313517cc5470808747035c8cc3328fdd60812c770c71d88d6aa30f49d78f2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 39.8MB
        • SHA256 320b68ce632a6b668bc7b59b2e489dfb69ef4ae9051de051f612e70aac3bb044
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 39.8MB
        • SHA256 c128dd92437b730d4b6849b76193e5aba6b96895eb3a5f7dce25c8b646b61cc3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 39.8MB
        • SHA256 5d454551c6bd31cbad1bf84617bb7cb257f87bdfea0e84ed6fceb1225b045df8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 39.8MB
        • SHA256 87f70b4c2e97d3cf6ea6e6a22d2f610e874e2d4f0fe03d4e41f6c5d372aaa1ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 39.8MB
        • SHA256 6e8ffbdd0a76cedc993534cd4ae547ab35d02c389a1433d93a6ce21561aa14cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 39.8MB
        • SHA256 c6436f7f4fbba5237bf803ab08533b6318495b23e0c497f433dcdfb4924d14b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 39.8MB
        • SHA256 a945c07cdf23bb5d06a3faa5b26b5500b05202959f5c2219f853e86d7386c801
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 39.8MB
        • SHA256 ec78404aff150eb84d31731833889140993d4e09feeeac707caead2bfe8707c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 39.8MB
        • SHA256 a0d8331137d477e91825673193a88ef8a189bd2f9df14d610d19f02abbdb99b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 39.8MB
        • SHA256 05747e36d02e8b477a4c33b38c8cb8f5b0ff21c219ff0ad195c9cef2f702a46c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download