Overview

overview

10

Static

static

10

2026-07-05...al.exe

windows10-2004-x64

9

2026-07-05...al.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    125s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/07/2026, 16:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-05_96c865ee14778011079fbcb47edc60af_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
  • Size 10.2MB
  • Sample260705-tgadeadw6x
  • SHA256 9a2bb6e34e0014fcdcae03e834dce98e1e3a3530d1c8b596e1517b0fe3bd21ba
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecution

Malware Config

Signatures

  • Detects executables containing URLs to raw contents of a Github gist 31 IoCs
  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen 31 IoCs
  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Executes dropped EXE 4 IoCs
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in System32 directory 8 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-05_96c865ee14778011079fbcb47edc60af_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-05_96c865ee14778011079fbcb47edc60af_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe"
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4776
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:6100
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5864
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5460
    • C:\Users\Admin\AppData\Local\Temp\2026-07-05_96c865ee14778011079fbcb47edc60af_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal~4.exe
      2026-07-05_96c865ee14778011079fbcb47edc60af_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal~4.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5116
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4792
      • C:\Windows\SysWOW64\UpdatAuto.exe
        C:\Windows\system32\UpdatAuto.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4184
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5380
      • C:\Users\Admin\AppData\Local\Temp\2026-07-05_96c865ee14778011079fbcb47edc60af_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal~4~4.exe
        2026-07-05_96c865ee14778011079fbcb47edc60af_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal~4~4.exe
        3⤵
        • Executes dropped EXE
        PID:4516
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net stop sharedaccess
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2408
        • C:\Windows\SysWOW64\net.exe
          net stop sharedaccess
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5040
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop sharedaccess
            5⤵
            • System Location Discovery: System Language Discovery
            PID:5652
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net stop wuauserv
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:932
        • C:\Windows\SysWOW64\net.exe
          net stop wuauserv
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2264
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop wuauserv
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2388
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net stop wscsvc
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:552
        • C:\Windows\SysWOW64\net.exe
          net stop wscsvc
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3860
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop wscsvc
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2664
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net stop srservice
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5036
        • C:\Windows\SysWOW64\net.exe
          net stop srservice
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1960
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop srservice
            5⤵
            • System Location Discovery: System Language Discovery
            PID:3292
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net start TlntSvr
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2116
        • C:\Windows\SysWOW64\net.exe
          net start TlntSvr
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4324
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 start TlntSvr
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2432
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net user helpassistant 123456
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3496
        • C:\Windows\SysWOW64\net.exe
          net user helpassistant 123456
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2580
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 user helpassistant 123456
            5⤵
            • System Location Discovery: System Language Discovery
            PID:3572
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net localgroup administrators helpassistant /add
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5980
        • C:\Windows\SysWOW64\net.exe
          net localgroup administrators helpassistant /add
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5576
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 localgroup administrators helpassistant /add
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2208
      • C:\Windows\SysWOW64\sc.exe
        sc config srservice start= disabled
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:5292
      • C:\Windows\SysWOW64\sc.exe
        sc config SharedAccess start= disabled
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:3152
      • C:\Windows\SysWOW64\sc.exe
        sc config wuauserv start= disabled
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:2232
      • C:\Windows\SysWOW64\sc.exe
        sc config wscsvc start= disabled
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:6104
      • C:\Windows\SysWOW64\sc.exe
        sc config srservice start= disabled
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:2072

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 5.6MB
        • SHA256 9b5ce03956b32cb8e50cb6e66b2420102d62c064dc3f0ce3ed73524b3ffc64bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 10.7MB
        • SHA256 64228117bf12149cb2283efa1e78aa018200694df751d4551d101b2dec2ed1d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 6.0MB
        • SHA256 2bc6e3aec654a4aed9cf4ab52a7f78e27db18c2b0647e88e0bd8c45392fb803c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 11.1MB
        • SHA256 5ca1af154eb5b98d65f4abeed946d5a92b0dc329d8b1f85f19e88f1fae271d78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 5.7MB
        • SHA256 c8c220d45bf50dfd189ee86e18a7ff83c02f1be69ba5249890c36913249331ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 10.8MB
        • SHA256 163a9180b11abce42762321c955d90afc6274060a76dcb39812ea0483a2e06d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 5.1MB
        • SHA256 467915b19a4d4d380289b6d19b40c3f1a3b97f17f000e0b1e9002c6b0fce7057
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 10.1MB
        • SHA256 1fb22de574829573eedaec3a589c179ced03310690623179ee0e5c888a610523
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 6.8MB
        • SHA256 e9d1cdcc8ee99c479a2a1b593393b8b567700d4628798bb9495fac60ed64f2a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 8.1MB
        • SHA256 f1d4ce2b6039f8398d8039784d9197a622a179e6bf393ac677faa193d3eba0bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 13.2MB
        • SHA256 4e4b2248e42783ecf63f5e02e1d16cd4761a47993ece6c3f7a0624eb798f2d93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 6.5MB
        • SHA256 92c391c2637021362c6448d40013b3c29bae1d6a7638121113ac89e4cd7b5fbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 11.5MB
        • SHA256 63df5af75782539a0392e893bc86af2cf2317aee98cb7c83fb8bb608382bfec5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 5.2MB
        • SHA256 76e39e86ffa0e795bd6b3fa80edc0aa9f7b6d65e90fa21d6deb0818d2c5e60e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 10.3MB
        • SHA256 bbcf7a0f0952ffaa0e9bccd75d08f98c7dddbb8ad58e45cb2f1a182f3b1dd70d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 5.1MB
        • SHA256 1849acea13160ebc2420f0d93350876c8dce93fb6ac0fb6bcc9fb823e50e86f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 10.2MB
        • SHA256 7b2950b0af9e0dfcc826335bc0c232d86082ae99a9dabd38faea30a64a70c14a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 5.1MB
        • SHA256 d14c0101280a3f8112fb5dd926d27e86e0a5685a76afbd06ac0c703e0534dd04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 10.2MB
        • SHA256 901b24a0441827d8095413d502035e6e5d63acab8471fec23106aed66adf3e8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 5.1MB
        • SHA256 fd33388b1b1c1b24c010cb1f2d7ee475ff8056fc1795e676104a297fb8c6f214
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 10.2MB
        • SHA256 d54abd401fb79756f10784c3ef32cd2fad9f507c7dd0c17b4be5979adb81d6c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-07-05_96c865ee14778011079fbcb47edc60af_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal~4.exe
        • Path C:\Users\Admin\AppData\Local\Temp\2026-07-05_96c865ee14778011079fbcb47edc60af_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal~4.exe
        • Size 5.1MB
        • SHA256 b210eedc5a06ad9798ff25e015757e5f1263fa852fa97d92ab5d53a48365d38f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-07-05_96c865ee14778011079fbcb47edc60af_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal~4~4.exe
        • Path C:\Users\Admin\AppData\Local\Temp\2026-07-05_96c865ee14778011079fbcb47edc60af_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal~4~4.exe
        • Size 48KB
        • SHA256 2ab4701bfd8747046a2df3faa0764e62663c9b6acb64ce5550000fd4ba5525e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 5.1MB
        • SHA256 9c1ff7ef78baa778ad36ef436646b23dadb7ac9a2e824f151281da3d9eefb87d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.1MB
        • SHA256 d05a1791f694397106e90a2bd31aa0e6f91b6c403e74a7247402b692974c73cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.1MB
        • SHA256 8d84cc5dc1413792bbea02addf1ac5756e3d38d34f2b479f0aaa8e63765824fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.1MB
        • SHA256 9c9cfb2081d797132b7fdaf808dacc1f98a4baaa4b07bd195d7c6db991601313
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.1MB
        • SHA256 060e51876f0e33de5a0d6812980b2799c3684950aa34f7ee1e61d44ca0d2c4a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.1MB
        • SHA256 47a06a866108018fdde7ca9e7dfa25f77bd8f1f1738151de3957fb93f088496c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.1MB
        • SHA256 efbc5b49c3980908030c1c34a3e39343e05c8ce5995ea4c3267b6ad55624d581
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.1MB
        • SHA256 537f8aaac3ff3cd699e97ed690a33f9fc9b411601bb6469ddf4070384d46ae05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.1MB
        • SHA256 6f3076cf4a2a475fa1f439e136fca20f3b7f112a701fd0197e239e1a2373a594
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download