Overview

overview

8

Static

static

3

2026-07-07...al.exe

windows10-2004-x64

8

2026-07-07...al.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    10s
  • max time network
    144s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/07/2026, 22:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-07_ee3e0d3cb925602e3f53573ff4dc6fda_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
  • Size 19.8MB
  • Sample260707-2cl6eae18t
  • SHA256 b658b13eab80f256f1f6bfacf2850adb5bd474f3a8738688c453df1a453f08f9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-07_ee3e0d3cb925602e3f53573ff4dc6fda_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-07_ee3e0d3cb925602e3f53573ff4dc6fda_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5560
  • C:\Users\Admin\AppData\Local\Temp\2026-07-07_ee3e0d3cb925602e3f53573ff4dc6fda_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-07_ee3e0d3cb925602e3f53573ff4dc6fda_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3512

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 20.9MB
        • SHA256 f500766b18c3ed920feae7ea5652b78ef7c504a916a3f464458e1da7735a874c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 20.8MB
        • SHA256 0b91d1270b7daafbfa0fa94045d41148ec9f98266afe3232442dc4a2b24e0d28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 20.5MB
        • SHA256 90df8a3edd9d272590540b7f31b754784027811d5b3d20d9705fb6c66b7e1e3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 20.9MB
        • SHA256 8da51012684277857d79aa7f1f1a19cc759d32dc888cc5d1c5cba967c7acf6a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 21.6MB
        • SHA256 f5957a77cb6f7a71190f5fa4b2ba2b5de8d86ab2a521b33f56060fa7f421bb28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 20.1MB
        • SHA256 5383c0051ea39322320159a632ba0f9a15c4a557ff1ee9632d4da7001fb4b0f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 21.3MB
        • SHA256 c38e9c4dc314b7d1fe2b75a991fa540baaf26d3009e1ebb086d2be063157d362
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 21.0MB
        • SHA256 8c168ce0be13d9218c46c779969efd1adb50ec6897c79e77d93c3350b0720d85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 20.9MB
        • SHA256 d351644b3e9acf433cda5fc7796bd50d3292f0bc3770bc9feccefd049c3b4d76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 20.6MB
        • SHA256 e904c505341b4282e67c23ef250b3b29256c53d44fde11e80620afb9c4c55343
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 21.2MB
        • SHA256 a8444556b39cfa83644fc77ba2a52f183434124819d3ec2e3efe99ee3eb05072
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 19.8MB
        • SHA256 52e67aedf258741004c163758eef8cc23564cd28b773d03eb8a556fcdb0990c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 20.6MB
        • SHA256 330b159a78b5ebf54c8104f87cf3b957080c92ff000ae7e158b7b18e5313bc86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 21.4MB
        • SHA256 840bd6d662095cdb3026b04079e8a377633df8d5b99a61322f2baaa1eb72ba0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 20.3MB
        • SHA256 06b213a96f1bd16d0daf39e0b91d6f809425b34cb8b494911b3d6821ddf35e25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 128KB
        • SHA256 6af2bec699efa81371b34875c8fe7a3dcd60935909f1684a3de3416f422146ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 21.2MB
        • SHA256 00ddb55066467632fe246c78c21d3876fe33e5c4f7cc04652c3d29d0ad526454
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 20.2MB
        • SHA256 608f3f903ec9aa1952e00762b567749256eb49d492d98f82238a8c04ab44477d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 21.1MB
        • SHA256 7e30cab3c3b42140bfbc175f4111d6686176eb6b5a1181d9263184a684a11053
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 20.1MB
        • SHA256 38490a6a279317f1bcf71828be12ca6851d1fbf88db3e8d3eaa78ed23c0cd872
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 20.0MB
        • SHA256 7d5836638029566485bf6ab3a5712dc9f0e7ae680146efe206a15b4e21c35203
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 21.7MB
        • SHA256 2f5d467b1d99ca70c168b6440528adbac603c29d7fb7a54f1fa7ea4308781652
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 21.1MB
        • SHA256 72249923f1ca9b206207227e89a0946e73ce5ea37e029267f21d296625148633
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 21.8MB
        • SHA256 0a9db7a20ff2c4586b3cf1398d6e6b4fee63b4abb423203e39d0da375f944493
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 19.9MB
        • SHA256 bc81f644218d913f0bc35330dc28b213daf688e4fdebbda7e7ee5bcf9dd94cf2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 20.9MB
        • SHA256 e1cdb235547ed0c860b9685f6068a35aa23915588b97960b29b4db99584d04b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 21.9MB
        • SHA256 9a7fbb3448dc8b8dfd3e2f38b75d3bd3379e6b0f2fbd5d9abc82a1eb930f11ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 20.1MB
        • SHA256 7de03877267d397ff28d84b51d1b4c352ed185a64e7da7195c54094869e6e7a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 22.1MB
        • SHA256 5aa92670ed4d8af910a0474521ae1d89a4b894aa90b1624910d6a8b4acb3b8c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 9.6MB
        • SHA256 82cf465e69f8a9b6bdc62bf4f61b85159034f27443c4c5cab10f632583453d5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 20.4MB
        • SHA256 de88b8bb42894878b601ddd61aea527d0c20c00b74c79624943359ae70a9b971
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 20.2MB
        • SHA256 b0207fa48f63c6fe7c7dfbabb4b2cae579aa6ca678df599e70d2e93e8e9ece7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 20.7MB
        • SHA256 6013de7b2e7f304cdde41b5c885cdfbd303f77ba17e1a4729488002a1db545b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 22.5MB
        • SHA256 c51b3d5725dee4c9c913b417100ddc6f948a76b87c9c5ce2a64ff5f62f3d8c8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download