Overview

overview

8

Static

static

3

2026-07-08...al.exe

windows10-2004-x64

8

2026-07-08...al.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    21s
  • max time network
    124s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/07/2026, 15:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-08_1e2a9c2f859c61cb2f46d505de28ef48_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
  • Size 20.0MB
  • Sample260708-sp4rjsas9m
  • SHA256 b4f456b2ae248673c04a711f73c6e8fec534f07952b1af03e9a8c873e0057372
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-08_1e2a9c2f859c61cb2f46d505de28ef48_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-08_1e2a9c2f859c61cb2f46d505de28ef48_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2140
  • C:\Users\Admin\AppData\Local\Temp\2026-07-08_1e2a9c2f859c61cb2f46d505de28ef48_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-08_1e2a9c2f859c61cb2f46d505de28ef48_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3416
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:1800
      • C:\Windows\explorer.exe
        explorer.exe /LOADSAVEDWINDOWS
        2⤵
          PID:5528
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:2868

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              AppVShNotify.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
              • Size 20.0MB
              • SHA256 b4f456b2ae248673c04a711f73c6e8fec534f07952b1af03e9a8c873e0057372
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              InspectorOfficeGadget.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
              • Size 40.1MB
              • SHA256 7f7dd1d542745aafc1d000262f6f39094d77cb8cb8afc8d5cc39fb2b17446014
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              IntegratedOffice.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
              • Size 44.2MB
              • SHA256 2bff4c2bdb2607d658aee411e1214ca09aad2678ca5fa3dcaaf2789bfd4aca9e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MavInject32.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
              • Size 40.4MB
              • SHA256 b2aa2e7733566be0402c94b4c88dbdfcc21e8838ff8083b0a3fd7e8dcbb16785
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              appvcleaner.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
              • Size 22.2MB
              • SHA256 1017717d4298d87b5eeb474c6c018ad010b47afd0c3474aa3d877bada5c74bb8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VSTOInstaller.exe
              • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
              • Size 40.2MB
              • SHA256 1b54dc6f286d821e10cee5f6280ef33be3ef3f54cab290ed10448e9c2fcd4564
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrmstp.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
              • Size 46.1MB
              • SHA256 8680ee52ec97f240d41445b2907579638e5f64feb5b134ff664bd1e44524c2b2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              setup.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
              • Size 44.1MB
              • SHA256 75de63ef723771b1c9f051191da0492569d5d6ed17789ae3fe5c39c91961a5ff
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrome_pwa_launcher.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
              • Size 41.8MB
              • SHA256 745935761ab4a6679b0a1fbe2f8eb0b68cd0c48944bb03fa2400d80511cc35d9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              os_update_handler.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
              • Size 41.9MB
              • SHA256 daf71155714e299bc91ef56516821c207521cda7249f2941778d5fb9d1a14479
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrome.exe
              • Path C:\Program Files\Google\Chrome\Application\chrome.exe
              • Size 43.1MB
              • SHA256 6ec116c03234852542ef8e9db3c9248ae92d7dd964d855cfd2793f1cae0b6958
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrome_proxy.exe
              • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
              • Size 41.5MB
              • SHA256 55baab39a7f4807cd52e6870b68701f9d409cd4b3826c6940ddb9ea60078ce70
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              appletviewer.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
              • Size 40.1MB
              • SHA256 c8504e7e8f3889ba49c614aabb2a0f0aa9735f75e4adef1f6b4831664c065eab
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              extcheck.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
              • Size 40.1MB
              • SHA256 c3f80dec8e0c902cb47c840907b2b13db8e6f3b43b584b0eb2f2cdd889c5080f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              idlj.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
              • Size 40.0MB
              • SHA256 addba4a031c020e3c9460836bc2828dccdc6e55f5c4507be95baa3e867f643a6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jabswitch.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
              • Size 40.1MB
              • SHA256 c9666360e2d4402824930f0c798540bdc38d378ba40be433654ad658c8ee6801
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jar.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
              • Size 40.1MB
              • SHA256 72415ff2a2c8ad094808d041d78606c5d45558949eb150fd7a41a062919fcfd9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jarsigner.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
              • Size 40.1MB
              • SHA256 879a94e97e7c1c649ed2a19fb64b8f53127ba97f6497396dcaa6d9c6c10b6e84
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              java-rmi.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
              • Size 40.1MB
              • SHA256 38706002abd91f726c07c3fa30b2488f5dc7805b5baf52eebde59c5899a9d803
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              java.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
              • Size 40.3MB
              • SHA256 637a8bb30c51f38333e70155d2e235b1e3daf9ff1b36c398bcc9a2387bc2ad78
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javac.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
              • Size 39.2MB
              • SHA256 220b611aac60412623a3e7c1a27869970842accb9eadbab626d6d672ab534c54
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javadoc.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
              • Size 40.1MB
              • SHA256 028d2eaadabd26b3b1eee25076e671bfc4827fb3dd68508d1dc4fac9e89ac67c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javafxpackager.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
              • Size 40.2MB
              • SHA256 9b51ce51c5037e01e545999cb95d605fda31490adaff477c7e1eeced1969514b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javah.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
              • Size 40.1MB
              • SHA256 354cc12960ad53a1ecead17c70c6047a08d6a527ccf272c6888ee3d6a5006127
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javap.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
              • Size 38.0MB
              • SHA256 76ccd39c12639b3957e39e1a1b5977aa9762a16e967d8bb6e2af6842748bca23
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javapackager.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
              • Size 40.2MB
              • SHA256 2f2d5cd0943951c1ccb4faa1444b43ffa8aaa16a5e6adc2acad8626e3dbd5f3c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javaw.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
              • Size 36.7MB
              • SHA256 1465a691f01fa894207c0cbc391307d8c4127a6deb43b4fced78e596aea57c76
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javaws.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
              • Size 36.8MB
              • SHA256 a4383be29cd0a54b751e221b244888ad57812df382bd2d1ce96b52cd2239bf32
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jcmd.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
              • Size 40.1MB
              • SHA256 ec4b30388407da43644bd242ece2f4222bb9824927586993f5abe9ca5f6cdddc
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jconsole.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
              • Size 35.8MB
              • SHA256 30dad987377cc76ad81e270f0120f7d2739540a944e62b6e56374d6018e7cc04
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jdb.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
              • Size 39.1MB
              • SHA256 c28564f7fe11cba95e931db227619c3f280cd9ee16e8da99918a87eb8659844d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jdeps.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
              • Size 38.9MB
              • SHA256 6a1758c6aa21c8e7c3ecb759d18c9742294523994f7be50dff171be1e2e68285
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jhat.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
              • Size 33.9MB
              • SHA256 b6c2a2c8abfde5cd0cf8ec11dca06ed42abc8c184e2efccc7f2ec2208c91f956
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jinfo.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
              • Size 34.1MB
              • SHA256 ebb57b49562b990488f95812917b0b8e395bf1e2a79029555e6ed9c7566cec88
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jjs.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
              • Size 39.1MB
              • SHA256 992bae98b72244e75e3fbb9657b4a5fa0989164d3f6e0ceaf6f8fe354d4bf93e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jmap.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
              • Size 37.7MB
              • SHA256 b242b0f50d50aa56aeef4e4b075aa93e5134acc2c823f7c4b254b8519414cc05
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jps.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
              • Size 37.9MB
              • SHA256 7fd9da86529f6d75a2cfdc07ae45128ae87cf0828a584651f8a8516214310e6e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jrunscript.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
              • Size 32.2MB
              • SHA256 fd504351365b55282c23afba5a7f93d7606499fe2b4593066b5c9ca555209f6a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jsadebugd.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
              • Size 31.8MB
              • SHA256 8a3810b07b58d137ed2a6aa753d9e7cba1ca7a9701d81b28817e0beea64feb27
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jstack.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
              • Size 35.8MB
              • SHA256 6fb588ebbda09f586299d779e849439651b1021ddeeeeaa863373468738bdee9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jstat.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
              • Size 32.1MB
              • SHA256 32ec8711d556c42caabe9ce05b53a5a66f5362139c69c66ce4ec0dba08cda634
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jstatd.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
              • Size 31.6MB
              • SHA256 a4625ab97de597412965c4d22b6a8b379312a279819d0aa8a88d681e7b7c94a6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              keytool.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
              • Size 32.0MB
              • SHA256 5ab556171aa978bc4b7ac3f85ba9258f9bcd37989a897a456aaec1840a7fddc2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              klist.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
              • Size 35.7MB
              • SHA256 5b3ce26800917d91376a6515dd7278d10c160331277abbf570c0d87e87b17e68
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ktab.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
              • Size 35.6MB
              • SHA256 7d7ac0c5976ef6fd89d13a0654f19bf8fde037848d7d3f69027a4bc2d8ffa616
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              native2ascii.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
              • Size 37.2MB
              • SHA256 a65266f2e41ad9f4a38cd2cdef11fdc20888ec4931f6ab216e5906f4ba05b440
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              orbd.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
              • Size 31.3MB
              • SHA256 aed7108866e4bd9da7c94da1350a385a6c8fec5717fe589bf5a69297d90ab2ab
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              pack200.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
              • Size 35.5MB
              • SHA256 da31e3ed87e4f2acec91764b2d2929e977a98c6390520a8b458540a71ac5185b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              rmic.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
              • Size 35.4MB
              • SHA256 f5cdc5b24d77d4feb8baf196c03eb0e2b63420988abdd0f081ff3d2c31be4d3f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              rmid.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
              • Size 31.5MB
              • SHA256 a119409543cc4d20dbfffbdfa7e260325e21ed4657cd245ff20888c59e3e2e5e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              rmiregistry.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
              • Size 31.6MB
              • SHA256 46f4a82f0bf0bd600581f220c3c29037d255e883051d44a915f506fd6c48dd68
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              schemagen.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
              • Size 35.1MB
              • SHA256 7232c758fc19588fe00d796c7d3307b8f96cfb49b43cb06c8aad1c7123a6e325
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              serialver.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
              • Size 35.1MB
              • SHA256 faa1c61a6f5fd40927045830ed7e696e7374b1c9fe2ed3a684973eafd9b00c84
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              servertool.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
              • Size 35.0MB
              • SHA256 5dcefdc6760b09f15364ae35d43293de882fffb02dba9f644c6d886d45cecd9b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              tnameserv.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
              • Size 31.2MB
              • SHA256 350c797fb1fa5f4f35f9e60caa1b935e2ef09a4456ecdf646205bd442fcf5206
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dotnet.exe
              • Path C:\Program Files\dotnet\dotnet.exe
              • Size 40.2MB
              • SHA256 6f5f6d91a90b977d122bc135f688d9ecce52cdb6d1f986c56893fec88dcbc624
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              createdump.exe
              • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
              • Size 20.1MB
              • SHA256 7dc1ef121ae12b8bfc0c5b503b9d1f0a978d4dd82faa56852c0c50648052f71e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              createdump.exe
              • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
              • Size 20.1MB
              • SHA256 5c9654d5887f74c897bda830c351cc6f753583897e9fb38aed91612ed97aa1d1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              createdump.exe
              • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
              • Size 40.1MB
              • SHA256 53388e17d934c890d1230020cac212e8144fbec87842ce7fedb3991c07f574e7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              prep_Activatable Class_Hermes_perf.cache
              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
              • Size 595B
              • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
              • MD5 SHA1 SHA512 TLSH
              Submit Download