Overview

overview

8

Static

static

3

2026-07-09...al.exe

windows10-2004-x64

8

2026-07-09...al.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/07/2026, 05:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-09_99c5f43d7c9bef157a34bda7c5577de7_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
  • Size 5.0MB
  • Sample260709-freh8adw61
  • SHA256 9baebec7beb5055096f9e74386cbabfcb242971f50b68b42e6f24dfafce22061
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-09_99c5f43d7c9bef157a34bda7c5577de7_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-09_99c5f43d7c9bef157a34bda7c5577de7_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3096
  • C:\Users\Admin\AppData\Local\Temp\2026-07-09_99c5f43d7c9bef157a34bda7c5577de7_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-09_99c5f43d7c9bef157a34bda7c5577de7_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1220

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 5.9MB
        • SHA256 a64e5f8d73c1e1270492ec3882751d9dd190fdea529ad57cb74447baad1100aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 10.0MB
        • SHA256 8ae79ff149dc22e42fa00467eb7b3fe951c2c76876ca142486576ac7b6627700
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 10.3MB
        • SHA256 205ef08c6ba46c0c84555a43fc8caf460af24d73b69d11220209ecc2a7781c9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 10.1MB
        • SHA256 231a6ad0651c4af5b6c77ff47d7237a5762e3faa7afb9454aed23e30cd1fdc02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 5.4MB
        • SHA256 8326d5d2ad2fa620b6f92ad89d5ae1881b248aa12e4b6dad977e9f8f6d670cc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 33.5MB
        • SHA256 d4fd48a63a375f4a039d72fac8037d148d4ae7085da4ad1314f3d6deffdc23da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 10.1MB
        • SHA256 802e9c93339d1fe3857d0281fe9330e26ba6e2a0eea30a0d7864ab3cdac205f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 16.1MB
        • SHA256 8abc1c30fd17c4b0b1bff3b8dae57306a1c52287bca127b836ce39910cd58361
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 11.7MB
        • SHA256 ebefa7bb8b433432b044aafd69cb0673daffa6b1c1f4c8f258540bcaf5fb895e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 13.5MB
        • SHA256 3edb95e727ddf05d993a8dcf9b1574814d68753c784e2e41925054ac60e72e8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 12.3MB
        • SHA256 4fee8cb7e1717adf83fbe7e7cee8f4d481b8634bbcf725916fa8d91f64921637
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 11.6MB
        • SHA256 500d0ca10cf7f25cee8ff4f955b0104059d1fba1e5ab0d4b0e9cd888cb1e9379
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 11.9MB
        • SHA256 fec931918dbb8ea9de78f7a4a0a32a8b49ec11c46208aa5c29621e4ca623ff67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 13.1MB
        • SHA256 77fd046b2c3951178f83990edf7e6f12086297e7b3593681b339beb7b79ddf04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 11.4MB
        • SHA256 365b121264aecd7fa3ca05168f0cc7af409f8325e0b32d3c5b97e2efabdd70d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 10.0MB
        • SHA256 9b45b59d3b97d9570be9765f0c0fce030165de5a5eda12b9d92f3e7357b05b4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 10.0MB
        • SHA256 ac2bea3d93d037cbb571c913614136849e34c5e7d23a5bc7567c96747de01394
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 10.0MB
        • SHA256 19ff28055025a710dec5b3eb6bbc8bc1d9c90dddb78db9ae67fea2f448786575
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 10.1MB
        • SHA256 9a6a60537588f1d97eac065232272c92980d56f6e87a682c6382cf0046c6d0cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 10.0MB
        • SHA256 04f85b47c445e0704df3ea65c05ab4356dc653feab0aea02e298b308618984df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 10.0MB
        • SHA256 46819eb212f88dff9957bce7e5125eadb92c5a1c046659b6fec40e05990f64f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 10.0MB
        • SHA256 f64857b2197bf538799568a73ccac0ef2001f4d4288ec5a5159bb308191e0576
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 10.3MB
        • SHA256 e073971c33884c43de614757151a5d2fba8a0694cd46c33a0f19ff216d9e3529
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 10.0MB
        • SHA256 5ec4abf4566617644bf7c62c354f842060d617d9014de4bb11c958118301d15a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 10.0MB
        • SHA256 8e3bcfdbac77c975d4c5260d2ae0786c35048317b8c633a8134546166dc747c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 10.2MB
        • SHA256 5f259ee684c7f767832dae767aca23ef20cc8fa189d4bf55afb5490790c1f3e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 10.0MB
        • SHA256 4c754c4171776cea8c5b2a498da505763e3d222311fea590238eb0a89896c4ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 10.0MB
        • SHA256 b1e4378cdfbdee6d1607f955a1abbdc8bea90ee0f34773b0df9eb72ece375186
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 10.2MB
        • SHA256 a1992f66e254f6ef044fd7dafe9a97556727c6d8a2d9965b1810792dd6047705
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 10.5MB
        • SHA256 d52dc99c70ac85fa07d88a234956a3cd6a5f2a89f7ccc7b4980d7ba07ce9088a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 10.0MB
        • SHA256 8341f4dab1f9b8c8fe4bdea44364e1380c718444cf57bb669aab33037308f0fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 10.0MB
        • SHA256 ef0052cefba8ea75497608cb618966fc20585e565c1562fae1d480d0488c53b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 10.0MB
        • SHA256 49255749441bb6d57ba637efb0ce7025f815d76c944f0551f6698c268afaf93f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 10.0MB
        • SHA256 d1aa589226be5b5d197afc9bddbde01d009840d68750467721423896b95755ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 10.0MB
        • SHA256 b68a2b8fa4519e0b7aa935efe65af1fb84c1b960952a6546c911f51495d096f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 10.0MB
        • SHA256 2e728d142df0881e9fdd32d5dba55834ce9c2a8fd89aa303f77de005185a0125
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 10.0MB
        • SHA256 ca357c838d4b5a9ace0263e50460423706fc58f027bdd915031dddae455a98bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 10.0MB
        • SHA256 61e231b3af27300040c14de18e6e2e9808afdd1d81b08ac062e23cb138f65f85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 10.0MB
        • SHA256 11264b3b3611981a3b567c2045a52bfa4f1919ed2c8b72508720cf0ae1fe9a05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 10.0MB
        • SHA256 984bcbe87be67899432b01802c6726be1b12f524e40e1330673286af0d9e120d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 10.0MB
        • SHA256 a97444449aa301c2817b3ffaa426ddd29644c03416d6b5d72b31f8425acf63c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 10.0MB
        • SHA256 27263fad72c4f8b21d1fa07ddd2741b6e5afd8706c61237b2bf558917e19f3b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 10.0MB
        • SHA256 c40cdc2444a93d33ecd78f78388e56187045d3cb83c05548c0b94393116e1e74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 10.0MB
        • SHA256 49baedfa003075a8a318cbf151285d33fe8e036857a37f9ba25b3f2ae545d289
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 10.0MB
        • SHA256 930b05128f3ab79df44cd67f509fcd5ac004e8a76bb9251fbf1baee0adb993b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 10.0MB
        • SHA256 d9b7602127a22c4faa71bb9913d758f3d45ba7c35c4feeadd8992f5892630064
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 10.0MB
        • SHA256 140a5a8efd245c88c749d137aad25f41237e9af42198f18633920689da4fb26d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 10.0MB
        • SHA256 cd303eb1a48fe7704d15afc09d0eba863890a5768ecaa43fb07ddb2bc845811a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 10.0MB
        • SHA256 8e2ba88e273eff835bf94eddaed3531e49044afce3f84d5cd785f148006af63a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 10.0MB
        • SHA256 476f522bc278848490e3d8bdab59853562968879d4fc2536ac86f2d56713fe58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 10.0MB
        • SHA256 4153d61da992ca6361e024bf8adcad6fca5e46b547ca8531da44143f5b739d36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 10.0MB
        • SHA256 15c4ffe71776f4ce633a29a6bc26fc18b67f96045040ced6ecb1a581f14034f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 10.0MB
        • SHA256 ffbcacc71ef670433efd625e6a8b216074ad0ec4e6a134452ca43b6660e772ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 10.0MB
        • SHA256 819bee88447a1b0caf43c85bc712c8f20bb2671000046a49e3705c2cd0dfb819
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 10.0MB
        • SHA256 6452d158c0c2d1f6b5e889ae7f07aa0b4c4e2879339263f4bc5838f85b5ec390
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 10.0MB
        • SHA256 35e00934acd516d6adff4461fe8fed65d9175346e02d6d0b04f41cdf71212e4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 10.1MB
        • SHA256 e9b1d777859dbea57510dcd654f744067acfc1271b3f669ee66fde2d192060c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 10.1MB
        • SHA256 cc82aa6fbc873fb5222d1884e70d3917a099723bd59050ffd70e63f8ad16d9b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 10.1MB
        • SHA256 40e115f767fe132f35d7df02550a8a2657940df2719c9a2506efae1762c93de2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1220-32-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3096-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3096-26-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download