Overview

overview

8

Static

static

3

2026-07-15...al.exe

windows10-2004-x64

8

2026-07-15...al.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    133s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    15/07/2026, 02:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-15_9d3ae47f0568e151116326a66055b03f_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
  • Size 15.6MB
  • Sample260715-ctlhrscw81
  • SHA256 ac814545515cd5f250a876793a6bb9eed26688cb5b1f87e33be72ee23f0d303c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-15_9d3ae47f0568e151116326a66055b03f_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-15_9d3ae47f0568e151116326a66055b03f_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2012
  • C:\Users\Admin\AppData\Local\Temp\2026-07-15_9d3ae47f0568e151116326a66055b03f_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-15_9d3ae47f0568e151116326a66055b03f_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:6120

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 19.7MB
        • SHA256 a5e9b3aa8df652742561a29734fd51e8472a9e55402eede7595481c862b8d3d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 39.1MB
        • SHA256 6c40c04543ef5bcc0293a83502d94d4924986f69447dfbdd1be4295911a45298
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 17.8MB
        • SHA256 a5e703b444084179fa475a54ec08e5cc7c07578814fe5dd5d1b40f35f2fe265a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 31.4MB
        • SHA256 363903f4a0c6589ce59e9a09e0d1ba60f9eb17a836e1ec9f4b9f8daa3847dbbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 37.3MB
        • SHA256 76f2e3c426c8abe6d902fc0b2a5608d62873ed3b1ddc887e32ba470b2a69eb17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 33.0MB
        • SHA256 1d030c56ae9d08f05a02d4f351335225e0db07f8131a6fa9489b38fa52866839
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 34.7MB
        • SHA256 400a0eef516be7589206996e57814a77aa05ffb65b8c085eda91dc4e94aeac5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 32.9MB
        • SHA256 8994aa349814d65590dc9057d158c8fb1c0808304afed11c14ff94cfeb5e0aa8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 33.1MB
        • SHA256 31a33669ae07549a9f270b97a2578c32735097ec3f3c70440eb74d03f0057d94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 34.3MB
        • SHA256 66df37d4c7eb30dac443862d8e3e90cb2c1fc9a08f190180d217cde24744b7e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 32.7MB
        • SHA256 a3db095e2774de58824012de4cb14e81015becce1db04e2742e9a165cc61059d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 31.3MB
        • SHA256 7958b7289ee0684418b112a679983207b76a3cf935db027915a1e90f5f09c582
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 31.3MB
        • SHA256 09dc1575fcac500e30034b073074a3d6d217f828cf72b9091a35b8b111587d1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 31.3MB
        • SHA256 b05fe765ecd59d3cb8e88649fdfc85cb1d2f67c063fbd3c2440cbf04c2af402a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 31.3MB
        • SHA256 1c2df41e561265997dfd1230e43643f5c86b2d1f972e89de08db3a2abaaeaf2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 31.3MB
        • SHA256 401968525d046dda12d889b6e9abfdd24c7dc0dc7c8a700035eb70d825c5f708
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 31.3MB
        • SHA256 a530c12a945e228e3ec4099ef9d5c472c3ac5546e83d263803ecbb54838c77c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 31.5MB
        • SHA256 490bcfd2d0ac010e949f61d9fafe7e50db7b8de6fac485265b1cd8ce3c1e3f89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 31.3MB
        • SHA256 678d2bb39c989864c53f6b558c0c29897f3f0d8f4f70f55658b601957fb64503
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 31.3MB
        • SHA256 792f3feed0e08a7609607f8d2c6edcbc1a674085e0ff94775cfd26fec608fe11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 31.4MB
        • SHA256 295dadf8e2080d71b30b788bf1f6ccdd323400cd91602764acd83d768b998b8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 384KB
        • SHA256 144c4713f378ec54938375c9433afb979bcdaf05350d70c3d422e883e7e60d15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 31.7MB
        • SHA256 5491c3bbd774ee0d2237fe31b83f6edff7676179b42b5f538011ba18c2af04ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 31.3MB
        • SHA256 880ec7418f59224d202f4b90644b2c0a3a0699e408222a1795de73ea2a40adfa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 31.3MB
        • SHA256 d6b2442ed5915d5c28d4eb662c5a50feffdca5aceaca975ff19f35e4e8a8352d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 31.3MB
        • SHA256 dfab82cc58165aa17f21362e905637b4121be4340ed0cbda3965ecac08c07cbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 128KB
        • SHA256 018b597827351ef5fba9c0e1d321cfa9b45d887ff0f8d5607452eb75d8626cb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 31.3MB
        • SHA256 00ea88d9b405024785c65607d710d7ce42f8d5d3874a33a81a21c36c486206f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 31.3MB
        • SHA256 c9c433ebde44dcd5d5f2f189b0f4ee6c8bc114dfc3edfdd54be888c06da7a543
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 31.3MB
        • SHA256 850a40f238eb50e9dd1acfe267ae9008d667dac9726760338551776220e5c6d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 31.3MB
        • SHA256 d24b1be12e490a41b1e2d27bbb64536248cc102c4adede7624c18dd1ddbe901a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 31.3MB
        • SHA256 4c746d4dea55e5a5883eb06f132e370560017202bc05644024ea573e93f9fd8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 31.3MB
        • SHA256 cf3fc0b93fc0c392899243876d4b7f904e14c7571dfad963036f8881237f3286
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 31.3MB
        • SHA256 88daf3331aa4bfa9fca33c2922d32de6aaf164305380686d845a33330b1e56d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 31.3MB
        • SHA256 0c9e3d4a0289a5306421ac194ccc05995d61cdddf530a8955481af6163c9cc66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 31.3MB
        • SHA256 61d0927be8ac2a58e97ed80976e5a3084cb5b586b714b044585a4fb1b373d9f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 31.3MB
        • SHA256 c1795790d23679e4d09abe09ab987a865d6c1ef0daef1c9b3667ec3683c44f93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 31.3MB
        • SHA256 28ee43cca3920cffe6feb8d307746068e5b1cbad11b343e31812588861cd6090
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 31.3MB
        • SHA256 427f1205fd98e9802ebf03d79cb7a6a1684eff2e4f79dceb5d54a8ca9797a9d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 31.3MB
        • SHA256 a57b07ba7771bea17ea21f7d1b62553640cd9199f6329c33cec6d95c55f7dffc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 31.3MB
        • SHA256 a77cb5e501cdba18ee1665f287e1997cb5c1d06bcbde25d53d3094f7052bd5df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 31.3MB
        • SHA256 2394e775a253528f243dc757b087298683c3c090da5bce27d66ee19e58202fda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 31.3MB
        • SHA256 7420633f2d0a5640660c7f04bba4cd461c9f6c63148b6b0777648d9bec3227de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 31.3MB
        • SHA256 00b4ef20d090f58384cf4f9875b9fba782c174a0096226216b4c996b121a7b78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 31.3MB
        • SHA256 fabbbc7b3689fe4a12caaea8ed81daa44858fb16aa989174886b723c011dba50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 31.3MB
        • SHA256 24f59c16f19252a806567294ef1b1724b2c3c7beeb78c509419ef3ed1a7c7483
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 31.3MB
        • SHA256 a00994d361410ebdfc51dec42991c2fd51f26ff488cddce68a496226aeef69d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 31.3MB
        • SHA256 5df3042163fc50ba08efb30d940d68a27f98b0b24823f179b347a92c204553a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 31.3MB
        • SHA256 926bebd1def81b0a0ba8191615cdcc2c61a9ae47abf4c9c1eaecf6ac52a13553
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 31.3MB
        • SHA256 286de8d6a26e3c3b4c5f3a6c3757c1177d70f136428b42d8d8ea208db83b6e1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 31.3MB
        • SHA256 77a1d15896c5dc17d833832dd7d963df38181a81298580b90449f8b6593d72e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 31.5MB
        • SHA256 487a14118dd86fc594a03813cf270b7a42a83941ee898f7cd9c968cedde7f874
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 31.3MB
        • SHA256 f940828ebaabb2e0214be9e2a2cdae4bdce60446dfba39cf6e81489fd58f474f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 31.3MB
        • SHA256 a3e45dc258e60fec8309e29e9f57929d7e6d75f1d8b99120f4b7dc403894c5c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 31.4MB
        • SHA256 4079c5fac8f2dd46d2d3fa6b09a15ba2d974934d839f3fe7c78711f61ea2adcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 31.3MB
        • SHA256 b7ab28a6da62e66038275ec67b3b53ba7a83253d60ddb8b3223ac720e394f371
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 31.3MB
        • SHA256 5bdeeb0920bd2540d73f7ba9c794234728fe57fb076654ad51e8e97842f814e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 31.3MB
        • SHA256 fe80ab210f222e109bf8d05aafd48c1deaa3d4a73849ce21e27a044e84aa5db4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2012-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2012-9-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/6120-13-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download