Overview

overview

8

Static

static

3

2026-07-16...al.exe

windows10-2004-x64

8

2026-07-16...al.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    135s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/07/2026, 03:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-16_6a2303a2ca27e76d9b94531d6b4429cf_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
  • Size 15.6MB
  • Sample260716-eaa9sscv6p
  • SHA256 0633bb3ebbfcbb2f49d489baae7dba1d0e210d218bfa7584463621b2d79ade8b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-16_6a2303a2ca27e76d9b94531d6b4429cf_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-16_6a2303a2ca27e76d9b94531d6b4429cf_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3284
  • C:\Users\Admin\AppData\Local\Temp\2026-07-16_6a2303a2ca27e76d9b94531d6b4429cf_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-16_6a2303a2ca27e76d9b94531d6b4429cf_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5988

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 16.6MB
        • SHA256 6810722171c3bc3b771943cd9e8234f8b19925008ee7abe0e1d0d4f76a246812
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 15.6MB
        • SHA256 0633bb3ebbfcbb2f49d489baae7dba1d0e210d218bfa7584463621b2d79ade8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 15.6MB
        • SHA256 e87c1542f4687e8a7f0ec6c5cacc30f47a6a92d96a0071421d62b8c5a03fc837
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 31.5MB
        • SHA256 dcd70dd5ee2b4ff01578d6bf0054df177085a6bc556ef6409cd3893a4fd89c09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 35.4MB
        • SHA256 423111d67586a94fa89cb14f93d0560c4b198ece2079ae21641b9d5588e94fda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 31.6MB
        • SHA256 0eec9a9d7319902ec154b32adcd08b559a03b93b22dee836796e54c63fb835b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 39.1MB
        • SHA256 f718813729f0b04a5f8bb7539e710873a3e72fe5f7e0e4566b776721c8bfc42b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 33.4MB
        • SHA256 0109fe3c2615026b74e16e1c638e5e46023e06591a63527de7da3e2551d2e1c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 31.4MB
        • SHA256 733ea37b08beded38f37a81eab040acac0477a04fb8cc53e76696c640b7b4cdb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 33.0MB
        • SHA256 b2682bad12cbe7a32cc0548c32112008dd9de33d785223ac78ca9f68e1f00373
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 33.5MB
        • SHA256 a04f321904e261a5505fb2fb83a795d1362683c2ae8347acd237de7f2a897982
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 32.9MB
        • SHA256 5ae918f9f143f82c79a16a2a38f19999e33684b8845c63f64f52412c8cc77f07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 33.1MB
        • SHA256 3ea44bb907994549166d40b420c3caa279d4f99487e211eee25144607fa26fd5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 34.3MB
        • SHA256 0a9ac6a353fc03597a7477afd0f08c5ae07252c88b7226038ddab9d3426a9c34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 31.3MB
        • SHA256 ea6db403515a38fe73e5254998bffead5dbbe408ac16c9ea3b842169c9011c99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 31.3MB
        • SHA256 61e9cf81dbea2249485349349042ad4384e388e1430b8d00b0e6370e51e18ba1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 31.3MB
        • SHA256 6c0aef7b206e84a3751c7743066ce8ab1fae336c89c626cbc46e1a9abaff525f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 31.3MB
        • SHA256 d4ea724f2b9954f7bd3e04b36af6be08e8d4f278322d26c31c55a9112c274dee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 31.3MB
        • SHA256 b526fb6cb22316a5a0f4d1228bcdef5286eac3ae1b401bc2c90f2e7e679a2228
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 31.3MB
        • SHA256 19784e558f6e9c569c496c3cda7e42bb804cffe4fabd0f6543192107b0965f8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 31.3MB
        • SHA256 57e717c0e1b2ac600215d751aae4acad002abb369a630cfec3187387925919e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 31.5MB
        • SHA256 c08d2b1cfa3f8244e5f445b1b5620c00e1b5c9794ab06fbbb5b22ad43da64457
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 31.3MB
        • SHA256 796a28f2994251db4a42cea52a88641ccc217affa5d4c38d16afe7e4b51022c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 31.3MB
        • SHA256 226a552a110bfb2d9ac00c626e3a1b7bb89e12cbfd22421381dc8b33d32fa47d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 31.4MB
        • SHA256 0a18ca785871b7823cc193d43c386782461c9b8dde070664faf9857b74ee29b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 31.3MB
        • SHA256 d63e561008cae8d94f7008f25aac33216068260509cc7161e3b40ddf94ae2071
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 31.3MB
        • SHA256 b9975057c5ecada1dc73e11f332285aa3a8fa6042a1ee5eb18ad41282f3e3f93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 31.4MB
        • SHA256 017a1bfc73ffdcc7e051e136fb43205e27e711bbc326e3738a9789aa4b4cc478
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 31.5MB
        • SHA256 6e28351915e3b7b74197ded5e053292fd6ec0c6f853e78859ad50c544e5a4fbd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 31.7MB
        • SHA256 d5ea56eaa5bc808a6542480b8d3a63172dfa70743b7cd9a0e10564a5be95d354
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 31.3MB
        • SHA256 4d753e3573a2958e6fb64e102bca69906953f02017ec7eadfe59ae03129f2da0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 31.3MB
        • SHA256 e9c651a87426e80e2c0ad12886921f9623b1a311c77ecc67f7928ecd60a42ad6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 31.3MB
        • SHA256 fd4cf268827ddd03d41669f3ffc1cfb6b2141de2ab7f042c74c9f00fdaadd0dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 31.3MB
        • SHA256 d445580d2819c885d2e3a327e63869cc37ea3c79c5cd012a441785899c4a6467
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 31.3MB
        • SHA256 b19d2277a9544917176cafcab2bb2e5b14f9b1462627c7084684fa37ebc95352
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 31.3MB
        • SHA256 89603e634ae179a6261f072c8cb4540f1d8590729ad7bff8c9c72b92edd8cd0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 31.3MB
        • SHA256 09a3234c9fe0763ed8e8493e9c86c6fc079aff0e10fa398494602e06a51805da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 31.3MB
        • SHA256 874a768f75adbe63fe1237409e9455c0b1327d1195a3a7e8cced9acdcf1b127c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 31.3MB
        • SHA256 b4efcae074d3769fc736e236296e9bf3683dcddd87a69a9af8cd45fddec1b1ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 31.3MB
        • SHA256 f6d8007ee92e80f225a1c0afd57e789a2deca8d156314c64d0dba1f0373bd6ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 31.3MB
        • SHA256 234710e849ccfbdaebaaa211680af235359312ff84f296afedef102f46a7602e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 31.3MB
        • SHA256 0a54a7b3f124db6f8f4cb329f1f4c95cb9dbad18443e6733064a0df6e0f15721
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 31.3MB
        • SHA256 81c374b898e8cad543acfafb6163c28bb7c9aa15e1e6e9880464d64f72f0991c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 31.3MB
        • SHA256 4970d69cb0859998f221d7f4c9a504d6dcd4278ecfbe721ec81d4db285b7294b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 31.3MB
        • SHA256 6e767e1c7d4af25687a815908447f8566fd8ebe896aa03c4717ca4847881002f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 31.3MB
        • SHA256 d4478836751e84b0381dfdac60e764b5d7fdbbe5e2019cc0be33bba499ffef3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 31.3MB
        • SHA256 b00109d7bbb9a09611ec92480b862a3575b2c9fdef7dfa0aedd3c8eb0045ca58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 31.3MB
        • SHA256 14a49a860ed0d44c41f0d6213888388988ab2582fb52c029dcd63cfb4632162a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 31.3MB
        • SHA256 f9aed73e7df5a554e30e3194b9b53633db5b0dd5fa8f9729555f3b450854bde8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 31.3MB
        • SHA256 3cc6a6a818de29791a1fe47b2095e1df66cbb6d461eb9b172f6bc0e091f926a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 31.3MB
        • SHA256 fbb48e3fbabc3a92ebb84599f09e71624755ea9d2daa0773be7a95d4513054d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 31.3MB
        • SHA256 b57e3fd225dfa6d13443cb18d9582a3da5b79bfc4a33a15bc2c3429401d17ead
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 31.3MB
        • SHA256 216d90710bd107bfee50f31a5edf836ed69d4b75ec02446c7f087379243ef2ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 31.3MB
        • SHA256 fa78d408af72d82dba8e19a3cc644a6186d26bc6de0b5be2a458b79949eac6d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 31.3MB
        • SHA256 f568600ab96b564a0e3fe8ee407c93903747d80cf4df15b4cdeb312920de0204
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 15.7MB
        • SHA256 563b433a84400574fdece4ccb2f9a3db5f911088146fb1ef2d14af051105ffaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 31.3MB
        • SHA256 c0ee73655df1f8fbc9fec2b9a0b22a35246be92c96fd4c2423a4e8c8762eab38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 31.3MB
        • SHA256 2f05db1cdc93200cf1c7d55328175cc6087232cf422633afd530c4585c33f766
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download