Overview

overview

8

Static

static

3

2026-07-18...al.exe

windows10-2004-x64

8

2026-07-18...al.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    138s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    18/07/2026, 06:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-18_dfa6579a4ba351eba16f491bd72b4d67_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
  • Size 6.6MB
  • Sample260718-gswdssh13k
  • SHA256 ad696f6e74248caec41fbe08fb46db9b4120a0f828b283c60cf32bde0d986e9e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-18_dfa6579a4ba351eba16f491bd72b4d67_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-18_dfa6579a4ba351eba16f491bd72b4d67_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2032
  • C:\Users\Admin\AppData\Local\Temp\2026-07-18_dfa6579a4ba351eba16f491bd72b4d67_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-18_dfa6579a4ba351eba16f491bd72b4d67_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2720

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 13.5MB
        • SHA256 ca3ad1f9716d647e941a267d18931cc1da6ee86b994b921d5ef14db9b7a0dce5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 13.2MB
        • SHA256 b50d79122e78f171ed2914ce55bb032655172a26247f5b0bb6e15767066a4180
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 17.3MB
        • SHA256 430cebde428263c22d9e23d2b3043c09e3b6251ae8905a78318a70a81cb57b3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 13.5MB
        • SHA256 5a0c874bdfda7591b65ce4a8ecae4581038d00cc27ba4b927ebf67eee160f442
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 36.7MB
        • SHA256 b9c82856fb254bdf11038d5f0a2e1c442ca31aef89c8510321a4867d826dcf81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 8.7MB
        • SHA256 6a079af534dd4f9a1d399469651365a22a76da91967ca0e8ee91b82975e4ec95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 13.3MB
        • SHA256 de3c0cf4f62052dcb88da10a5331d49d95a6297f511c7a10881e6b67366e2e6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 12.7MB
        • SHA256 1b4d8fdff0263fb811fbf2dbba0a25ccd46b48827c84c1a0c51acf99cef6a0a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 19.3MB
        • SHA256 0f3d74f99db4672235abc71b4e6ee796294922cd4f70ceffe953d05b8b5e602d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 14.9MB
        • SHA256 9645cc252f41c0a825b611822db8bca9d2a327af6d8da2bfd7b9e31806bf676c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 16.7MB
        • SHA256 29bc3e8f861fb91f6aac1a12906a8778262a8f166150d6c91c6d0a8e0692f5dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 15.5MB
        • SHA256 e4cbd704a11b6bca5e85d31588c590a8afb1d19f627a055c1e931f3c65a01f82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 14.8MB
        • SHA256 f9a433f9c3bb7c53f1b77a071c5695ed9a11cd29d09fb3e49165f93e6b9e352f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 16.3MB
        • SHA256 802a3c723cb5e7a0c25f020b2bc4d37f0cf1c0e64e0aa21c5b34047c2bd25d06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 14.6MB
        • SHA256 fc0f0da337d4a5ca4ccfda26fdf98fa35e1f9ed1a9d8deea60355ce76379f2bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 13.2MB
        • SHA256 972ea3920956c7fe2e7211bf767616b34f6efd4f5e56a3cafc381d534b47fc80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 13.2MB
        • SHA256 147878fab0530c8d1c43ea2691f90dbaa3a7e044a4920eea48490b2db139b5b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 13.2MB
        • SHA256 5925605c347186b79510da7e13423fe4a555d6469ce295ee4665f0fc341bcd4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 13.2MB
        • SHA256 22fe95b8e7f850585fb245e418402423132ee70b5da275eb606d8e007113f442
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 13.2MB
        • SHA256 ece3a25b6c2dcd88fc5c938fc687a8bc79e23aaaa99a8c7e2e6be38a4a616791
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 13.2MB
        • SHA256 90c08090819f95dd1a5699383c118c1da31bc5e062939e1a2865e0aad408a0b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 13.5MB
        • SHA256 d5d8ecbfe7a28c2db6e192a6ba651fb515b0cb7240ec6326896937958fd96746
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 13.2MB
        • SHA256 6fc8c85f547a38dcbeb7785adfdec1d61960045f2c9f2a6a63b2874660c3a879
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 13.2MB
        • SHA256 d7dbda96dc9dfe3b5f0c079933d9f10a16a658da7ab603fa55a1fd2b0161e147
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 13.4MB
        • SHA256 be67b3d29dcee46e7e9bc344df8ecea99e93ba07d1d8262b01225963385e8052
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 13.2MB
        • SHA256 3ca9361b5c7a5a9fe0c273503eb1d7ebaa1f177cd5c0deabcf87a049fb9b9afb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 13.2MB
        • SHA256 fe92c261ff18a200f3232004ac6c5586f4c7a70f6cc87e8470a0f56e87fd3e9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 13.4MB
        • SHA256 bb8fd89605e6be3e66ae95c529cf9cd73a841475de842e7e69f4fb5dbe89d0d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 13.5MB
        • SHA256 89576ff304677e44dab6bad3bf045b582dd15a25ca6b7c63bc02329e85e8cfdd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 13.6MB
        • SHA256 1d5ac6b34a0a1092e1c39ac978595d04b9a3affbb9592eb11929925f1d8dd5bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 13.2MB
        • SHA256 21729e1e6431c465e9703d22769011067b4f60cab6bbb9d0d38d1e068bf4b48d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 13.2MB
        • SHA256 7538f7f88db6faba287e5f7c0b9c6d3428a6307ee44856fafa00c5834a4b3038
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 13.2MB
        • SHA256 dca8debc60350f498aca0b1554c9d7fd38d33a84cb9b6b792025a643ff0f5d12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 6.6MB
        • SHA256 ec7e8ec498795877fe132ed5f167ade9218e1e6a03c5e3a5d5996953ce790233
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 13.2MB
        • SHA256 5c9b1eec9aff40025164e0f043203477dbd7150483b6b033a549065571d4e4ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 13.2MB
        • SHA256 fa21fc8e7e526c2ff4e0522b9a0bbfe2eb887ce3acfed998fb5ebd4e930c5216
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 13.2MB
        • SHA256 4922427e761123f5ec5c9f3b8ba03a8ec769784f40f7b9c67150b8890a771675
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 13.2MB
        • SHA256 0a852faa3e445c198483674a63c2f58214670622eef3ee830dea2992777445c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 13.2MB
        • SHA256 227e3764fd16c6b6fa5f3bec949e6b146982d4c7556543a579dc56295507ff7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 13.2MB
        • SHA256 923f2d34ba94309a5a55a40b15b966fe832103c7cd79ef08a23e02a7980626f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 13.2MB
        • SHA256 9d0e7331829f0fc54295e3947c2c4a6a04a404a4f566a6ce17dd336158306574
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 13.2MB
        • SHA256 9f53d966a2687d96123cd9dc783b9aba81a2aad45f76652cc9d9b8c8020caaad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 13.2MB
        • SHA256 87b20f914d5835231e28b9ec4f3eb60f996dbb54ced72ca40744a5c958a52ec1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 13.2MB
        • SHA256 59bab12c5759d0664b8b70b09786db56f43d10f538e7185abfcb8d5e6b8830ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 13.2MB
        • SHA256 3bab27041e2cb41785101962b9bb429853fb31912d54d244371dc08b6e9b078b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 13.2MB
        • SHA256 e4419338bd4a62855a8c5dbdca2193baaaf20c8a09767ac92c8c30697ea6889c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 13.2MB
        • SHA256 430c7c8bead687d0ea9c7e41305b73ad909592ed2e9264e53a710817f3bdb9c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 13.2MB
        • SHA256 7d203eb68c03fa2c5d68bdbea86bc74df34aae2336f72de81cc7212f7a8e7707
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 13.2MB
        • SHA256 98eeb8e8896288edee169b166bd6078e01dc3059b18be9ec6b6a7144dc101f69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 13.2MB
        • SHA256 5d48324f576dea9f64505c0433f9c0eacfee3f0bc2f96b312384048f6d2de6d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 13.2MB
        • SHA256 b241b721605e56a25b711b863bc83790ca657520dabfda73a885fd788facf367
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 13.2MB
        • SHA256 6ff92bf47a19bbf736586f87db3bdf4c5993bfd324a1366797732b381c883f24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 13.2MB
        • SHA256 0318ffa0a82163126a3c9696314593f6ecdca718570a992ee9a0f20260ebe1c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 13.2MB
        • SHA256 5f4b8a37b5dad765f06c50cf483aa0f6bde7826827d60738a8267ad9d5ead2ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 13.2MB
        • SHA256 1c2294e7823679e081f535b3bac71e272a2e202b1333144e72ba5d41364e843f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 13.2MB
        • SHA256 8636bcfedfda3527cbc767d1da1fddda920f349abd0a0e4dec450e5e21e9c123
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 13.2MB
        • SHA256 18a1b62f74a2bb1c495741e088f721d65d6e817508ecf9fa21929a23547923f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 13.2MB
        • SHA256 9bd2375258b9e95eb72c08d586df593c7472d34821e332eda2fed0167909954c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 13.3MB
        • SHA256 e598dbe26c2f305fec09c8f863c2722de8a4161c46649809db4af888da1dbc5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 13.3MB
        • SHA256 7d9715a6f07a1492885a6b165165d954bfa5247ab488390839297a0c99c294c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 13.3MB
        • SHA256 6cc574366391812b1041389c37aefa1abec499b114f945e0f7d0addafb9b736d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 13.3MB
        • SHA256 370cb486e7a54c4f97529137634a12bb98e9891dedf0d16ed3b792e67bd28e9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2032-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2032-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2720-14-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download