Overview

overview

8

Static

static

3

2026-07-28...al.exe

windows10-2004-x64

8

2026-07-28...al.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    37s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/07/2026, 19:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-28_d705ddb00c82318f0960e8a0c66c3e2d_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
  • Size 34.9MB
  • Sample260728-yma94svamd
  • SHA256 60ff4dd81aac06bd128c03b733fc4bf83af2ad3d6148aadb75778752107ba9f6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-28_d705ddb00c82318f0960e8a0c66c3e2d_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-28_d705ddb00c82318f0960e8a0c66c3e2d_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2884
  • C:\Users\Admin\AppData\Local\Temp\2026-07-28_d705ddb00c82318f0960e8a0c66c3e2d_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-28_d705ddb00c82318f0960e8a0c66c3e2d_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5368

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 35.1MB
        • SHA256 b76077394d1386a036475d1acef4a8fd44a0fef40c24489d10286d1c50e54c8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 69.8MB
        • SHA256 26316390b478e12a98c81557fc81fbacb1c9ed4702580bc726af58d9cf5ed20c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 68.3MB
        • SHA256 fcf68b295f7f39103587b78cb11527e6e4ac14c5c5b0a904a91650f055afd289
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 68.2MB
        • SHA256 86d317d12260f8bed6653f4943b6b6f79ab78a157eac1b55fb3d46a73646aa89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 37.0MB
        • SHA256 6b6051d5a08ce4beddb4d34a7b11d8c37d6d1f2ccdaa1885a3e02bc9d870f4d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 52.3MB
        • SHA256 8137a9a6817bdcdacc34f245c52fe30c3288c147fc264a6537c4d900628a9512
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 54.1MB
        • SHA256 17bcc9884cd151a452b1e7ff162cd103940ee7bb14592ce95557536267782708
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 57.5MB
        • SHA256 1a0ab8d739f599dd03f3f1285c76853c97a4ff2025a2c2f4418d88bcc544d992
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 56.2MB
        • SHA256 a150fc13f681629b8f9297be79626cb7cc076693a71da9be2a862536e1f2e18e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 54.4MB
        • SHA256 a36e57b39817844b5c80edcdf2b28e53388694c1dcd420243cf7730b4f89ab51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 54.0MB
        • SHA256 9faa84d68f8caf0890cabaab0e37c5055d2dca6d830cbcf9050ef461ab7ac416
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 50.6MB
        • SHA256 1b61320aa5bf95de1650a987af320dfc46089e3b533cc46f6b1128f68c456438
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 49.9MB
        • SHA256 cdd4e5b9fcc99b910b9898030bf71a91820b23369ada753e81b5921851d3ec61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 48.9MB
        • SHA256 42fce1f848cc30108b753f6f48e462edbacfcc7954fbfb0426ab0e47511c2179
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 49.0MB
        • SHA256 f4b75602cd15737f9bb6c49240406156ec4c923ef4266c48147dd8a6c9f8ab05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 46.6MB
        • SHA256 dcc4685e24ba0d0f139a7028bdcb14065a62548335f78db9012fb5a41ea5cc07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 46.9MB
        • SHA256 d650eb6e8c9eec3901596a22464eaec6be48c7e91016e0a3d46e71e4bd23302e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 46.6MB
        • SHA256 63d78f70f044fa23489f0174f208d655ecb2c5f7863ec88233c37ecd5f571bcf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 44.6MB
        • SHA256 c7be7339465f045dc472b7252adc6fb4d818c8753b485161eab5313f8fc1fce6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 43.6MB
        • SHA256 36826246047b1927ec92de6a555985f9bd1ec5afa1f81e0cbaf0fc67d651afe7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 42.1MB
        • SHA256 47786bb209eaafef712f53a48acc9a27888900a3efdc9f4d278b272fd620b070
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 40.9MB
        • SHA256 96ae709509239c1d421ec985c810e0dc74dacfcd1cb4bf9e3d63a3b3333605c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 40.6MB
        • SHA256 f91ba478a99430f99ad91310fd42e93dceecdafa6ee8f00f63bba3c684048f67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 39.2MB
        • SHA256 a2706350c6aabfcfc5ef7cf63ca8ba29320cf4c8c270d9e930a8ec29d2474d89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 38.2MB
        • SHA256 09db657de9ee15e631fc8816d1cbbeebaccd02524b7ec74fed5f6d374e1e89c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 38.1MB
        • SHA256 67ea3502aa66436cfdaf9f9dd891d7a59787be5eada3f06d8227b94d10ac0cc2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 37.1MB
        • SHA256 673748670e8cd14282f0905e39354f7103a2533ea10a41ccf98538784011da07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 36.0MB
        • SHA256 bc4f3f54a2d9d514e3b9111945349149fcab72be2634a09094d5da17102d50d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 35.1MB
        • SHA256 0b4ca43fb4c4716af3cde26cdaa50e152d94335e24541e67d15904158b395f7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 34.0MB
        • SHA256 6851f8a9a937f666343466366fb4393029165bbeb0e46698461662d96bede671
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 32.2MB
        • SHA256 8b8154d1cc8f9396e07b0a1d77f445c2d2a00317562e0d62b3f9b94c1f27900c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 31.9MB
        • SHA256 8cb798ec1890a1b0cceff8e23a93734fe02632ad8b94c4ca6fd9d0e09a1332cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 31.8MB
        • SHA256 355d253fec50a7999720bc836f5f6aafb357016ebe4eddc5cd6afceae659e4e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 31.6MB
        • SHA256 4df47f4d3418d60815705041363bc4bf29394c3abb22f4e0e916bc89760cb05c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 31.5MB
        • SHA256 ec174b56f515ef124f9257e20b5032b6ec633a1c85462dd18d8c43441195e272
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 31.2MB
        • SHA256 d4c4d06d9961353865da571cca6358347cb2d9a53961a36821263a8808165f66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 31.1MB
        • SHA256 0e99969fd9cc5a04ae650228aa66ea992f7a006d2a603c315aa37e0e170c77f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 30.8MB
        • SHA256 9338e59727a95b2fe5431869d580ecd6499203adacf18a4f74819fbabfb90352
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 30.2MB
        • SHA256 0d40239d7f5fcbb27e83cb3889256a5fa89e3bab68fc6e46a6801bf17191dd75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 29.9MB
        • SHA256 d19c3eec1e08f4f6615b973fb3868cd9f69dc4c3e338543a0a0b76b040c309a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 29.5MB
        • SHA256 819bb5ff015117159c999a2ed7241e41882270f0fe0b0766f1969bac97b1aeab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 35.0MB
        • SHA256 798f4d18ada69b569356ece7cd20f31ab1fe9178618cab7f55ad1c35929afa53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 60.8MB
        • SHA256 317ec55aa152ff5e57f43077f83383cbcc6aca063a016cd8aeb912fd26e31fb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 60.7MB
        • SHA256 77218c4e2f968ef145559302e1e54bcdb367171aa882cb74dff102294a566c18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 56.6MB
        • SHA256 4d544f1f5622012808fac79a50dce48a87341e85dfa8f594130e66dc07a8a149
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download