Overview

overview

8

Static

static

3

2026-08-04...al.exe

windows10-2004-x64

8

2026-08-04...al.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    145s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/08/2026, 23:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_06094f46a4023e489d1ab7259a788eff_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
  • Size 39.3MB
  • Sample260804-3fagfstajf
  • SHA256 8962f312bfc7513453931a7cd8ab7735e72c630aae9e72b8e968217fa9b50daa
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_06094f46a4023e489d1ab7259a788eff_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_06094f46a4023e489d1ab7259a788eff_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3676
  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_06094f46a4023e489d1ab7259a788eff_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-04_06094f46a4023e489d1ab7259a788eff_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3864

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 40.0MB
        • SHA256 e316b11db6a4f30624d2069666d905668a78dd128b33b758c85e9573153a3757
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 39.5MB
        • SHA256 5b7a08b1c88b671ad5a7efde75c68d748de69d914cd6e631fbdd3408d7ac52f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 78.8MB
        • SHA256 7aa343f58dc5a302ddaf3ebe77a47b9b20e1e5449aa1ee307721fb937742c2aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 78.9MB
        • SHA256 42015056e4b02c6748b674c5908ce72f83d9ea88a649d3da5c0e0b2595bcbde2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 79.1MB
        • SHA256 b874b47f7bd50613763632b6404f2cc83d88e2d8c1124d82348a6c1e1a1b64ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 78.7MB
        • SHA256 57f9d6d0314af548f642cbc28fab95e4760237662f3bf5e32232b8360ccda6eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 78.7MB
        • SHA256 ba6cd5d62978841c0cb9fde07683322f0d9c0220b60a4b850d396d00c7fbbf82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 78.7MB
        • SHA256 32a93340654f4feb3f0d93f84aea550db6c2b23972149932443d078f243c670d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 78.7MB
        • SHA256 a99a2f303809599116bb82d16cbfe8030d8df109684663cb0aeb245fd5a14f87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 78.7MB
        • SHA256 8cb27a95acb4a422038fb55156b0e4fba74fd1e5df9df41cbb1f0afc67a5e848
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 78.7MB
        • SHA256 c818122b42fd40f8e5068cf66e9c94131e3824c5b15afa1fa38143e20abda23a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 78.7MB
        • SHA256 012c8ccdc75286272aebe1c411f926392d5ff1f22a422148cb06799a3e47be49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 78.7MB
        • SHA256 f079caa575b65e4049a64b5453391ce067443ddeda1a54e0a4382e5847cf90d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 78.7MB
        • SHA256 efd0a48959c1ed9e22f70bd8e17457f0603e645a2553ab3bfa588e78261bcae1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 78.7MB
        • SHA256 5aedd11eec0fc9bd07e999fce8361242e0b4581ab7c24b47a21838349c9bb680
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 78.7MB
        • SHA256 4c5b964a3c165af293c7b731bbe8610411be32a916efd2905d2676d8203e57b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 78.7MB
        • SHA256 959b7110d14fdbada71e084483d6a9229b2a02dbf8b146c01122b98ee0277d19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 78.7MB
        • SHA256 a5b5cf574ff8ec8d007e360cd4a1200a8cf5ae28013170761cb00de80e04cb79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 72.5MB
        • SHA256 219a0ded0f20f5eaec177d28421e1f8afa530b618da671383b4393969219fe0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 73.4MB
        • SHA256 3d27a64187c3f2781b08326665bf78313b244706b0e1fde39acfffc04fef5c58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 70.5MB
        • SHA256 a0fdbafe855e21a417ad507bad77964e14747588e1f4aa16efc913c77a7c3bf9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 62.5MB
        • SHA256 5236435546137c6ad7d01d37e2cd3f53caeee4fc9557b8c404d96a709344f973
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 54.6MB
        • SHA256 37919a1a809980003510ba3ca9bfc64003098a2ea57b9eef68ea3ff00b5a9060
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 52.2MB
        • SHA256 c85d8fcc594e0ee3601fe26d8220692d078c6e2a5e27c09f1402c3acdb6d73ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 19.4MB
        • SHA256 d4bac95f83405dd8f4558a3c4e1af99ac79829ce8b83debeffdacc5c63c8a48d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 39.5MB
        • SHA256 06ab413f6bc18d43f8e1c2e89fb2c498f1c9c93ef4817fbe956b9215b1174396
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 39.4MB
        • SHA256 19d957d66b7df67665cdab94066f328970419f166587b6b3e78c65d524246ccc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 39.3MB
        • SHA256 8962f312bfc7513453931a7cd8ab7735e72c630aae9e72b8e968217fa9b50daa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download