Overview

overview

8

Static

static

3

2026-08-04...al.exe

windows10-2004-x64

8

2026-08-04...al.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    39s
  • max time network
    135s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 23:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_06094f46a4023e489d1ab7259a788eff_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
  • Size 39.3MB
  • Sample260804-3fagfstajf
  • SHA256 8962f312bfc7513453931a7cd8ab7735e72c630aae9e72b8e968217fa9b50daa
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_06094f46a4023e489d1ab7259a788eff_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_06094f46a4023e489d1ab7259a788eff_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:6036
  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_06094f46a4023e489d1ab7259a788eff_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-04_06094f46a4023e489d1ab7259a788eff_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5088

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 39.6MB
        • SHA256 a00e5089b76d6258972e4077e3331f5e7f37a4f463c63df0f9185acd9309fd79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 78.7MB
        • SHA256 f2255e4b371f68c7ed29c7fcaad2b419eea22939cd56978eebc9ccfac65951da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 79.7MB
        • SHA256 492c2ced892c455a058ed643beb222cb9784410fa878db746e542146bc2ae918
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 77.5MB
        • SHA256 6a4dd5f06ef032081f9a1d6104466b2a7cf0056ee074cd92ccd7a2fd5a562922
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 41.4MB
        • SHA256 8aaffcf2d4ce994b8f9bf17eff839c30c7b7b08fe6bd8eba4d821ed33f9848ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 75.2MB
        • SHA256 f81567bb7e0a3af4c5f436eafc0bdb6707721ed9521103150403a300b58ed508
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 63.9MB
        • SHA256 46c9eb7b551eb33a49bd6a0eeb8f32745586b4bac7c5f6a707e040042b565641
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 62.5MB
        • SHA256 5236435546137c6ad7d01d37e2cd3f53caeee4fc9557b8c404d96a709344f973
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 66.8MB
        • SHA256 c62f50eda8d91ec52b5fef4299413d16861d51869762bf7a9fb9735970ad4bf4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 64.8MB
        • SHA256 ee141ab867ea15587571f6c4129c38dfc8527bea5c1d119a5840db4d09fca688
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 65.0MB
        • SHA256 61dc8e3cccc8480dedfb832b40944d58c17a3fef7ba623f5c3fa87c975173dca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 62.6MB
        • SHA256 7b7876c5c658881f2737d091d7927b2b643c0b19a6fd4ff3e36eeb629587ff6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 60.4MB
        • SHA256 a211a76edffa84efecebd770c198f5dec16fd6884e32bac0d34a50a331ce7650
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 58.9MB
        • SHA256 d4e9f09b13db75e7c473ff1d363cbf484e51954d0994f10ac571c04d04ac602f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 55.8MB
        • SHA256 f2563d31aaf76b93bc036d2242385c34006f6efcb6fc6d1b1bf83e5752c240a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 54.6MB
        • SHA256 e985888184f9ef92e5acdfa127fda2f1a69f4d25b36aab6aa7e26c0cf780050c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 51.9MB
        • SHA256 8a8de68e4f4f0b73c59ead06268a941560a7a643caf727772e93957abadaf651
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 50.1MB
        • SHA256 329fa5b0231a8a46b63c22e777928a4ea77d87c5735f14c9671b69e405a5b714
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 48.5MB
        • SHA256 5c6e8aaa1607264b6fc56d5ee6f59e31888cc40d29187e3e736b83bf744b2e3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 46.9MB
        • SHA256 f691f9df8041c3a0d4e21124b1fb87932c18174ad8bd2698c0e736fa56754fec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 45.9MB
        • SHA256 4ae4c6583d9739fa650c52ac45cb6a23b6dbf6bcdd6338cdc6d63ade3591a832
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 45.4MB
        • SHA256 5c70a55ab0acc03acfaecb0ef3389f630a1a46e28c58ad945dc0e8d29c6154c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 44.4MB
        • SHA256 f1f97b0e630863ac55b79d560c095349d5cb835c66c032b9f0bb8a691769d617
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 43.6MB
        • SHA256 3b8d2ce63f75d13f6f2a9e0c56a775ba6d6c0b33ca707b5f556921d2d5e08365
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 42.2MB
        • SHA256 a047ff1f81b22b400d151e65963bd7684a22ada8e815d1d8bf05375477660375
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 41.8MB
        • SHA256 3bfd33eb4abab0ee411f3ec52448f5f6e7096481b03dd286fb89d70196f8d179
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 41.6MB
        • SHA256 5450a4cb2bdab89dac4f96f4646f90de81ccf68adc2f1440083d26e50cc4c714
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 41.4MB
        • SHA256 03b29a2fd6dceb56936524891e057b16bc2ae25ae2e4476c3e019a5946c6801e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 41.1MB
        • SHA256 874c0285aebf1a50e31edc8fe09c25c61319a405bb985bad5fe88efa870654c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 40.4MB
        • SHA256 4f8cc96799513aef5750c7c57ca1f23eae66705135607a00b7702fefc67edd58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 40.2MB
        • SHA256 c5a4d2df87067c1237d1c13a9b28cbcda0c738b11a4b29c582534243ab33d6f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 39.8MB
        • SHA256 0b71dfeff751e35e2360c23bdb82b05ba9878ff09ab74aadd42ba1413e3886ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 38.8MB
        • SHA256 e876c8e2abb547c458ea477f8334f60bb69a04221453053958bd657ee0e9f808
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 36.6MB
        • SHA256 08154725adaf2d12726b76694113cfd3bcd1b4619cf286b6cfdebd08693eed53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 35.6MB
        • SHA256 45e6851f2643f7dbb998c8e152a0bf14d29cfa1977a3b05728992c796577257c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 34.9MB
        • SHA256 70a8b46ab30c34ddd86b659b437f240e4e8ccbe5a94f699ab87c06e2f77c975c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 74.1MB
        • SHA256 08485ede169652685817d915337ed951c55b39aa032aa6c8fe5070ac47d38193
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 70.1MB
        • SHA256 71a6e85aa0c015a047b8e1583e8060a49b5db3cef1698812a8cf5ecc999aed5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 69.1MB
        • SHA256 dad3438478bca55240414899c3cf7066a36ae597569050f6bf4d434d7997e1f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 68.6MB
        • SHA256 b158fb55be1bfe92a77601e4edabf8666b73913deef7a189544163d9eacca662
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download