Overview

overview

10

Static

static

10

2026-08-12...al.exe

windows10-2004-x64

9

2026-08-12...al.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    148s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    12/08/2026, 21:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-12_d1a51b06136f3bfa776a578c2823702a_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
  • Size 10.6MB
  • Sample260812-1rtncseq2t
  • SHA256 01efc4c3ab6303f654086bc1e5892cb1e1754fd83e0187f56989858bde3b3eac
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecution

Malware Config

Signatures

  • Detects executables containing URLs to raw contents of a Github gist 31 IoCs
  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen 31 IoCs
  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Executes dropped EXE 4 IoCs
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in System32 directory 8 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Executes a command shell one-liner 1 TTPs 10 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 35 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_d1a51b06136f3bfa776a578c2823702a_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_d1a51b06136f3bfa776a578c2823702a_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe"
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4832
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      PID:4596
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4028
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:564
    • C:\Users\Admin\AppData\Local\Temp\2026-08-12_d1a51b06136f3bfa776a578c2823702a_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal~4.exe
      2026-08-12_d1a51b06136f3bfa776a578c2823702a_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal~4.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:624
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:1552
      • C:\Windows\SysWOW64\UpdatAuto.exe
        C:\Windows\system32\UpdatAuto.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:408
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          PID:4524
      • C:\Users\Admin\AppData\Local\Temp\2026-08-12_d1a51b06136f3bfa776a578c2823702a_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal~4~4.exe
        2026-08-12_d1a51b06136f3bfa776a578c2823702a_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal~4~4.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2712
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net stop sharedaccess
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4132
        • C:\Windows\SysWOW64\net.exe
          net stop sharedaccess
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1968
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop sharedaccess
            5⤵
            • System Location Discovery: System Language Discovery
            PID:1280
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net stop wuauserv
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:864
        • C:\Windows\SysWOW64\net.exe
          net stop wuauserv
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4972
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop wuauserv
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2376
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net stop wscsvc
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3440
        • C:\Windows\SysWOW64\net.exe
          net stop wscsvc
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4992
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop wscsvc
            5⤵
            • System Location Discovery: System Language Discovery
            PID:4020
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net stop srservice
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2716
        • C:\Windows\SysWOW64\net.exe
          net stop srservice
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4280
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop srservice
            5⤵
            • System Location Discovery: System Language Discovery
            PID:4472
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net start TlntSvr
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3184
        • C:\Windows\SysWOW64\net.exe
          net start TlntSvr
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4460
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 start TlntSvr
            5⤵
            • System Location Discovery: System Language Discovery
            PID:4336
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net user helpassistant 123456
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3832
        • C:\Windows\SysWOW64\net.exe
          net user helpassistant 123456
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2892
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 user helpassistant 123456
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2400
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net localgroup administrators helpassistant /add
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4288
        • C:\Windows\SysWOW64\net.exe
          net localgroup administrators helpassistant /add
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5104
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 localgroup administrators helpassistant /add
            5⤵
            • System Location Discovery: System Language Discovery
            PID:3276
      • C:\Windows\SysWOW64\sc.exe
        sc config srservice start= disabled
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:3380
      • C:\Windows\SysWOW64\sc.exe
        sc config SharedAccess start= disabled
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:3352
      • C:\Windows\SysWOW64\sc.exe
        sc config wuauserv start= disabled
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:1180
      • C:\Windows\SysWOW64\sc.exe
        sc config wscsvc start= disabled
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:4248
      • C:\Windows\SysWOW64\sc.exe
        sc config srservice start= disabled
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:4292

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 5.8MB
        • SHA256 2358a764e4682bf9d070e6b28a67dad1483d00a12a17e4f84d2393f5042ac27d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 11.0MB
        • SHA256 41b2639e73b058e1ad4442f88912c948d7b16fcdc260d35099ff70940fd18d1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 11.4MB
        • SHA256 b4fc390e7eab5a7597c4bb3c126c37a1370df06ce8e1713c2b8a470108449746
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 6.2MB
        • SHA256 9e7b58a23fce4f1005ffb7cb952983f4567673fe497f4eac8dc797bd6eb62712
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 5.9MB
        • SHA256 144bf421b338a138613943ce18f8467e3e3ab93a6b7c51e3919858c95617e691
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 11.2MB
        • SHA256 be45c62abcc73f89b436f632952d105f41dd9ef76fb4bbc660363126aee9bde6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 5.3MB
        • SHA256 5930a2ee3f5b38dbbb61e2ead0234d26dfacfbfbaf3c8e90acd1805043db93ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 10.5MB
        • SHA256 3b595ca29a42c43ed56423f702f6e907e122f5fd590c2424e094ef87ca4df1c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 7.0MB
        • SHA256 408100910fe80b20aa47d9e1a260b8d1154aebfd608a98dc6f47e43e24ffe93e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 8.7MB
        • SHA256 341c8e4524bbb96e9b6a3ce4b735bb839b84e6edbd7e760fce1f4b6d9b7c1d48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 8.3MB
        • SHA256 fdc4ff6cf58eff65c1afcdb6b76c92a645a0ddb05896d92c62a97e1df26b9582
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 13.6MB
        • SHA256 79e4418c0d842682163ba0aea5a654705b94cd47986abc86c239be9260bf509b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 6.7MB
        • SHA256 60b23befdb15459c8ca252e9374c4623a5f319d2002dc78f50c7eef585518ab3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 5.4MB
        • SHA256 b8fbb33f00da281f37842c6d2a8500067c4c2f462a2133206b1eaacfefaff788
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 10.6MB
        • SHA256 fb0eac6c3799ce9f3158764b3f048095b847c74251ad67f3102597ee802d97fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 5.3MB
        • SHA256 5827762095b461ff393bd3382267f89b52e4b47f61a143eac8ee73be6f23b11d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 10.6MB
        • SHA256 eea0b927d271502c27a7716a8947826f78803874fb4eb2e46b5b0041bbc68293
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 5.3MB
        • SHA256 b55ea88c76a1c2c806b72d01182ba709f51448d5cec71fc3d0f9de04f51d8a0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 10.6MB
        • SHA256 41b95bc8bbdbd3c12804139b14034713eb082987ba73900299701a5e9bf2ea1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 5.3MB
        • SHA256 6c8495026cfc5b20dc8b28f16b13f531e5404598afd1bd43c5ba33a62a5a4ae7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 10.6MB
        • SHA256 829e3e93df58e64661f055375a61b6350d06b934768c1acf9c13eddf82b99464
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-08-12_d1a51b06136f3bfa776a578c2823702a_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal~4.exe
        • Path C:\Users\Admin\AppData\Local\Temp\2026-08-12_d1a51b06136f3bfa776a578c2823702a_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal~4.exe
        • Size 5.4MB
        • SHA256 c4a586cdbfdba874761952f453e6ab85a443d70734961cb171fdfd6d78a5a805
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-08-12_d1a51b06136f3bfa776a578c2823702a_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal~4~4.exe
        • Path C:\Users\Admin\AppData\Local\Temp\2026-08-12_d1a51b06136f3bfa776a578c2823702a_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal~4~4.exe
        • Size 147KB
        • SHA256 a8141c11befdab81fd5b00c23b3fe6f5eb5782791f0ea7f922f034b0745affb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 5.3MB
        • SHA256 990c8293203b8a17aaceb7c72bdf3111ef246e22c5fba73c0ab01d709fb15179
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.3MB
        • SHA256 5f0a39bbc9efeb0b93f08a11ea6cb86453d7213f0675746a574b12931a1f81e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.3MB
        • SHA256 3ce84a13045df7d234cf60a9ea0ae18afc3676c9316985a60699334562dc90dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.3MB
        • SHA256 6491163f269d7dac569f9763f872014e18a690c50ab07ab4f2db5a0c42e2f649
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.3MB
        • SHA256 f7e95a192b44eeba484a42bbb3a75804594eb2524ab176e1f280ca92c097afee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.3MB
        • SHA256 8d002a595732a255b05acb4a3cfb5e353978a9eefe7b657763bca197d77e19bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.3MB
        • SHA256 ed4ca8dc9a670b3ddbb7b28ec652934d6cf4f2054fefbbf7649957762dba5095
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.3MB
        • SHA256 5837c57506fd65b7b48e962e5bb76f343ac3819eb83993d82d08b92fcb8ff96b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.3MB
        • SHA256 e28966ebbdb28cc336c61be03ddfea1e013aab80c3f200188af3be67fd8aee90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download