Overview

overview

10

Static

static

10

2026-08-12...al.exe

windows10-2004-x64

9

2026-08-12...al.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    12/08/2026, 21:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-12_d1a51b06136f3bfa776a578c2823702a_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
  • Size 10.6MB
  • Sample260812-1rtncseq2t
  • SHA256 01efc4c3ab6303f654086bc1e5892cb1e1754fd83e0187f56989858bde3b3eac
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecution

Malware Config

Signatures

  • Detects executables containing URLs to raw contents of a Github gist 29 IoCs
  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen 29 IoCs
  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Executes dropped EXE 4 IoCs
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in System32 directory 8 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Executes a command shell one-liner 1 TTPs 10 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 35 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_d1a51b06136f3bfa776a578c2823702a_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_d1a51b06136f3bfa776a578c2823702a_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe"
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2524
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      PID:2392
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3432
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:5092
    • C:\Users\Admin\AppData\Local\Temp\2026-08-12_d1a51b06136f3bfa776a578c2823702a_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal~4.exe
      2026-08-12_d1a51b06136f3bfa776a578c2823702a_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal~4.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2900
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:3400
      • C:\Windows\SysWOW64\UpdatAuto.exe
        C:\Windows\system32\UpdatAuto.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3824
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          PID:5788
      • C:\Users\Admin\AppData\Local\Temp\2026-08-12_d1a51b06136f3bfa776a578c2823702a_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal~4~4.exe
        2026-08-12_d1a51b06136f3bfa776a578c2823702a_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal~4~4.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4780
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net stop sharedaccess
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5968
        • C:\Windows\SysWOW64\net.exe
          net stop sharedaccess
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2468
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop sharedaccess
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2196
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net stop wuauserv
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1936
        • C:\Windows\SysWOW64\net.exe
          net stop wuauserv
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1844
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop wuauserv
            5⤵
            • System Location Discovery: System Language Discovery
            PID:1688
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net stop wscsvc
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3024
        • C:\Windows\SysWOW64\net.exe
          net stop wscsvc
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2740
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop wscsvc
            5⤵
            • System Location Discovery: System Language Discovery
            PID:1776
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net stop srservice
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4412
        • C:\Windows\SysWOW64\net.exe
          net stop srservice
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2616
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop srservice
            5⤵
            • System Location Discovery: System Language Discovery
            PID:3532
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net start TlntSvr
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3748
        • C:\Windows\SysWOW64\net.exe
          net start TlntSvr
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3260
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 start TlntSvr
            5⤵
            • System Location Discovery: System Language Discovery
            PID:628
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net user helpassistant 123456
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5356
        • C:\Windows\SysWOW64\net.exe
          net user helpassistant 123456
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1768
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 user helpassistant 123456
            5⤵
            • System Location Discovery: System Language Discovery
            PID:3104
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c net localgroup administrators helpassistant /add
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5860
        • C:\Windows\SysWOW64\net.exe
          net localgroup administrators helpassistant /add
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2200
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 localgroup administrators helpassistant /add
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2696
      • C:\Windows\SysWOW64\sc.exe
        sc config srservice start= disabled
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:1056
      • C:\Windows\SysWOW64\sc.exe
        sc config SharedAccess start= disabled
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:236
      • C:\Windows\SysWOW64\sc.exe
        sc config wuauserv start= disabled
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:124
      • C:\Windows\SysWOW64\sc.exe
        sc config wscsvc start= disabled
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:248
      • C:\Windows\SysWOW64\sc.exe
        sc config srservice start= disabled
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:3920

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 5.8MB
        • SHA256 2358a764e4682bf9d070e6b28a67dad1483d00a12a17e4f84d2393f5042ac27d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 11.0MB
        • SHA256 41b2639e73b058e1ad4442f88912c948d7b16fcdc260d35099ff70940fd18d1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 6.2MB
        • SHA256 9e7b58a23fce4f1005ffb7cb952983f4567673fe497f4eac8dc797bd6eb62712
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 11.4MB
        • SHA256 b4fc390e7eab5a7597c4bb3c126c37a1370df06ce8e1713c2b8a470108449746
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 5.9MB
        • SHA256 144bf421b338a138613943ce18f8467e3e3ab93a6b7c51e3919858c95617e691
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 11.2MB
        • SHA256 be45c62abcc73f89b436f632952d105f41dd9ef76fb4bbc660363126aee9bde6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 5.3MB
        • SHA256 5930a2ee3f5b38dbbb61e2ead0234d26dfacfbfbaf3c8e90acd1805043db93ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 10.5MB
        • SHA256 3b595ca29a42c43ed56423f702f6e907e122f5fd590c2424e094ef87ca4df1c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ClearEnable.exe
        • Path C:\Program Files\ClearEnable.exe
        • Size 10.6MB
        • SHA256 ae39a35d1c88d81e4a1afb4c06e6f1282bb176f4e9890380fa71a9dae2a3767a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ClearEnable.exe
        • Path C:\Program Files\ClearEnable.exe
        • Size 5.4MB
        • SHA256 33492416c01c5df906e006658a5968c126e9c4d59f7923e523d079de744a11cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CloseConnect.exe
        • Path C:\Program Files\CloseConnect.exe
        • Size 5.5MB
        • SHA256 1bf92ad2f10e5dd3fca2cb66a889050b0e95472f178bd7c24ca2085f88ee830b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CloseConnect.exe
        • Path C:\Program Files\CloseConnect.exe
        • Size 10.8MB
        • SHA256 0c3c20f9f6cc8aa98806f7fdc8ba4192612ac876c0fa7bdfdc31311589f880d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 8.3MB
        • SHA256 fdc4ff6cf58eff65c1afcdb6b76c92a645a0ddb05896d92c62a97e1df26b9582
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 10.6MB
        • SHA256 fb0eac6c3799ce9f3158764b3f048095b847c74251ad67f3102597ee802d97fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 5.4MB
        • SHA256 b8fbb33f00da281f37842c6d2a8500067c4c2f462a2133206b1eaacfefaff788
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 10.6MB
        • SHA256 eea0b927d271502c27a7716a8947826f78803874fb4eb2e46b5b0041bbc68293
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 5.3MB
        • SHA256 5827762095b461ff393bd3382267f89b52e4b47f61a143eac8ee73be6f23b11d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 5.3MB
        • SHA256 e13ec457d3b7f46fb655c037832e1025faf79ce5333d05e7bf21e642f3fb7a3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 5.3MB
        • SHA256 6c8495026cfc5b20dc8b28f16b13f531e5404598afd1bd43c5ba33a62a5a4ae7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-08-12_d1a51b06136f3bfa776a578c2823702a_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal~4.exe
        • Path C:\Users\Admin\AppData\Local\Temp\2026-08-12_d1a51b06136f3bfa776a578c2823702a_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal~4.exe
        • Size 5.4MB
        • SHA256 c4a586cdbfdba874761952f453e6ab85a443d70734961cb171fdfd6d78a5a805
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-08-12_d1a51b06136f3bfa776a578c2823702a_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal~4~4.exe
        • Path C:\Users\Admin\AppData\Local\Temp\2026-08-12_d1a51b06136f3bfa776a578c2823702a_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal~4~4.exe
        • Size 147KB
        • SHA256 a8141c11befdab81fd5b00c23b3fe6f5eb5782791f0ea7f922f034b0745affb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 5.3MB
        • SHA256 990c8293203b8a17aaceb7c72bdf3111ef246e22c5fba73c0ab01d709fb15179
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.3MB
        • SHA256 f7e95a192b44eeba484a42bbb3a75804594eb2524ab176e1f280ca92c097afee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.3MB
        • SHA256 ed4ca8dc9a670b3ddbb7b28ec652934d6cf4f2054fefbbf7649957762dba5095
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.3MB
        • SHA256 3ce84a13045df7d234cf60a9ea0ae18afc3676c9316985a60699334562dc90dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.3MB
        • SHA256 5f0a39bbc9efeb0b93f08a11ea6cb86453d7213f0675746a574b12931a1f81e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.3MB
        • SHA256 6491163f269d7dac569f9763f872014e18a690c50ab07ab4f2db5a0c42e2f649
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.3MB
        • SHA256 8d002a595732a255b05acb4a3cfb5e353978a9eefe7b657763bca197d77e19bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 5.3MB
        • SHA256 5837c57506fd65b7b48e962e5bb76f343ac3819eb83993d82d08b92fcb8ff96b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~8
        • Path \??\c:\ntldr~8
        • Size 5.3MB
        • SHA256 1f721c5575a71c51ea11c27947cc8ca8a4a494a94238fe395cad2102cd570a3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download