Overview

overview

8

Static

static

3

2026-05-31...al.exe

windows10-2004-x64

8

2026-05-31...al.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    31/05/2026, 13:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-31_5dfea79890b974e55034c2b30b454384_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
  • Size 3.9MB
  • Sample260531-ql2rnsbv3l
  • SHA256 72047593e443fd07adc8f43fb138a17dca843ce52fe4616e6934b894f16fc5b6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-31_5dfea79890b974e55034c2b30b454384_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-31_5dfea79890b974e55034c2b30b454384_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4120
  • C:\Users\Admin\AppData\Local\Temp\2026-05-31_5dfea79890b974e55034c2b30b454384_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
    C:\Users\Admin\AppData\Local\Temp/2026-05-31_5dfea79890b974e55034c2b30b454384_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3356

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 4.4MB
        • SHA256 f995001569f6d58bb4d94f65bed1af3178c46491b9a7a1fe7c08befc3b5a2b0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 4.8MB
        • SHA256 0d115ddba796688033fa80a0d9626acc118b6625033e085e90b5ca8cc9d9bf84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 7.8MB
        • SHA256 977b7aa8d4f864196b19656df2327c988e1f970f4748be561671f206b6f7f170
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 8.0MB
        • SHA256 e491c618a3f6194eb07d9697a34383fae959956da842614db3ad1c74ecd07567
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 7.8MB
        • SHA256 3ff26658e5e5d15f0b33b4be752cee531b53838be5112884c998ae40043efac8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 11.8MB
        • SHA256 b24f64e61b068a5deece65a3f73656c229652cb1e75759e9041fe6c4fc74948f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 8.1MB
        • SHA256 40272493a321a60953f0f36585c4ee8e762fe098e4a840c0ec9d1ea885adbd25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 9.9MB
        • SHA256 05d4751be9379e7023855ee877a945951bfc341b4b95ff9b45c4079997349873
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 7.8MB
        • SHA256 3ac002c8e3b1bd44bac0b2cf3106a517022439f428e46c474e4e43331822a40b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 13.8MB
        • SHA256 3d4853b459d0fecb7b8552b07a0bce54f3490c00792665b649749814411755d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 9.5MB
        • SHA256 dd1dd8719fb6656779f3dd29d11b3c28d8be01180bcbb76bb5d00c595bbdba92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 11.2MB
        • SHA256 470099bfccaa725d131c7d06e7ca920e9d86d8389037234714fed87400b0e8b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 10.0MB
        • SHA256 1f8999d6e6ea32f359244e3475ae87c5661d3d511fc997c50c68820f47106401
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 9.4MB
        • SHA256 14e5feb34a581b62505a0748eb4f221b4096dd3824031ed170dd85236134f749
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 9.6MB
        • SHA256 f03475396ec59a0eda7461ccc35ecb6d9f29198c87eb585322fad2364b60d834
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 10.8MB
        • SHA256 20642a78a05883286ccff2b051c4d4db41ea6837bd90f7c1049c0b2aeffb1018
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 9.2MB
        • SHA256 a89e98ab632dea8ba18226ad85e6de8de4d4fed73b0e6b27c391b786259906e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 7.8MB
        • SHA256 5b3b761ca963a736f5bb6212c583c402a2277b87cb768ba6c8729328c48d550c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 7.8MB
        • SHA256 54ebd2908782e06751fc8c597b7ac1172f66b90bca78bb23c503200e6f44685f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 7.8MB
        • SHA256 d43427a20e276d94a815ba400808836925e5c267c442c0852542239e62ee7d6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 7.8MB
        • SHA256 01cacba2998eb52ca9fd194c3b644d898ff9a3c81025d80faa35834337fadf44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 7.8MB
        • SHA256 a607ef10578368209e8865bdbaacf810877ebed2505b17ee35a8bf4559a78f38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 7.8MB
        • SHA256 a2d93780c5ab6f126349afc6ed47e88018168b442a95ae2cbdff975abe54b03a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 7.8MB
        • SHA256 4c3b78e21c8cb25290f2c3ab74920a8a3eb9d3035029f15400fb36b97403ca94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 8.0MB
        • SHA256 0f7bb17c984e5160fd4f5c0b6e5edb4491dd764563e82a9d15e2a66bea15ba72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 7.8MB
        • SHA256 d7bd55900784af604c0dbfb4545ec39c52a185a5c293fe4eb74c05c0395a9545
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 7.8MB
        • SHA256 e78db9bf874c22de85a49f9b6922995de4f9358d23aae3f9475636031dabb58f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 7.9MB
        • SHA256 de3060aae3062db122d5782d6c69b4901deef1995cd85e9a1583b97777af4387
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 7.8MB
        • SHA256 5bafd50ea8b44dd3057f6ebce86ccb78b37cc0480bfc9f2d6a2abc4789ba6190
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 7.8MB
        • SHA256 e114f40fe86705fee1beeaac6011e2a6ba6a19a8423b19f64c63644b38bb55de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 7.9MB
        • SHA256 f489cfae8eed43056fecaa89bd63623d6e9dd1c8f81ea542a03893e2c0620038
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 8.0MB
        • SHA256 8b0b1978afa65d7fb05210b096f0106a558d52bd4b17462b1079ee2bc667f4d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 8.2MB
        • SHA256 498b1dc844252ea61b6d45f224628bdb65e23899ae154c4c816d48e697183067
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 7.8MB
        • SHA256 36ca435a6db585c0397621ac0f88b394d98b7172ee51212da80a873fe74124c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 7.8MB
        • SHA256 d6da410fa333149d92ef057c051a9e160d7a9aa446339da20a16acf76de822f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 7.8MB
        • SHA256 88505978e045f0cb5b25c3635f54fa7ec13076d2031ec8fb42005dc1c2ac463f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 7.8MB
        • SHA256 e8c0bc7c0c666526de2e0c5db988705d592732a99ceeaf94c04a7935a229f991
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 7.8MB
        • SHA256 c2891eb90c99cfeae781f68352aec7d5e4dfec8e9075a5b05ec7a4aac2655615
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 7.8MB
        • SHA256 3f39ae169213c8e54898de8b54e2b5f73d921e6e27aed9833edf95ce468b1e64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 7.8MB
        • SHA256 b7a7545352a71a1a8e744559ee03b80a65dc8490248cff945fac5d1ad3e38860
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 7.8MB
        • SHA256 d4feb17aac09f2a0a7b6e4b58f194d7bf1fdbdb86fdb7e8a0b5882f4fcb8bb9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 7.8MB
        • SHA256 aadac672e6a11e85b9f17193c6f0e8224ac7f9b7ef60e18a5a3c5f79b8a6e410
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 7.8MB
        • SHA256 c7645526698bfe63c72eaaf72dc95dbe57e052889b12d25f47e68b0b65266ecb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 7.8MB
        • SHA256 0d38380edfdc566d2eea2da8c8e9cf5865bc106836ed09174d33f17842f5efa5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 7.8MB
        • SHA256 8f3361bb4ac43bb7e8b84307a82c1dad84eb44e31b575cc56d0b13d574bdac4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 7.8MB
        • SHA256 353862e73db8027a65522f8802b6b02c8d494ccdedfc2d657b3fe75502a0008d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 7.8MB
        • SHA256 050b0ea7a7a049f51e466d7c58ee02680047c59b4546afe2b4c76be4a8f91e65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 7.8MB
        • SHA256 d75c2495c1fb6bd6b07f90ac7d83ff4849f9a9a6eb4c9be9fa4f8cef5250ac0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 7.8MB
        • SHA256 8e1e7ebc2562a790c35276b377d330572b1571795141daf9a006b9c77bebc998
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 7.8MB
        • SHA256 d94caabd6f81bd2c560c8a955d56cbb8f8a0562efde99da4b59606cb8fe8d98c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 7.8MB
        • SHA256 24ec369ab38dd41c2419c707a58faf6d4a94bd6aad881abb964d5d192fb65fc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 3.9MB
        • SHA256 eb5527b9343ba2e16ac8f5398e0b91c94755bc4ceea880098cc9bb5e7c34e7ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 7.8MB
        • SHA256 2ed556932d302b9ce6700504393c020aa318237cd3f882d285ecc17c238ea51a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 7.8MB
        • SHA256 cfcc07767750b499a423517d6cd4a0754a6800e0dc419e2460410c5ee92276fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 7.8MB
        • SHA256 e8d1e67cd58f136fdc9cd25108cd5167cf24cd3f16bc0982c7e6260abb936bee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 7.8MB
        • SHA256 0bccc39f055da36067c96dc088644a26900e7c5b3bf7257cc0580a54fd7cdbd2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 7.8MB
        • SHA256 a9d6bd6a1bab3b73ab1d9d297dd0509c40767097b9b56e667264175914a9afd8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 7.8MB
        • SHA256 68a6ad8579be7966426a98947c04a6ef88b9b83c74b88e032b73fdd3777f0a9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 7.9MB
        • SHA256 bb198690af6742325009a5f192fdaffbb86a4d135e0823f07f94aa8adca417c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 7.8MB
        • SHA256 4f013a6c737c6c8e9ff9223008c9b701aa28429cc07aeb82a4ca533c2ca44e48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 7.8MB
        • SHA256 8cff98b82d48f230a5f66c8a43e3238698e78a31353a944005f43e854c139a15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 7.8MB
        • SHA256 b5191127abeb3efbd5f8c5513247f85e6b0cb38af9293f0a33d41d71eae776fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 3.9MB
        • SHA256 72047593e443fd07adc8f43fb138a17dca843ce52fe4616e6934b894f16fc5b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download