Overview

overview

8

Static

static

3

2026-06-06...d_.exe

windows10-2004-x64

8

2026-06-06...d_.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    06/06/2026, 14:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-06_b47150af6fe3cb6f0cdf06f76ef24f1d_akira_amadey_cobalt-strike_elex_emotet_glassworm_icedid_.exe
  • Size 13.7MB
  • Sample260606-rnfgwsgz41
  • SHA256 72e03286874ddb9db7cba2ad5ab28eedeb76c1862b5bf88b35f11f1c39aa082d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-06_b47150af6fe3cb6f0cdf06f76ef24f1d_akira_amadey_cobalt-strike_elex_emotet_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-06_b47150af6fe3cb6f0cdf06f76ef24f1d_akira_amadey_cobalt-strike_elex_emotet_glassworm_icedid_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2360
  • C:\Users\Admin\AppData\Local\Temp\2026-06-06_b47150af6fe3cb6f0cdf06f76ef24f1d_akira_amadey_cobalt-strike_elex_emotet_glassworm_icedid_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-06_b47150af6fe3cb6f0cdf06f76ef24f1d_akira_amadey_cobalt-strike_elex_emotet_glassworm_icedid_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3284

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 14.4MB
        • SHA256 34531d0d6f69e1875020ed2536fe66f1a425d2676c93a2264594db837aa85b3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ConvertFromStep.htm
        • Path C:\Program Files\ConvertFromStep.htm
        • Size 27.7MB
        • SHA256 8e18f4a6a0354943c258cad4c8bba40cf25508f8a762c1d87e72ba143f21d779
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 33.4MB
        • SHA256 caddfa572a3182d4111df2cf9d3fddbb18015bf703c65e479ea258167dcc0c8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 29.1MB
        • SHA256 cc26b321baa314efe400f95cbe008047f9629cb2eea9a049d6a15a78c4e386f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 30.9MB
        • SHA256 18ab0323213e9f3b8e71c8aa9662fec94f216fc08740f9fe745d422034f506ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 29.7MB
        • SHA256 eccb40a2d3a24aaa630228b49a33ee12626d8ffb08e1857e0156566c41fb5a5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 29.0MB
        • SHA256 223ac16b186cebe9f17174f79cf3db78002aa2eaadfef72382ba57b1152f5f81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 29.2MB
        • SHA256 10f5f2253c89c21e4a674b91fa9014b2eec813bcdb379664c90be5c62ce17179
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 28.8MB
        • SHA256 0de208affc04c73446481e6789a788b31a90b611193d519fbed5c19e499b10c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 27.4MB
        • SHA256 9b01ce721f8a2339a0f6952dc2b5fcc458a1026d7e22b3739fe6bb6ec0993c19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 27.4MB
        • SHA256 9848116840999be0db3b55d53b436bb29018dd7202aae91be01642cfa7092cc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 27.4MB
        • SHA256 7851e8a8f7d2c55acff718c2e2aace6aec059efaa3b6be5f60277c2d9ef1fce8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 27.4MB
        • SHA256 80274d4924bfebb23bf6af1c4f2346ae8f633f3f0e97cf0c6079b8c48502754e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 27.4MB
        • SHA256 b880b095a8d3533c88cfded435a32c837c15c03e261f6a489030021870fb999c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 27.4MB
        • SHA256 64ca364178c29e63e07fa2f2294b9025be2e7a100b6c07b2507cdc07b595b4dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 27.7MB
        • SHA256 cf7da5cd4be6888df17a64342895568c072b0380afae7f75a4fdf9848495a8b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 27.4MB
        • SHA256 737ea966f9a7cdc690588a9bf6737ca11bc7eadfc1f3e4cd36219a340078f073
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 27.4MB
        • SHA256 d574eedc5ba176068cdcbbad4cb67c15cf7b1bbe0320242bab59986f945cbbef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 27.5MB
        • SHA256 a48365eede321f6a4772667c81e83965b4e6c15f22c9b6311e46b7a246ea886f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 27.4MB
        • SHA256 5114b1598898ad9a67c8bc0b872b4dfca8fd585f7f4b91895679d22e69d2fdb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 27.4MB
        • SHA256 463e0ddbfb259e205a2cbae46b26d40651f742930ef29637b8fc0932a8372f6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 27.5MB
        • SHA256 b9b6fddd29597bd7da1bc227af1a623e6163304750be8f86efd7ea844ab51809
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 27.7MB
        • SHA256 83071201054c262ab701964efee21dc70cb8b4a3eb19c0f6420150cdc4acc687
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 27.8MB
        • SHA256 ff0e618fe9485abe74487bd8f4aa3432a3187f1b61b23815d81f470a02332e8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 27.4MB
        • SHA256 85b248e821e6fa00f0edf3a79b9ec5fe68a3e8f6b268a4fb9df1e2c800a627da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 27.4MB
        • SHA256 abcd1c9cde147d78fe11809e9125ec5df0e096a35fbf22b951cfe36b311402fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 27.4MB
        • SHA256 489240140e74a2264599063f09700df0a8af571f373559ccd9d42573d039a40d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 27.4MB
        • SHA256 4d4ee8df7cc6c5fc402f3568be9774d0220b82744f40abbce64685d242bd517b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 27.4MB
        • SHA256 358b8f794f8a576a5bfb5c470d4d0d6ad7aeacc1a528054655894e232275a552
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 27.4MB
        • SHA256 d065ddcd29b47fe683ed4758c55c293b1b689838ed62a5fc1bc3bbc59085c75f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 27.4MB
        • SHA256 3b5b67c780233fede59a7bafad989fc6b585a069932dae0055791d1eae405718
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 27.4MB
        • SHA256 71d1e1004e1f3aaf13f2b5e97247c4aeffd7f0bfe50485b4723062df05ccc9ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 27.4MB
        • SHA256 a557f3c4b6a23be94de85c1ab9b836c294fd009f75dbf452b52265f1248a0262
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 27.4MB
        • SHA256 f98f36a0c43f9022c4298e4a3076ef1611de5356b7396d919ed2cd45f67c1c19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 27.4MB
        • SHA256 7383a534809ed6d9ab7ef8d43a98213072bae05e6f69fa88f9a186101f03f07f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 27.4MB
        • SHA256 d88f8f4e7af555769bcff792282dc3bb7e56de28087b1bea950c5e50fe2f1bf0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 27.4MB
        • SHA256 c2892eaf88e599232a37845cbb3d7f9073a357c1534d0ce095ed082179405183
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 27.4MB
        • SHA256 7d85eacbdd2fcbcacc9a8c49cc6fc548c857c57e32d074d5f7afb4864bf05b0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 27.4MB
        • SHA256 d7458e78b386eb17f8cdaae94c8cd376e3fb58ffff438fad744f823d6940dbb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 27.4MB
        • SHA256 9748275dc5522daa16eb4341570a2dd99c1c5e545fdcfaa5dbe0e0f9398f6218
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 27.4MB
        • SHA256 8f6b51448543c52428aedd7e3a38df2b14a9309b845d18723b603f7643dc5e7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 27.4MB
        • SHA256 43367251b9effd12409842bc4106927767e995bd23a30a2678a28d72135f0903
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 27.4MB
        • SHA256 88e90cab762d63896c1dde63983c32bd023df2d4758e34a9556f76dcb3e7b5a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 27.4MB
        • SHA256 ca33a38c4c0cdb648f2785094ffdf5fa7a2fd6433fa6fe6b256d3c5818d76a36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 27.4MB
        • SHA256 5d79399e47888111ab946e1b4137d0c2422200af51d94ffb233f287c2e60ec6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 27.4MB
        • SHA256 41fbeef5a2f4558976b280cd3e5def22ba6c4ee5ad60811d0bcad892e359681c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 27.4MB
        • SHA256 7a8d10c6c52781e8d65945ed46981c1aadc9ca84a383ea1062c96d384d655559
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 27.4MB
        • SHA256 d4c599fbf836e9925d82eea3608e1a27ab5f13720bd8aa2bd8b064257ca0a708
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 27.4MB
        • SHA256 a4a3a1996c2810805bc462061d8b0794653cb74d9c4ed2ca06031adc36af2add
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 27.4MB
        • SHA256 f0a0da9a3f00b5ede1897a452de5c72a6a01e0c471ffd974f5536bb55cf5ac7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 27.4MB
        • SHA256 75f30fac1a3aeb9a070151828e2cb5852581c5335b37381180067c817ab97076
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 27.6MB
        • SHA256 d6c8d53c2f01e5cb20788a8b7a4c3f626f0383d492a7babe669b59ced9ae9056
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 27.4MB
        • SHA256 f38fe6b8199096f94a9513879da622f9a5dcb47092936ffc41506f5fd6e04f93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 27.4MB
        • SHA256 ccbeb6d9f6526b2fa6e8d09bc133ff501ef8bc8be6b6a50580c94d8632e3ba42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 27.5MB
        • SHA256 0e716fddec6936d4962045147e7668db5f10aac9be3530ec6a51c6dd8dc4e0b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 27.4MB
        • SHA256 048f9268d5cc843e5d2631317297b08d34c36ecbf8576cd2e0c248b7281e296e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 27.5MB
        • SHA256 e02fedd4d07b7bf9ac3cf2e861d54d4d36bbd90a0c33409db6b8e75b213d2fb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 27.4MB
        • SHA256 87dc094547cfa479ee0f10a9afac67314e1f2e3c7318404be32c38b1ecb61782
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 13.7MB
        • SHA256 72e03286874ddb9db7cba2ad5ab28eedeb76c1862b5bf88b35f11f1c39aa082d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2360-85-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2360-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3284-147-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download