Overview

overview

8

Static

static

3

2026-07-18...al.exe

windows10-2004-x64

8

2026-07-18...al.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    18/07/2026, 06:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-18_dfa6579a4ba351eba16f491bd72b4d67_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
  • Size 6.6MB
  • Sample260718-gswdssh13k
  • SHA256 ad696f6e74248caec41fbe08fb46db9b4120a0f828b283c60cf32bde0d986e9e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-18_dfa6579a4ba351eba16f491bd72b4d67_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-18_dfa6579a4ba351eba16f491bd72b4d67_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4552
  • C:\Users\Admin\AppData\Local\Temp\2026-07-18_dfa6579a4ba351eba16f491bd72b4d67_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-18_dfa6579a4ba351eba16f491bd72b4d67_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:864

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 7.1MB
        • SHA256 0734c13a52c5d0198f6e990a931e85b6d3bc69d381c2597d622f6279dedc1bbd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 7.5MB
        • SHA256 fad72421519c32c1104e7cf89f3e85d396bac278a4f3f44e8fe34255ed680ca9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 7.3MB
        • SHA256 0945978b3b2b71f606e77edcb2d084e9853ca7231634901b9cd594e55f6efc27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 6.6MB
        • SHA256 72a2e291271af2fea15a2f1293564f9b87dcf3d438b2aacb033ed8652858d6f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 6.6MB
        • SHA256 6c7fcdd6f27c3664152b01d0968cb7467c5c37b82822496c18b8a9118daefcb8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 6.6MB
        • SHA256 516e53805dffd92df77997aae8f059a3e1a232c22d60e48fdf124b940744364d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 6.8MB
        • SHA256 c00ce7db3859c3d26427b318db3e517349e9c7d5ca8b60207dbc74a8b78b7a27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 13.2MB
        • SHA256 3ca9361b5c7a5a9fe0c273503eb1d7ebaa1f177cd5c0deabcf87a049fb9b9afb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 13.4MB
        • SHA256 bb8fd89605e6be3e66ae95c529cf9cd73a841475de842e7e69f4fb5dbe89d0d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 13.5MB
        • SHA256 89576ff304677e44dab6bad3bf045b582dd15a25ca6b7c63bc02329e85e8cfdd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 13.6MB
        • SHA256 1d5ac6b34a0a1092e1c39ac978595d04b9a3affbb9592eb11929925f1d8dd5bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 13.2MB
        • SHA256 21729e1e6431c465e9703d22769011067b4f60cab6bbb9d0d38d1e068bf4b48d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 13.2MB
        • SHA256 7538f7f88db6faba287e5f7c0b9c6d3428a6307ee44856fafa00c5834a4b3038
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 13.2MB
        • SHA256 dca8debc60350f498aca0b1554c9d7fd38d33a84cb9b6b792025a643ff0f5d12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 13.2MB
        • SHA256 e6be4790e201142856da02894fb2a2a69ee6d4cc1102c2118763b9b71adfc8ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 13.2MB
        • SHA256 5c9b1eec9aff40025164e0f043203477dbd7150483b6b033a549065571d4e4ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 13.2MB
        • SHA256 fa21fc8e7e526c2ff4e0522b9a0bbfe2eb887ce3acfed998fb5ebd4e930c5216
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 13.2MB
        • SHA256 4922427e761123f5ec5c9f3b8ba03a8ec769784f40f7b9c67150b8890a771675
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 13.2MB
        • SHA256 0a852faa3e445c198483674a63c2f58214670622eef3ee830dea2992777445c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 13.2MB
        • SHA256 227e3764fd16c6b6fa5f3bec949e6b146982d4c7556543a579dc56295507ff7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 13.2MB
        • SHA256 923f2d34ba94309a5a55a40b15b966fe832103c7cd79ef08a23e02a7980626f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 13.2MB
        • SHA256 9d0e7331829f0fc54295e3947c2c4a6a04a404a4f566a6ce17dd336158306574
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 13.2MB
        • SHA256 9f53d966a2687d96123cd9dc783b9aba81a2aad45f76652cc9d9b8c8020caaad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 13.2MB
        • SHA256 87b20f914d5835231e28b9ec4f3eb60f996dbb54ced72ca40744a5c958a52ec1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 13.2MB
        • SHA256 59bab12c5759d0664b8b70b09786db56f43d10f538e7185abfcb8d5e6b8830ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 13.2MB
        • SHA256 3bab27041e2cb41785101962b9bb429853fb31912d54d244371dc08b6e9b078b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 13.2MB
        • SHA256 e4419338bd4a62855a8c5dbdca2193baaaf20c8a09767ac92c8c30697ea6889c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 13.2MB
        • SHA256 430c7c8bead687d0ea9c7e41305b73ad909592ed2e9264e53a710817f3bdb9c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 13.2MB
        • SHA256 7d203eb68c03fa2c5d68bdbea86bc74df34aae2336f72de81cc7212f7a8e7707
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 13.2MB
        • SHA256 98eeb8e8896288edee169b166bd6078e01dc3059b18be9ec6b6a7144dc101f69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 13.2MB
        • SHA256 5d48324f576dea9f64505c0433f9c0eacfee3f0bc2f96b312384048f6d2de6d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 13.2MB
        • SHA256 b241b721605e56a25b711b863bc83790ca657520dabfda73a885fd788facf367
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 13.2MB
        • SHA256 6ff92bf47a19bbf736586f87db3bdf4c5993bfd324a1366797732b381c883f24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 13.2MB
        • SHA256 0318ffa0a82163126a3c9696314593f6ecdca718570a992ee9a0f20260ebe1c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 13.2MB
        • SHA256 5f4b8a37b5dad765f06c50cf483aa0f6bde7826827d60738a8267ad9d5ead2ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 13.2MB
        • SHA256 1c2294e7823679e081f535b3bac71e272a2e202b1333144e72ba5d41364e843f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 13.2MB
        • SHA256 8636bcfedfda3527cbc767d1da1fddda920f349abd0a0e4dec450e5e21e9c123
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 13.2MB
        • SHA256 18a1b62f74a2bb1c495741e088f721d65d6e817508ecf9fa21929a23547923f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 13.2MB
        • SHA256 9bd2375258b9e95eb72c08d586df593c7472d34821e332eda2fed0167909954c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 13.2MB
        • SHA256 8d22aef3d444a7f66fb6f33becae883e7f971230b42395b2070a219d70fc702b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 13.4MB
        • SHA256 b92e85ce697a3765a675bc9ab919e9afa0d86c2c45cf5cfdf21dd53aaa663c24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 13.2MB
        • SHA256 791ddcbeea7618ed8bdef87bd6bacf22c42bdb7231169661839228f0db79101b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 13.2MB
        • SHA256 5b51131c5d97ade0a488df21e90738761f6fdaabec3682171ea230749eabe624
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 13.2MB
        • SHA256 05f1ea3d8709b9a4024d2f5d0b0a83e9a7aca9c67d1077c89801d3cca8be60ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 13.2MB
        • SHA256 9960ab726ac8948e2654f1e44ce60afef7791ebc097fc1f8860bd912e326f63b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 13.2MB
        • SHA256 adae07bd27e323790471dfc6943a99d098432de7b3f6d63fa512866a32e4d8dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 13.5MB
        • SHA256 2f6dad61f9ea2c8e14d1a691b763d5fcd157ad4a96aadd8ca3190c3191791e51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 13.3MB
        • SHA256 c2a06d6281490df506a658d3a6a1e4a89a0d632bbf7170efedea20b6220444ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 13.5MB
        • SHA256 c465ae68589dc698d4d52cd170850a5621ceddf274401adcf8edb8d88111f15e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 13.6MB
        • SHA256 42c23fa93922f602a834bae131f6a489ba0ed7dac866b1d3b2c8c274cb54638b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
        • Size 13.2MB
        • SHA256 6afa3f62b731fa0d4c3c40d13250ab299adfeae2654de74b667d977e1dc89e58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
        • Size 13.3MB
        • SHA256 b96680d6fe118f77f369964cf218b8c382651d54df3019d14e15dec0469dc498
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
        • Size 13.2MB
        • SHA256 7201df716c48ff832bddb767d6deaf3161f968f07eddccd46ed40182f8f6b661
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
        • Size 13.2MB
        • SHA256 ca53f9576c6ed09b48af793d4ec0bb8155ce0c7cc9f963f5ade4b11a103f618d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
        • Size 13.2MB
        • SHA256 62127da1a650bbf8c99e9813e9f23c9b8dbb75fee7c66a92297ab57484ea044f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
        • Size 13.2MB
        • SHA256 9ffc1870241e81046ae1efee50316a76d7094a46194c409d1a699131165a609c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
        • Size 13.2MB
        • SHA256 0d3a19bb1a8cc1fb84e3e1a1b57bc65a09d42363c276c0f723c5b45da3bfd9cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe
        • Size 13.2MB
        • SHA256 4e9d895bff3c08a883de0dc0456c6ada045b6a364ee3f73f59765fa0c9e83af6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe
        • Size 13.2MB
        • SHA256 a9501a75237e04906d6f2dbf8518e7b077c579b3fdd0c22481a05e3642daeee3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
        • Size 13.2MB
        • SHA256 d27a4f5f1bda7cd7150b77a3e183a47a6df4e45ec7ca38d7db68538be74a83a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe
        • Size 13.2MB
        • SHA256 465e533ac646ee6168c36ee961dedd0e9e54d7a65900a353e4cba4cf7a0af764
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 6.6MB
        • SHA256 ad696f6e74248caec41fbe08fb46db9b4120a0f828b283c60cf32bde0d986e9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/864-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/864-6-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4552-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4552-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download