Overview

overview

8

Static

static

3

2026-07-27...al.exe

windows10-2004-x64

8

2026-07-27...al.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    27/07/2026, 17:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-27_2f631051bd763a08cebaef0b46150c3b_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
  • Size 9.3MB
  • Sample260727-v6c19saq8s
  • SHA256 3c36cf1d95e2125691c19d00a8e22adcb85bb7b88278b8fecde69312cfa4b60d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-27_2f631051bd763a08cebaef0b46150c3b_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-27_2f631051bd763a08cebaef0b46150c3b_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1820
  • C:\Users\Admin\AppData\Local\Temp\2026-07-27_2f631051bd763a08cebaef0b46150c3b_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-27_2f631051bd763a08cebaef0b46150c3b_cobalt-strike_elex_emotet_hijackloader_icedid_luca-steal.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2520

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 9.9MB
        • SHA256 3d4efd0661f9529f16df19745be8648e13a726f5d78b8a8d42ce2dccdd98bd2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 10.3MB
        • SHA256 3d04bb516615eaf17e00dc3197a20854e939cdee44510fb4051519311070bf7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 10.0MB
        • SHA256 7bc488f2c3d7bb053a18ddb3a8314e1b3d589a8004c5d864c76fc87425f81048
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 9.6MB
        • SHA256 40d53f1a41ac5b861bebfcabfc9aa1df425840a4a1f463d5d326c35578a5cea0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 11.5MB
        • SHA256 f29475e3699f6ab6038c66388f131588409bd9617ee2ba9408757e6d0db13975
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 9.4MB
        • SHA256 5e88988e07eb6dc1f386553b76f9521da27d6997df6234f898c5486722ac3f8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 9.6MB
        • SHA256 0fa4fae8eecc0b6cbcd37e7769abb43eea3bdf6862ee2a05993e720146d5b507
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 9.4MB
        • SHA256 32e84853ee7c223c4070d9c92152afa7166d4d6d70e94403a0172f8c7c54a728
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 9.4MB
        • SHA256 44213e805e34e19fccd5fd7621672cc81daafd01f75fd2187f3b9109b72ad935
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 9.5MB
        • SHA256 1efb7a659841e29257721905b93052a0c8b69fd6ad4fdbc6e1ce1c9ce835aa63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 18.7MB
        • SHA256 9fd256842d5ffd8b646431705086393f0c48ca026ae7005b44c959a2e3a07a22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 18.8MB
        • SHA256 8d84e8115c5222e3cd3cbb0e5fb81c4f2abf278071abefe32e63590c2c9c485e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 19.0MB
        • SHA256 f2bf44ba47a9f7a48a193ed872e3e5234d3a5389fec5a7d6e60d3a5c41604adf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 19.1MB
        • SHA256 017e6625581aeb4b9e574c44b84d79e72a524218ee21073327dbea0052713769
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 18.7MB
        • SHA256 f645e07a123631fad80f8ecdee1ba9960fa438bf24946450cd9ce3e90d327bfd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 9.4MB
        • SHA256 c036beaf497810f0f953fd5b78bf36bfc514f4541329a23a7722ddd67cb6b9d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 18.7MB
        • SHA256 241ced49e388aec4de8c739976bd214ce33230a322c606ccf519c5522c456e1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 18.7MB
        • SHA256 c35e03a8e0ba5425b701464525a63fd80d9c614de1c113f5eb775b33307b7a5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 18.7MB
        • SHA256 6a8663d34d754c71af55174de43adbc2dd43ec5b6ac2d1b6e024bbe8a2810b17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 18.7MB
        • SHA256 8dab7dfb07a375f15cfb89f9e0b5400b4c394f4fe1fd9a8f9ded0e330607132b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 18.7MB
        • SHA256 be8e9a9325b243042fa30da160e5327179d72d435f289bf2ae68ad3754280784
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 18.7MB
        • SHA256 830967a0621b9f1aca9069555b9fc46f9fcba1f43c9f10b5abc5298e60f350b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 18.7MB
        • SHA256 d35eea0d187e3d56ea770219470f93e9a38df35cbc3fced936151bc586c35eb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 18.7MB
        • SHA256 4eacf2907c43476fc399416ea0be14d2d7f561c3bbcc8bf13beb9b87c9ebb6fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 18.7MB
        • SHA256 93374316ae96fc1b99d2e0d3a53f6b55ebaa258bf48460ede25ce9d8b110d31b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 18.7MB
        • SHA256 00b5aa28f51e3d9110d7d085d80509b293626d9892be303726672da710a627fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 18.7MB
        • SHA256 4185214600c45710cbce9002a8af3776b88aa60e92925c884abe300df1d15a8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 18.7MB
        • SHA256 0f8d7e06c483487ecdefe61381eb118212b0ee6e825cab8eecf68815dd4e22ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 18.7MB
        • SHA256 4b071a15f212008c33681af15e2c85204ead4bd3c2d8a7123a12a3ea9a38d786
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 18.7MB
        • SHA256 8b2e2984086fc40555161a98f55984af4445f3c10543522d6f83d967c040f74a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 18.7MB
        • SHA256 630d66cfd0f56ca56c56443502288f73b6ce4c78216675dd9e6064c000305ea7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 18.7MB
        • SHA256 af0f62fc74883d67ac06a2d5bb898b8a5d21fa8fb780d9631eae9db45a55114a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 18.7MB
        • SHA256 f1d17c9efb08caaa90049d1f877a5ba43e24619391cb702e47c81fd7ccbf0b36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 18.7MB
        • SHA256 71d52171bfc323a424e920da03b3487551ef95be954afc77ac1488cc8f755691
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 18.7MB
        • SHA256 3c0e70841c7b78fdf2139e8aab854f88e83b643a14f82203baa42c0771f0d1bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 18.7MB
        • SHA256 ad816cbe354b9c80b45a81cd7e9b01fb243e33ee5c6bea8b925949d8f7bed0d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 18.7MB
        • SHA256 69232999e06f414749f6608c28740a9000124717e4f4acf4b3088641bebaf72d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 18.7MB
        • SHA256 b6a4a5fd68b3b8d4670ba56c65dd78740320634b40b7681bdbae3c70a2eca24d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 18.7MB
        • SHA256 95c8adf7c32619e29195acd519fd008023ab2c8a0b56004d1cd46fe9f51bce26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 18.7MB
        • SHA256 d331f030a54bbe3b4df9a66f45a20eab2a9e2216ef2d4e60369ff96a48795df9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 18.7MB
        • SHA256 32a15daf0684d0775b3505dc2736febf2797944db6e483384005ceb05f23305e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 18.7MB
        • SHA256 695a7635e6af1e1fee50f57c3236c3278e83a5f373e3c54830d5574c065fb31e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 18.9MB
        • SHA256 9f673eec02f3c8d815b2ba13070cccea8997ef0206c08b17544fd290d8279f79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 18.7MB
        • SHA256 4e572e1ed063067a27ffc440055cb9cb116a99a1566e726fd407bc00ef4ba405
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 18.7MB
        • SHA256 ab309181b0cd46fad26b4e1853e5d51e8981922194c437333ee5f4c25b2a2e31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 18.7MB
        • SHA256 b5b639a8c3b76d767195ebaefb67f7d51571e92c4d2daef7f49123cdbebde4d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 18.7MB
        • SHA256 b99db6526cadd79d983f3d343ef15bec3736c447f5d50496b83d5fd478408602
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 18.7MB
        • SHA256 d5d227d2908f245539a114036977c21e0d9bbcd9a532db82b091150197f493a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 19.0MB
        • SHA256 e62f6e2df549e38011d4e04932b5f8ae698e3604672b9f92b55597e31fb054a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 18.8MB
        • SHA256 749a9b805a635e377caa9e3e527b9f93b94fed8cea433900500d28b993401001
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 19.0MB
        • SHA256 d8886aafd3345a229257a0c7b442fa8ad8b7b64e07f08c5aeefb7db4cbc9b8b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 19.1MB
        • SHA256 e225c1b9ec0877d94b8f75dbaf48c6872b9b3ecd225075b69664b2219c39cd21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
        • Size 18.7MB
        • SHA256 65cba10b792968ffff58530bd72d730d128561968b681dab6ff38700f2352819
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
        • Size 18.8MB
        • SHA256 2da9f54c1473e4a7132799b7965e8f0380c6e9c27bec2b95d33e81ec80bf259e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
        • Size 18.7MB
        • SHA256 0cc15263a3ec284a783e2f567b777c253b4c5cf3027eab81f63588a39c7e3237
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 9.5MB
        • SHA256 6973c9c6712e8b3fecedbe879b36d793a64575ae678184c3954c696d68488a96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 9.4MB
        • SHA256 8c16aa8ee74be318b63b5ffe3903a11775a05db08d80f46893c9fd5ddba3a729
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 9.3MB
        • SHA256 3c36cf1d95e2125691c19d00a8e22adcb85bb7b88278b8fecde69312cfa4b60d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1820-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/1820-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2520-6-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2520-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download