Overview

overview

8

Static

static

3

2026-05-23...d_.exe

windows10-2004-x64

8

2026-05-23...d_.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    146s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    23/05/2026, 01:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-23_c80a053dd88fd096721ae3e74205e5de_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
  • Size 32.4MB
  • Sample260523-cble2sax7k
  • SHA256 f5f9e2f2eae2770f7770166c25d810b37e21bc31fbec134ed3a77a3edd502715
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-23_c80a053dd88fd096721ae3e74205e5de_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-23_c80a053dd88fd096721ae3e74205e5de_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1112
  • C:\Users\Admin\AppData\Local\Temp\2026-05-23_c80a053dd88fd096721ae3e74205e5de_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-05-23_c80a053dd88fd096721ae3e74205e5de_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3792

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 33.1MB
        • SHA256 b724c7409f4ee7d8d8073e3bd8dfce892973f8e01222cfd3abe2f1acdb8610b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 70.8MB
        • SHA256 f57e98d3eff240e9882c2e21024a734ac0b200af4da1ac10664b414dd81e3691
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 66.5MB
        • SHA256 b3e278224f4c42362279f0844976d1f25663611ff374d0bac26d756d33ccf461
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 68.2MB
        • SHA256 3229f0b21be622e1d22cec2bda22df2e17f7f1830a3d01f4da467eae3346f2a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 67.0MB
        • SHA256 913432808bcaec0ed567c3cbe930a807cac8cfd062f256f5e4d717a6eb17bf12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 66.4MB
        • SHA256 aa43993863911271d315d47ff12ff95aef597ae12b637613cc65aa0bf090355e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 66.6MB
        • SHA256 a06d91cf5b4ad3469add6d38d6ad44f58bbeb23371653a7d1904e27ece748bcc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 67.8MB
        • SHA256 3d2f4193ab79e9caa92e3703fee5512aaa85c5508e8415318e4094374d4b8ac7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 66.2MB
        • SHA256 705b611a39b8dcf453e1852eaca125df06d1eb1da095838020c69052ee76647b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 64.8MB
        • SHA256 7290fb5adcae6794057b07828053d0d2acd5bdea336f625c0a3c84e01dc1762e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 64.8MB
        • SHA256 bd13d8a72dabe0fdf41859053c43212618258d5efbc88b5c2488b602fb09742e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 64.8MB
        • SHA256 c7a04db7c60ec6c898b7d164b159682812f529a1ab052c7d4cc172746e0ac488
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 64.8MB
        • SHA256 f406471b31bad2278442d74ad263e71c2c6c80b286fb7bbf8ccec6a40a7f4680
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 64.8MB
        • SHA256 28abcd8cdafe96e33052d8ec4d7c74f169512c299f87f9cd2134297cd74ac041
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 64.8MB
        • SHA256 65201a54847c515ea565481fd930736bc4d5d23645c7a1828283019a86fbf2a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 65.1MB
        • SHA256 cd5c0e2190420d3006f62cf51839da6079f65d86ad03b4a0ea062ed6a21f317c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 64.8MB
        • SHA256 7244d9ad3bab1d714a9fb787ed0c6a9af48981cf929679eb57218b75dfff2d29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 64.8MB
        • SHA256 04673165364009e7d7f04e9aea8690d5b33a7cccfa4b144be233fba4ec1f0165
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 64.9MB
        • SHA256 076d09dc828536b6163b7573d22d824f5a67428f7dc4b0f8070b958db305a594
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 64.8MB
        • SHA256 d034d590b6d6fa1754e111407645603b612bd80f086187bfa1be62c430c7fa34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 64.8MB
        • SHA256 983b1bc0374a5d2b4f3177095e20d80fcf8b92f1e8c1c75ea9dabbbeab12ba3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 64.9MB
        • SHA256 adcfdf085597c40780dcdb62aebccbcb07d28b77c95b02fe4e166c55cb73bc26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 65.2MB
        • SHA256 1631398c88b6e37427b4afda8cc83f74f58cfea093ae671b84747c832d00c39c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 64.8MB
        • SHA256 118e7c4d9fa73df293dd26778fcf9aba94e3f9ccd3162d4109512877fba5a2ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 64.8MB
        • SHA256 e80a0231c0fd8f99b9fdd908e41c9c39f60c87b2608a61180ed4c73e368c1b99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 64.8MB
        • SHA256 cb00d6d769c1b31cdff35405fc333de5dc5035274b60de5a792e08adfb899ce9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 64.8MB
        • SHA256 5bae995f201481bb6081214c20b1f489ed523b9db38a37d31e54c8739fca65ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 64.8MB
        • SHA256 c62928d24618418fee5f1c02a4a970211031177d64d472bf9c86efb92f6ef605
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 64.8MB
        • SHA256 d461105a7ae2d85da2ebb07459bcfa5720d0a87a710dc63ee49472918f29116c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 64.8MB
        • SHA256 cd02c1f491fc549fc8bcd3f2d78ae444e5bb1cc28f80cb8bc87cadbeaea1c197
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 64.8MB
        • SHA256 2a9519e51a6e1456768603d39f7dcbe58745dfffa6cea674f90fa9e35f16d9fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 64.8MB
        • SHA256 5e0b6dba3b173d90e761ee4b4cfbce83a429f4c328382a91dd02e6c809877951
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 64.8MB
        • SHA256 bc4c5e512bd06854ba8f819d6d3b5cf0eccc603d3687b9ee4102ed39e2e03d29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 64.8MB
        • SHA256 9d267ed89c78d499bd34fa1e9031463087bcacd6dc845e7105df3300d620b20b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 64.8MB
        • SHA256 f1a850f90975f274c6a4fad520122661d69e245225d9de898133d6857691bb8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 64.8MB
        • SHA256 ea5803069f603fb3266dd495f8880c0a6367080369cb0e6b64cbbd6d9ae421b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 64.8MB
        • SHA256 255942875e12b3ec5d68de86bb76f110fa5686e75584f802e2767f43e325f78e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 50.2MB
        • SHA256 d9dfbdd39bd7cb606b2113a1e7afe2a8473e63cdc5c47e6a60f2d1c400bdfaf5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 44.4MB
        • SHA256 3d32135f26c28c7b947b0e454dae3ed725f61a610973457fc71439d23847b012
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 39.7MB
        • SHA256 2491b2dc7be0773cf160971cc22ac024852d01a63d2e3412760f8fbc25ea533c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 38.7MB
        • SHA256 c66a1968c108491a05e4c65a2264ab4a559f113c4fd2fe4d61d6ef218d49a613
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 39.1MB
        • SHA256 7a611816e67c1da7915070acd6ca4230ca248c6987c5825b73d31b2158905c99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 34.6MB
        • SHA256 ee9f01a1621ec4d83a23d80b6dc1c0677534ea9f510da8b97638cba8dbdd06f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 32.9MB
        • SHA256 636e13214a67cc5693b1ed0822de334eb9b5056fa2fed268ffe641b6f519c049
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 30.6MB
        • SHA256 473dc8dcff6cc6d3a760fbb00911d31617c1868794c9d4eff3e01f73fc1eae53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 31.4MB
        • SHA256 7d1fa169fd674deb4a4a79b27328f7dc0136c8f31bcc557b7a63d0d2d5bd33d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 29.2MB
        • SHA256 4f79d6096c4f44269cd105618560c6908e00d85b187764330c3034ed876d834a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 23.9MB
        • SHA256 6b4d6b4a4a4aff88ba633756b2847b9bc81c6fa54b1fc1e1dab57c7f672c41a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 22.3MB
        • SHA256 5155dfe10c00fd5ed64e2ee9de3de3e429257cadc53e48ed1ddfb281a45c4cea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 17.6MB
        • SHA256 74f72101c0976df76eed82fed9c7df9a3af4a39c93b26de08a7806f46abf3ebd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 9.6MB
        • SHA256 20b217e19c17813545b90f0737b8949558114ad4cbaf8e627327af54883cf1a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 9.5MB
        • SHA256 d17ba8962cb65b6fb851a90f25f9f909bf19d8e1870269426f4136b2afda328a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 8.6MB
        • SHA256 1db374b869e1dc90b5f607aae8c78dea33df71483bcb3e9c485649ba33ac8dc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 7.4MB
        • SHA256 3492ad660ce10d4fa00783c68e062f0e4d25d3ee23f68428b4559ea002c10f64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 64.8MB
        • SHA256 ada427a672687547b4c23ce135d89d3d769ad21ff77de11ac1a14f75c52ee8f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 64.8MB
        • SHA256 c32ff46c0a40b440d78e2df3dabe55511e641ac9e65690367e08218c50d224f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 64.8MB
        • SHA256 ac5b947c2210d1d0fe34092451424436b7adc7d1cbc8abf3c36e51aef99ced55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 32.4MB
        • SHA256 f5f9e2f2eae2770f7770166c25d810b37e21bc31fbec134ed3a77a3edd502715
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download