Overview

overview

8

Static

static

3

2026-05-23...d_.exe

windows10-2004-x64

8

2026-05-23...d_.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    23/05/2026, 01:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-23_c80a053dd88fd096721ae3e74205e5de_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
  • Size 32.4MB
  • Sample260523-cble2sax7k
  • SHA256 f5f9e2f2eae2770f7770166c25d810b37e21bc31fbec134ed3a77a3edd502715
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-23_c80a053dd88fd096721ae3e74205e5de_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-23_c80a053dd88fd096721ae3e74205e5de_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3924
  • C:\Users\Admin\AppData\Local\Temp\2026-05-23_c80a053dd88fd096721ae3e74205e5de_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-05-23_c80a053dd88fd096721ae3e74205e5de_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3152

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 33.1MB
        • SHA256 b724c7409f4ee7d8d8073e3bd8dfce892973f8e01222cfd3abe2f1acdb8610b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 70.8MB
        • SHA256 f57e98d3eff240e9882c2e21024a734ac0b200af4da1ac10664b414dd81e3691
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 66.5MB
        • SHA256 b3e278224f4c42362279f0844976d1f25663611ff374d0bac26d756d33ccf461
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 68.2MB
        • SHA256 3229f0b21be622e1d22cec2bda22df2e17f7f1830a3d01f4da467eae3346f2a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 67.0MB
        • SHA256 913432808bcaec0ed567c3cbe930a807cac8cfd062f256f5e4d717a6eb17bf12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 66.4MB
        • SHA256 aa43993863911271d315d47ff12ff95aef597ae12b637613cc65aa0bf090355e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 66.2MB
        • SHA256 ef8dc19d03f5f04ce2e84db8a0bca7c245d95f365f3ed12fc228c9485e99247c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 64.1MB
        • SHA256 6458d7c6f36dee451d01684bb27a50f09e2985541e990d605442caa8389223e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 66.2MB
        • SHA256 705b611a39b8dcf453e1852eaca125df06d1eb1da095838020c69052ee76647b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 63.0MB
        • SHA256 9427561923a2311523e6ffab61f911ce6bcbdeeebd9642d5815c61fb92cd2aad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 64.8MB
        • SHA256 bd13d8a72dabe0fdf41859053c43212618258d5efbc88b5c2488b602fb09742e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 62.8MB
        • SHA256 61c2cb34c7dd8a9fc51f7e4dd266b899355c231bd8292b70497ce6b150e42339
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 60.4MB
        • SHA256 71506c56ce038eee49d11bb17ae5a5034e6707093a12b633e3c2e4036fb1d6e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 61.8MB
        • SHA256 f01936c5335f48f4163468cad13c645be5e0621ba2610e40d7f558663df724d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 59.2MB
        • SHA256 4b3b4e5e114f560f11619456d60c2a200bfbe5b1e2467c0bbe3797ae6e8242c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 59.0MB
        • SHA256 61d3cf22f865c6b1a93c17baf8d1515b68328ac62b7997a07c393e60309cf73e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 58.6MB
        • SHA256 c82fd2955995e8f096a447def4e1820bdd07661baf16231959cb89db4db5e93e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 55.4MB
        • SHA256 197ae68f013682e6cd1d18a768950fbf090a6ebac31b6acbd6cee2153d2a4c6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 56.6MB
        • SHA256 61150a0cd41bb56212f3120c07449af9c77402842badcf870335c5409b4b439b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 52.9MB
        • SHA256 71c9f296e3ff56b6d79ec75c65b9ac195bac63ede490745cd812e7be1533d48e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 56.9MB
        • SHA256 86925f21e33bc2530da351bf0e209adb271c07fa5b903d3cb4850b16e97833ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 53.1MB
        • SHA256 c43fe8412506627ff592ea991cc8b18c9dfe47937be2fbb1da2b669353109156
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 53.8MB
        • SHA256 b8c54097d56c55ded95d08d4ad5f27fb1743ff8bba647e070b48b6d5d868f466
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 52.9MB
        • SHA256 5e5e8c3ff2e91da7c87e8ffbfe2297d73080d497ca7c42853bb6fee529717c9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 50.1MB
        • SHA256 ca6461bf1797017490ce9948f83918399427d35346608a104be6bea55fe0d322
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 52.2MB
        • SHA256 7889bbff231a3f14ecb08d3f2406fc9748925dc0aece6e6bd3c633ca6a95a72e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 49.4MB
        • SHA256 aaa415a08ed55bde9627781a90d51055b413f3bf89e3a2bfe3e00d8b01f89281
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 48.1MB
        • SHA256 24926edfc6b0c04e40f1dc10aa59b4399cb3299a7d089b81521905d6834780b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 49.2MB
        • SHA256 6ad00fc18a0d63dbef5840cc23f2ca86bb77a9b1fcfdddfea44add655778cc8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 46.3MB
        • SHA256 2b6e8dcf31358ae0a769cd40a827ef609056962c22c7709671f493cc0bd2e491
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 45.2MB
        • SHA256 236b902b2a5907e104cf2ce1cb00962295fc726ed5afa703cb59c6ff5e44f50f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 45.9MB
        • SHA256 cad164bf8c27fda87fd6aeac75b96f733a37041a8ea794dd950603b10c825209
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 43.2MB
        • SHA256 f2efc19146ec50b42a2a4864895b2021fc0cfed783e7c3e5704f8fb7dc4c7004
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 43.8MB
        • SHA256 306c15e38bb9cf8eb2eba8d180898ab74251df07be6eb48732a82ee054a5ae48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 42.6MB
        • SHA256 63b8e4f3db78750fec9edc4f39744e17745b35ecf0799dbab3df1967ff6311b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 42.1MB
        • SHA256 7cf41b989333abefc64f73c27327178c3709def91025a4de14562ad3d34ab50d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 41.5MB
        • SHA256 05ce497746ab7c036632b54a2334d4450b1e141ed5a9aeb3827f8711136d77d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 42.6MB
        • SHA256 51f0b062e16ea2edea650f423be0119656da08bd73c83c9c78179ebf933b7709
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 43.6MB
        • SHA256 2d1a8e998fe078bebb842f63c4e124a911419cba7dc6a62712f9ea2e123bdcf7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 41.1MB
        • SHA256 7f39fb2e98f1db0b99021acc4487b9b545a6a08ba8e758de4441a457a6338707
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 38.2MB
        • SHA256 b93c0e499f78733ffde30b07d23ffb73eb4dda1ef6cd3b8da66ccc2ad1f32279
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 39.0MB
        • SHA256 80ecd95732bd0b4f166d294efe0df2f3ebb9c798036f1e4a6a83d9774457c039
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 37.4MB
        • SHA256 c43f4226edc22af7568bbbecea2687f1e4db8b1a59ce4087003bac3bf58e3614
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 39.1MB
        • SHA256 7dc6cb53340a00481d709d4eb06d57a69b3aca7bb355a0326ab03e3a0395962d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 36.0MB
        • SHA256 9848a06570226a18f0689b1c5c070387050907cc590a6586877e4daf85e7f016
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 36.6MB
        • SHA256 a8bbc650991f3f3fcf3f9fa1fc536c23f39142f602b8e9a8f049974cf4263872
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 38.3MB
        • SHA256 dbf0b4188a45242828152179bf233bfa4342e197ec46879538ae4edc2806dd48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 36.3MB
        • SHA256 38d21b3b594965726ae9653a33e821a6825bdbc7fa4d50a5eec2c9dfef1a67d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 34.1MB
        • SHA256 236639b9f886b4a2ff21a94e6f8f8dde1e714d0b329abf7de8b2b6850a2be2a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 36.9MB
        • SHA256 4067013c1b40228bf6baf8ff54f6a2f6b9440389a7a80c7d3f265b4161880a83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 34.9MB
        • SHA256 7d6fac6c1fd63d9166922ac3dfcc9a75eee5f6e0f406f013a1b79157654574d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 37.1MB
        • SHA256 749dbb58b150ab002236d27495ccc21a36a6d97f75272b787f5182f4e0e7e389
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 35.4MB
        • SHA256 e818b73b7cb8fa38890413eb84963325c1b93ac2beff46f276f26b98c169903a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 37.7MB
        • SHA256 dd397a3c44d8ae8951acfade56d28bca02c167cc16ffb2a727a026dac0209657
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 37.5MB
        • SHA256 8a95453b190c6d053036de5db906c9822738648cc521c94c70f8b4bf3b6cee54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 33.9MB
        • SHA256 ba74f6ffccb2716855abf6c17590d1a38754b9f34ee1a753b52f78cf72d4af21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 32.4MB
        • SHA256 163da039699047198e648690430e131f898081e24144cee1077455c79042b416
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 64.8MB
        • SHA256 ac5b947c2210d1d0fe34092451424436b7adc7d1cbc8abf3c36e51aef99ced55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 32.4MB
        • SHA256 f5f9e2f2eae2770f7770166c25d810b37e21bc31fbec134ed3a77a3edd502715
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download