Overview

overview

8

Static

static

3

2026-06-04...d_.exe

windows10-2004-x64

8

2026-06-04...d_.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    04/06/2026, 11:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-04_1406d02e1672df620c41942ecc662cc5_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
  • Size 8.2MB
  • Sample260604-ng26jac18s
  • SHA256 f4d79c5b6a8d4823cc8b8d910788ca29c2183758e74b43af8816666a2f56e01d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-04_1406d02e1672df620c41942ecc662cc5_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-04_1406d02e1672df620c41942ecc662cc5_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4004
  • C:\Users\Admin\AppData\Local\Temp\2026-06-04_1406d02e1672df620c41942ecc662cc5_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-04_1406d02e1672df620c41942ecc662cc5_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4972

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 17.0MB
        • SHA256 cf4c6aed996edeecf9513d914c77e6f773b9af0058a119025e44cbe21ace1066
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 17.4MB
        • SHA256 6a6a7fcd144075f472288c3be2c5ad5a27cfcbe52f87c757c6a2c4d1d8149649
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 17.1MB
        • SHA256 11f9f830f2142c07ea84f6a677670f9f332e2f5e5d438f25b99b9b2f464dd6cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 16.5MB
        • SHA256 899a655f2ecb87f274724217b2b3efb1cd2b6294f22372fbaaf85ce11d31fadf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 16.7MB
        • SHA256 8035633f3e08802e0cbd965debb0102653f2b822b78bb18f231c09f8ea7505ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 16.5MB
        • SHA256 ad2d3061a60628716800c9179834b82259073087a29e4a0b78fe2b4e4dbc51e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 20.6MB
        • SHA256 7856c444667070ce324778570ca86b866d38e15bae92ac2a0bb0e2730995c562
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 16.8MB
        • SHA256 d2477ca23d7c3bdef1be2c44eb182cf81049f94a57cc84e919e0c6c8408fbf16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 39.9MB
        • SHA256 09ff23b67b89be00ff2d6361d443af79c2ab27e2e8472bb3deb55a93ba7e197c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 18.6MB
        • SHA256 87585555139eadd2d11d5b88e1935c9c2a2fc6913355ae99d4bc9d2b11db0d3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 16.6MB
        • SHA256 1dc7b41efce3aff7e7cbcf8c994875d7713d32e9c5cd0d314076a0c85e350f60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 22.5MB
        • SHA256 8f090a7fedad4079237cc6944842348fbfa16e572fe1a3abe2695d4f6bd21213
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 448KB
        • SHA256 30fda89260062596f8473df15f576de632ea44d623bd575d46ec46d32766b91b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 18.2MB
        • SHA256 3874e4486bb0cb812e0a16e4e97453ab3a99fee1c1dc410d30bcf20977e2d69f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 19.9MB
        • SHA256 e1aebe058f679f47ced00e788d69f91f723ab4602217934d66dbd5e09247e327
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 18.7MB
        • SHA256 fe4f3b90d37b2a9bac5e9a70d73dd459fc230c0fba819cd520fc319e13409212
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 18.1MB
        • SHA256 d92eed5f11f9f9763669ef2dde8bb216a4f01fd6c721ef8122843b975607bd27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 18.3MB
        • SHA256 df1289597a59487ae10e7383d9b3da33699592a1bdf291e27402342d14285ac8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 19.5MB
        • SHA256 c05663e488f30a67d555725e9751ed73b718ef3e8079756a919614a0b635d00f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 17.9MB
        • SHA256 e6d21b20a43bae87e9d1a3a288edad3e0d8f1a15366beec3a803dc4cc3e2a80e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 16.5MB
        • SHA256 3cee74e6de0fff372db21f5a3cfb65bba176ac92db258cfa7c7508a1535da18a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 16.5MB
        • SHA256 3ca29300137e26003b200ac92ecc84ece3be9451380bd600fb303a18a754de90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 16.5MB
        • SHA256 e998dae4b3cf0daf092f1141fa53cf57635329100ce267e3af3acc4099feb989
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 16.5MB
        • SHA256 a408404973f839d8493c1107047e540aa09979cb206e1b9ca28581704e507b31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 16.5MB
        • SHA256 4a5fafdfdaad4a8732148a0a92e993b9138785801e9a390c33ff3e6eff82dc45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 16.5MB
        • SHA256 022a4f470188e75fb5f489e0f158febba195f96d9b0006a273127a191c273f3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 16.7MB
        • SHA256 bdd049653baddd51e324a86c7386de99b697d448b0d74439d916174cc6320834
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 16.5MB
        • SHA256 6f45d98ce063df93b7e07280a0c3da33f9408060faaec3a9ef300fe07f0aded4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 16.5MB
        • SHA256 d7775ef1604d977b88656bab284304357654b7b1efc18667eab554ac5177cd6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 16.6MB
        • SHA256 933fa545f90ed7986760b26d57aacf7d34bf2beb0768eb92f778ebbeff227e32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 16.5MB
        • SHA256 8540164711a6d440c36f52d354301309792a1a6566065532987ef916688b7646
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 16.5MB
        • SHA256 95ba2aad133bf965f5c2569a7b9fecb0e18f20df5b87ef9d2bb9288aaf2e4656
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 16.6MB
        • SHA256 e2253927fdb195c0f97469d5a55c52eab754969cccc07a047ac8de527febe9db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 16.7MB
        • SHA256 d2600090a63c034e1b289c88d08535d873fd0aebc8db1cf609841fee6b06d4d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 16.9MB
        • SHA256 e7e697fb5e07e2a3509ab3cdf4d31ba2ce1e3de6ecb1b82d0d94252bc6e7f481
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 16.5MB
        • SHA256 307ea046608ddabb76e3e425dc3442a632e42de70f3c303cd3dc57ae22e10653
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 16.5MB
        • SHA256 4c4472e074efe378239d9133dca812b67970877c35d49a38151da79d9430a57c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 16.5MB
        • SHA256 09e7209e541fa3855bce2925c189e39fa0bf9612c668f99bfdbbfebbe19a3738
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 16.5MB
        • SHA256 cc1e63e3891b09ea34e1af60b7ab666e7fb2077c943be49331dd750eea11ebfa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 16.5MB
        • SHA256 ebd1e00cf1e097a9769c2c5568e06e0569ccd8bb8ae8e70cb85c4392409a2013
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 16.5MB
        • SHA256 6ddc7bf62f762419e73e7ef5e797a081668a489ec3f8f7c0ed4faafe3782ea10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 16.5MB
        • SHA256 c5fde8b2ab1140711acd267da8ce5f5d88161ef827500a91058c27fdc1efc3a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 16.5MB
        • SHA256 3724a77d758ab6d0927587e219030656d714086fed2402a6305326e5cb2656bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 16.5MB
        • SHA256 81abb0fb7ba11ae91f770650db0f952d6d38fbb2502601d4baeed04aa611b2fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 16.5MB
        • SHA256 90c13f389b11f757e43485e75df2dde4c9647ac0fdd6fc89df173029ae722be0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 16.5MB
        • SHA256 0544b84544a14b19c47ece602a7299302d7bbf8950980841638c537c20cb89bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 16.5MB
        • SHA256 8176b609227c80dbed06c49b00100f974903c34d0ee62105f7a903e67ece3ddf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 16.5MB
        • SHA256 8cbf2f47fec5196e4edb5c29e664f746d8f6edf43018be9b86166e90c76cd354
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 16.5MB
        • SHA256 095a36d6c2fc82cc8ae17b98a7e1ca6bbdf05407ee7b57679ed5564a0be1e657
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 16.5MB
        • SHA256 d931e9401d4a68d775f6ac35e7bb1f263dc105dc10185913350afd3bc48a405a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 16.5MB
        • SHA256 183a2f39fbaed72fac2ea233a839adcfa66f2fde4811efc02ac2f3b1e8d6254e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 16.5MB
        • SHA256 8e77f0f0a0a3f875d23f969801c6fa4ad5029a11783ca9900d0a9b5d1f7603ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 16.5MB
        • SHA256 22ff572cda79f3d9bb09042fed6bcb0c1acaa4e53236be06a983da7874749e9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 16.5MB
        • SHA256 af85beaf366aa4bad68e0b8c5f53c86f19eb7152fbe5dfa25d3b73bade036636
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 16.5MB
        • SHA256 db2ed51613cca0385de34945e69981736ccc6a8c940cd27e2eb05373d4d866dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 16.5MB
        • SHA256 c199abd84eff178f40f5538362b0ca7a9baa858498a32ed171e6d00c76aa55fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 16.5MB
        • SHA256 fd942064bae8c6e4f5ca9d1d914aa6750a02066d49ecad4cb74ed3052a5aebaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 16.6MB
        • SHA256 8d6ad02c3f0f419b815698e266615e86ac8e950f7653c712a2420e5dbe6b4fa7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 16.5MB
        • SHA256 5ed3a7919174a4884621f7b4386a3a557626688bd2526913fd65702a6198b2c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 16.5MB
        • SHA256 e7a335497001ca74dd8c6da0d3908199ec4ac601c4c85c193299ec669e0fcc60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 16.5MB
        • SHA256 72655fcc695a37d5690f91073c7289b9f471103e90db4670740879f2919557da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 8.2MB
        • SHA256 f4d79c5b6a8d4823cc8b8d910788ca29c2183758e74b43af8816666a2f56e01d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4004-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4004-236-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4972-312-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download