Overview

overview

8

Static

static

3

2026-07-01...d_.exe

windows10-2004-x64

2026-07-01...d_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    47s
  • max time network
    123s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/07/2026, 10:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-01_3269f42b85e8826a689a11430944aa52_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
  • Size 35.9MB
  • Sample260701-l85dvsbt6q
  • SHA256 0606f96d9625772c75aa5f7740eac6acd858d28810ee669a8d5e4bc3a72e0bfa
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-01_3269f42b85e8826a689a11430944aa52_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-01_3269f42b85e8826a689a11430944aa52_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2880
  • C:\Users\Admin\AppData\Local\Temp\2026-07-01_3269f42b85e8826a689a11430944aa52_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-01_3269f42b85e8826a689a11430944aa52_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1280

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 35.9MB
        • SHA256 0606f96d9625772c75aa5f7740eac6acd858d28810ee669a8d5e4bc3a72e0bfa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 71.9MB
        • SHA256 b42e545dc8857169fd52af4de7c6d9475bf61e7bbda1c87e95b83c2777ba70cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 36.3MB
        • SHA256 1e72e7ff498ccfa444d877f42b1b84f84ed06f6789b430aaf5a9fa949c56fb99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 38.0MB
        • SHA256 99beb63ad15ede92a2723e60b8f601f4c790612fd599fd88a072583970f5f1a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 71.9MB
        • SHA256 b3f2ae69ae211c1a856a6dce5eb24e8e699f0fe9e42b063c547e8c78f59448b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 77.9MB
        • SHA256 abe1297332a6b9cf4d4bedc59d01be6a83ff3399a4c980fd953de1a062fe1afb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 73.6MB
        • SHA256 19a69b7a4aa2d7dd5029ae6758cd4ada1266f7ececbecc918bf9bf66acac1450
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 75.3MB
        • SHA256 26442c5249c6ef24662480afcd68551f7706fabd09b74630f5d7e8d7cd480e5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 74.1MB
        • SHA256 5a5dea09238aa089ff712f6c4e1f38d6a1504b6dacca8149ee670aec14c592d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 73.5MB
        • SHA256 63edf0ccf8b800e92d766bc1d5e70a2962d2520589f7556c0a98733cbdb11338
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 73.7MB
        • SHA256 f6e339c28008e79ca0dc5646f671f54b485601974f302290eb5f2c8449b8169e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 74.9MB
        • SHA256 32f2a7fbfe3a4f0fb798276b90f4dba3af5fb0bea15e8392370793e3faa35c11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 71.9MB
        • SHA256 ed2fe93f6cf5e0bcc67f705e7d0e1a6e394b1c13e65c7d32fd2363872125b82f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 71.9MB
        • SHA256 5f1d803fb7c073e0760108e7ded5f21480cf8ced1b7cd15e0fb229928f380b3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 71.9MB
        • SHA256 28f2e3eb52d35ea94db59d560b56dd807a7e8daf870b8e578acc35068801d495
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 71.9MB
        • SHA256 dd65554c2bf0ce2531c1a355d35ca1a714dea949f1cbc83aec454a239ce0ae09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 71.9MB
        • SHA256 ce2b7769ba6cece6d6471ea36aaafeee328f36623a1488b9e4f956ab69248acd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 72.1MB
        • SHA256 f80c8e6f99d902e5e64c9325dee49474b5a01544db37bcf5ae674f045a5e3e92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 71.9MB
        • SHA256 c8286da89efd56cc1cb44735a704791771b9ca47b2f55416a86eb03f969886b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 71.9MB
        • SHA256 9ec04f838b766d5b51409960ca6f7c81ac29e0eb745065cb7083b8e5600d90b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 72.0MB
        • SHA256 d65b1c8736946fc62d2c45a1d44e2c73b1e50b7d8ddb4697acf6062e8a0907e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 72.1MB
        • SHA256 96d2e141673990a5679a6bb76601eb8a1dc4df347e83fd60c1c4393a0b7739fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 72.3MB
        • SHA256 2c386884d36842bf9cde3493ed4ab816ee12ff29ce8a153193bf13399ead865d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 71.9MB
        • SHA256 da37412f5a3f203dd2c0efcb23a44358157e70f25cb0e565b2ca0366b1fc0ead
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 71.9MB
        • SHA256 dafe9d009891998f614a62c14071806712aa6d03e3ba3a15e11bd137920eff22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 71.9MB
        • SHA256 10a151d97a43e9b36d7b89315ee7c0482b77e43e8800d80b6f0410fb2be9fbc4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 71.9MB
        • SHA256 539b2b8ff05f2f5a87bd0deef2ed0febd0108197e433931e14777ad099cdd245
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 71.9MB
        • SHA256 c72a32ec939a894742b0fbf601887c26a926d16591521744215ee59d81b4e4ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 11.4MB
        • SHA256 77da1d84940a3586ff28cb7da808fbb87901cde48d230c9dc2ca143fb9900d3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 10.8MB
        • SHA256 51bb8b2c49c0ed62ddfded90cdc7d7f7817b7c20c7a860096dda29232be1b0b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 9.2MB
        • SHA256 a66b617f922c6ffc470c3859bdcdfd5bd01a994dbdc5faf4f6b0bc283f74598d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 8.1MB
        • SHA256 7b97d130f84ffc6783dabf00a34a475ece39b4be59015578c3f58af253900d68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 7.5MB
        • SHA256 85f92608eb152d2f0ff35b7e113f32122d25e37cb4345c485ee9e67f4860194d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 6.9MB
        • SHA256 998b0702cece92f3055020a2c911b683b745f3c22f440fd63fcd205b14dba4de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 6.3MB
        • SHA256 9b05445c69b3c77988fdf44d124a730ed3a6bd74a8595a0568b3f8fc62cc0c5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 192KB
        • SHA256 56d5b720b4307ef448fb38ef6495ea0a6fb25e8bfa8f9c140729b820c8e0cc1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 36.1MB
        • SHA256 be5de9ca94dcfa9fef5c3944e34626c930bec75884f52052e1829880438c89ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 36.0MB
        • SHA256 bbc366d8c00b2dedcb25267dfb1409256285e959f4860a77b98c02695976d019
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 71.9MB
        • SHA256 0d5988f180902c7a8aa14973cff7b16bcc2ec0c3e0f67aec473bd9e3533cd74e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 71.9MB
        • SHA256 bc1eb1ec980fe5bfdd59f4dbd598c8454e11885af0cd223a1aaa0b7cc54d6a55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download