Overview

overview

8

Static

static

3

2026-07-01...d_.exe

windows10-2004-x64

8

2026-07-01...d_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    39s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/07/2026, 00:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-01_09bb2ec339aa01dd2612d9864da2c8f5_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
  • Size 37.9MB
  • Sample260702-at1xcaav4s
  • SHA256 e03c219043661bb7ce50723b2f034cffbafbd3b2467a9ccce051251aecb02f75
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-01_09bb2ec339aa01dd2612d9864da2c8f5_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-01_09bb2ec339aa01dd2612d9864da2c8f5_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1548
  • C:\Users\Admin\AppData\Local\Temp\2026-07-01_09bb2ec339aa01dd2612d9864da2c8f5_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-01_09bb2ec339aa01dd2612d9864da2c8f5_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:6036

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 38.4MB
        • SHA256 9be8743cc5205ccb59e09d0a51e60745950968ac4309f0fdc305bd5c6c587169
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 38.9MB
        • SHA256 9280c6f4aabefd1db3fe0c696236cc1f1b9b848818a9bb6e9cc6799ad616a933
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 76.5MB
        • SHA256 4e0d11be46b1833e8b4105196374afecd63a58541155fbd4d2f0ed877f82e23c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 75.8MB
        • SHA256 63b9f6eae9cae291d5486ccf35cc0a013986530abbd71504cc92de71a6f1905d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 76.1MB
        • SHA256 5313eb35f2c9234eb73e246cbc5181123beca698c7ad0704538075edda47720c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 75.9MB
        • SHA256 ebc85478fe45512215799f51032bf33ff6f5e8d73ea6d453c06bcece9d378750
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 77.9MB
        • SHA256 f163b07c14c04f7b49cfe0d2200dd36ba744a9f880d985fd68f17b3a87bb2c24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 76.2MB
        • SHA256 c42758bbf15fb228cc6ea24e39a6a2fbc34b5ffa83fc6bf08673750a751fd0b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 77.9MB
        • SHA256 6f794bf96f8028d3285dfa876649383a295bf6440aa6df9fd546fd480caf2913
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 75.1MB
        • SHA256 23de3539fb25cd69ecb0fb079e1f227d96239b0b123777d399ae988fc3c8a88d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 59.2MB
        • SHA256 ea16d5da3c5444c18cd02aed41d7eba5db8f29a698627bdf276d20e69735c5f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 58.3MB
        • SHA256 a34fc83dc31c963db0ccc6a33675510cad8d42f928cd8f59df32d99b797a878c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 67.4MB
        • SHA256 31e0e2ffaaaae4aa0b9af2aa7f911a66212eec0d67b29a742f4b0681c885f7e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 64KB
        • SHA256 79a0b1f3b0958e830806c9254c2ba2af079ac99713004febcc3610200c9f504e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 60.5MB
        • SHA256 dbcb55ec8e30852745940d1e6d1265858e3ca031fbe79227d5a9cf3b29e65d9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 57.6MB
        • SHA256 019d0feeeb4db46b553b3f62d8920bc98d4011d30d79b13d6e288a354a147cf6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 57.4MB
        • SHA256 6572c81bedbdd4bdb6d23522c5ab85de9b9a090a6bef68084d40b3c08ffa00f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 59.1MB
        • SHA256 9a196e9b2d312f3f184908cdc1a7f775a14524e4098d440f4e940527a3109ab4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 54.4MB
        • SHA256 95cab8817203c517e88f90e7281bce9169833da43dde161e7e084f5375338831
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 54.8MB
        • SHA256 1bae8ebab4ff429771e194789db3e38e50674cecfcec031a816fd55dadbb9546
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 54.1MB
        • SHA256 3c0feaa013d858ad6aa09309b82c1d4719d4057eef5762fcdee993cd8ff80a9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 52.4MB
        • SHA256 2b45089b447cdcf2634496b741fc8d3fb0c4e8bfc798c345caf67b37f0df7791
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 50.9MB
        • SHA256 667794ad856aaca3cbc869674bc310e264767227aaec76c95d35a4f710c55aa7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 49.6MB
        • SHA256 fbc0a5d9ce094b31df9e3f7e5d0c9c7847a7c5fdd18fb233b309556fa79bd566
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 48.9MB
        • SHA256 9c4e68e86d444848db0e1ac402738fc90ec5588ef3a5574828d5893f47c6147e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 47.2MB
        • SHA256 2d347e8c836b12e51011ddee31e3a30a19fa28dcb79431009b17f19a51e219f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 43.5MB
        • SHA256 0bd1dfe1326cb3650f708dd80b4f4031f2dc6940b519983975478dba4011a753
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 42.1MB
        • SHA256 e14c201db0689e8fe3bc9c99772073d70b10aa72fd16681e0217b673b1785c0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 40.9MB
        • SHA256 4f26e9229c4f735bcf95cc5175523bb6ecae0baa07bd4f24ff25834474dbb82c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 40.1MB
        • SHA256 36a5388983e64ce4f292c004448053ee536a194ff4b966ae20fc40b2d53fd93b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 39.1MB
        • SHA256 24f895a2aba580f67bf8abb745cb38893aca7c73f84904af097fc46f3bc68ba2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 38.8MB
        • SHA256 259b18efd70382489c3786891a48d48c70a4fdeed0fb6e6983b6e05d1dd9dbd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 38.6MB
        • SHA256 b5e03889414ceb4e6c659095ef8a31a50b06204ab1784de091e1e37d7c32b999
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 38.4MB
        • SHA256 6cd1089af893cc2246bb048c08938af664600a1b11339d3a25acf3d4d1c4413c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 37.4MB
        • SHA256 8a74da9b4c8f11614e6dedb6f659f968e832f0889f4cd6ed2bd90a6b65144174
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 37.1MB
        • SHA256 d839dfd30ed7ade2b6473ec606e3e4301acc09ed3e32215982f1b93d672eed3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 36.6MB
        • SHA256 cbe530ea0acd30d29a5ad5607627417c611e5e84c76a64855cbe8b399c68054e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 35.9MB
        • SHA256 fb76538dc51f835689373057c82d569af26a378f8796a411e2b7ba47edc42313
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 35.6MB
        • SHA256 8fa54c7c0be6f4b6d2e657090317880774bc48828d23c98611caf58ea260c81e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 74.1MB
        • SHA256 3e5696736d18313f9a568031e88876735a0bf725f91548ca64817af51205e410
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 73.4MB
        • SHA256 9768286188ed8a5cbaa16254b1ee1fa4464f06184b7c482b9626b601ec0372a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 71.6MB
        • SHA256 3ab292082eb508d1f8e6c81b87b5df0ac0746ac4e99a3951d460cf78a456dc57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 69.2MB
        • SHA256 0e3e40eb1a475c9737f2addb041dfe2da1cfa786a31ad4e94155aa3ce90515ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download