Overview

overview

10

Static

static

10

2026-07-02...d_.exe

windows10-2004-x64

9

2026-07-02...d_.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260630-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/07/2026, 11:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-02_c1c7ecdc35c9c9a0207944875415c1a3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
  • Size 13.9MB
  • Sample260702-m34e2sgv9v
  • SHA256 aa72ee3feab21cedb8657699958fe4017f624e1b1dcce813baef4e34106b0d0d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
discovery

Malware Config

Signatures

  • Detects executables containing URLs to raw contents of a Github gist 31 IoCs
  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen 31 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-02_c1c7ecdc35c9c9a0207944875415c1a3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-02_c1c7ecdc35c9c9a0207944875415c1a3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5036
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1796
    • C:\Windows\SysWOW64\UpdatAuto.exe
      C:\Windows\system32\UpdatAuto.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4020
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
        3⤵
        • System Location Discovery: System Language Discovery
        PID:360

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 14.5MB
        • SHA256 2ecde3d8c470e771a59d1dcf93340007b4f9a1962a9dc751aefc06bef115e6cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 14.9MB
        • SHA256 19d7f347d69aa7e7f0fd3bb34f1558a0b79d7861c51b5eb5b4bb4b1b4ad62e28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 14.6MB
        • SHA256 9a78950d2ad9fe49f7decc2111b6daf8b3ef3ea6f90cd7532d9abfdfacb01705
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 13.9MB
        • SHA256 1da0671b30f0da3295899fd8941eae1c383c9e0c699f7cece623a681a674b488
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 20.0MB
        • SHA256 e0f72bc67e15576fa59783276e8d2fd2d14f13aa0873cde89b3e2c6bc76e3bc4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 15.6MB
        • SHA256 e123ec4a28573de0df0698538ca75c0f45b62d4e2ce22851766c99f8318ebdf5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 17.4MB
        • SHA256 ab2e1c8855eadd3b00f42a55772e459d24c8dfaa9f2366323ae66f78f8ffa967
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 16.2MB
        • SHA256 8144b5b7ed6d91fb9d79161fe973385b2238954038f3004bfb370966fb9eb3c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 15.6MB
        • SHA256 a89ed78009bf98ce0fb21085f1ea97c36431f90eda6cb8b580ad58c5d8face4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 15.8MB
        • SHA256 a7bcfeeed1ec718bd5993403eb728c2679a929648e0e1e56f53f8bd29d9ede03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 17.0MB
        • SHA256 f6438e28112e2b70b52080fe4107b6a7c1562fd2f4466aec2d487b0a4481e582
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 15.3MB
        • SHA256 579318f4bc6ed7f1fc36e3fbdeca3cd5a4f1a0bf9136512b4b49a1b5df8eb378
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 14.0MB
        • SHA256 a69538fcda844d0c9fbc9c08c3034bf49622fe40a7dd1f40bfa8b49b8ea08e3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 14.0MB
        • SHA256 d353bbd8badc56fe6ef54633a84119438f1516ea6a7c14274ff4076c60ddcf44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 14.0MB
        • SHA256 899fb72b944e2d88e53fe230086735a2553be0ed2bb40965e76450b410d0ac55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 14.0MB
        • SHA256 8de2e06f9b7c617daf72aadf4f17ae0e9ec3039536e49eba9b2152c051396c44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 14.0MB
        • SHA256 7236b97ac4e1f5a7ddaa7cf25d93b394be077e2b932f7deff1ffc0c0096c39aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 14.0MB
        • SHA256 0eb0d36c69ec29a794427959fa761fbc1da60601d5832eba97e23697774b4f46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 14.0MB
        • SHA256 cde9bd881c1600c38a4f9e8b184cab8a26145f801b01b2df06f475eac5b0ace7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 14.2MB
        • SHA256 74bf158628b220c7d2a83585b557dfffdd6351957f9e7c8ff58583c2d26b6fc2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 14.1MB
        • SHA256 4e5fe8d22acbabcb3f076535a4fa48b5ecac553216fa2d47dc69037e4ce90859
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 14.0MB
        • SHA256 783b5d869c65dc93fc9cae82c976d0afe4851b0723afd36ee2c32702fec6839c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 14.0MB
        • SHA256 b2f5931999fbf48d41fc3807947f2707fe47ee888118e633b33b7b9a684b0af9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 14.0MB
        • SHA256 5089809c34e19dac48f15ef43ebe7c3cda2bf3041c8e62756e525ac6b3085c79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Option.bat
        • Path C:\Windows\SysWOW64\Option.bat
        • Size 53B
        • SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UpdatAuto.exe
        • Path C:\Windows\SysWOW64\UpdatAuto.exe
        • Size 13.9MB
        • SHA256 aa72ee3feab21cedb8657699958fe4017f624e1b1dcce813baef4e34106b0d0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 13.9MB
        • SHA256 235b32bb93b1b24c2059501686ca8e9167d4067a98ba12539ab7aab2f66abe6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 13.9MB
        • SHA256 89d3581ce7d70757e37bb89afb8b107983329bdd6e2a2be547e819fe6e1aeb50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 13.9MB
        • SHA256 50172e3d8b62151fb818a056b5da59b3ca5abd3fad954021a42c3b0a1f43a1fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 13.9MB
        • SHA256 2602092cca40a733c4f7242dcf5276cffd62e142fc373b9f2e588f242cb3a9aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 13.9MB
        • SHA256 d32e1332e38365f9f56613a8fffcd6e66461cce3feb71779a2508aaf618f206b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ntldr~6
        • Path \??\c:\ntldr~6
        • Size 13.9MB
        • SHA256 71fd7cc87f058b248095c4d8f9a12a7a3103f85d5b9e081eb5454db694f16fa1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download