Overview

overview

8

Static

static

3

2026-07-06...d_.exe

windows10-2004-x64

8

2026-07-06...d_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    20s
  • max time network
    123s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/07/2026, 15:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-06_51aa6899eee6689b05e295d46e93d357_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
  • Size 18.0MB
  • Sample260706-sncaxacy2r
  • SHA256 36d52c99193f77a9ad626bdef10d90e4c0374630af78b788b0a16b9775850e28
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-06_51aa6899eee6689b05e295d46e93d357_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-06_51aa6899eee6689b05e295d46e93d357_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1316
  • C:\Users\Admin\AppData\Local\Temp\2026-07-06_51aa6899eee6689b05e295d46e93d357_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-06_51aa6899eee6689b05e295d46e93d357_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3376
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2220
      • C:\Windows\explorer.exe
        explorer.exe /LOADSAVEDWINDOWS
        2⤵
          PID:1220
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:3380
        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
          1⤵
            PID:3000

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                AppVShNotify.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
                • Size 18.2MB
                • SHA256 92270ff0cb6b6704e7303870d2b86ffecd24e270a551c82e64f3740ac743310f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                InspectorOfficeGadget.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
                • Size 18.0MB
                • SHA256 36d52c99193f77a9ad626bdef10d90e4c0374630af78b788b0a16b9775850e28
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MavInject32.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
                • Size 36.3MB
                • SHA256 976af0215d92869dd3a8ccd4e52d1536d3b3dc58607075d602129b1455187472
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                OfficeC2RClient.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
                • Size 48.4MB
                • SHA256 ef2af5332aef604e2d89c8f66d6e037bc931c5a87c569307c62cfd7a8344f9f0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                appvcleaner.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
                • Size 20.1MB
                • SHA256 101c5189b5cd0d115e3582f3566ea8de08bd130c1bc3cb304bac92657cc574df
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrmstp.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
                • Size 37.3MB
                • SHA256 82fe1c4da483b9ec528189f33d472068d7a0f39bc6d773df265f6a1b826b65bf
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrome_pwa_launcher.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
                • Size 37.7MB
                • SHA256 fdf90354ae7893d4a10594884374a26e809982bfa87b8efba250cb9234584bee
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                elevated_tracing_service.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
                • Size 37.6MB
                • SHA256 636fcc426e50e726a2d170e637dee813ec09f7c67eeb7312911c6694c4a09f07
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                elevation_service.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                • Size 38.2MB
                • SHA256 3a1e0a8a3e832b342608487620410d422465fdad293f8000e45315f634cedf07
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                notification_helper.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
                • Size 37.6MB
                • SHA256 671ce42521fd6e015c7d7a59f0689f363395bfc15fa3ee0530f8350141f8399a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                os_update_handler.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
                • Size 33.6MB
                • SHA256 4ac8550261e7e2bb5cee168c0f43ca1bf90be3011c60af664a183ed28f1e62d2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrome.exe
                • Path C:\Program Files\Google\Chrome\Application\chrome.exe
                • Size 34.8MB
                • SHA256 0fc4556800ccab7ff881f7d5975c5204f135c9cd2a23ebffb6fdfe98e2aa6360
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrome_proxy.exe
                • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
                • Size 35.5MB
                • SHA256 3a31825aadb8d0f16ed5e55341c5c5fce3be59520aeb5b3f0afc5606e008fcf7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                appletviewer.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
                • Size 36.0MB
                • SHA256 b7e043751c11a73acbfff796d6286147f6636d4cfb1b3561e68d49657b0cf874
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                extcheck.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
                • Size 36.0MB
                • SHA256 b31b568aaebe730290eb11119c9f74f047ba2b0f88f270e8cf3239332ae55fb6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                idlj.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
                • Size 36.0MB
                • SHA256 a1e7bcdb014c3b13d7a9cf2be97cbe514893fa2a4b3d8c8e5d4cde95203cf8fa
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jabswitch.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
                • Size 36.0MB
                • SHA256 a5d6a9542fba24c00a145e89c4f215c432da09e4d571ef653bc8f96f818b38ac
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jar.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
                • Size 36.0MB
                • SHA256 d07babf0842dd6003558a3532bd036c7f49e94df29a348915c496520a978014c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jarsigner.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
                • Size 36.0MB
                • SHA256 abf38503fc6c0777138eb5cd4704f25b5124b666e5b7b67e1500edb510895fd1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                java-rmi.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
                • Size 33.4MB
                • SHA256 063deea77a0aa0b84cb24285061e8abc67b81ddd0abfa0998480209746dc5d4b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                java.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
                • Size 32.4MB
                • SHA256 c3983e21b94feda78baaa1bab9e66b78520c5d195ce1b97332142b5f7fc92c6a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javac.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
                • Size 36.0MB
                • SHA256 202ebe4684052eb878a706f5646174f2aa9adb09b0dbdcc2a39a03afc20a78bb
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javadoc.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
                • Size 32.6MB
                • SHA256 7686b27508ff8d136e1bc7dd0b3a7dce9907b7f35ea8d11d5e7b552209a52b83
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javafxpackager.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
                • Size 36.1MB
                • SHA256 15f74eff872a6a851ad7214328e0fc57fdf9d2385289495eccc91c3fbfda8c0e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javah.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
                • Size 36.0MB
                • SHA256 72d76894d584c04445a35bb4086c7dbb62434e98b38301421c6cbab3c8049abf
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javap.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
                • Size 32.1MB
                • SHA256 a01f3ce89aab6823df77c16713539aacfb6a1f27945fffedd3194640a64ff2ad
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javapackager.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
                • Size 34.1MB
                • SHA256 a8a37950bc68f4c56ab4d0576d2e613f244fc169e710bf7845eaa07b38df9ac9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javaw.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
                • Size 36.2MB
                • SHA256 6da2ad69cca85b6e8aaa42054e2f9924d512b487575c7b8e318eb68deaff9d64
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javaws.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
                • Size 36.4MB
                • SHA256 02984a7847915e73f4e9bcfc2d83e10f55008e3b9c005afa616612c479afdacd
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jcmd.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
                • Size 36.0MB
                • SHA256 2b2514e36a142717bd3f5253268bf77e9f85921d75f0f5642d18b49b744b9fc3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jconsole.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
                • Size 36.0MB
                • SHA256 c94d6fc36078f04a049f4ee45b89afaeb1a4ba0541e2170187f8991e7fe84b31
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jdb.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
                • Size 31.5MB
                • SHA256 86db75c82767941931154dc77171dfc8e4a144e08ffae40fec9af2a6a74ffbd9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jdeps.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
                • Size 34.2MB
                • SHA256 9a86f32a3912ee5652a796ff7d3ddf0e4cca37c4d4e1ff0170324ebe2f08388f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jhat.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
                • Size 36.0MB
                • SHA256 623f0779f3a3616ba66759805ae270ed23e7840f9b2f2c1dd0301b55d3b9fad6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jinfo.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
                • Size 35.4MB
                • SHA256 012fb409cf59cd2ca2c06e8dcc65a256356d71023f428f1b29932cbd4888fa98
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jjs.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
                • Size 35.2MB
                • SHA256 303451db3a8d9a5cb9122cb64a9c6520103c67ea998621425ced290a65bbfcfb
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jmap.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
                • Size 36.0MB
                • SHA256 eb232c722f98c7dba6e22fb7a27a4a04c8bd134aaf069b4c6db43de7f5a25c09
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jps.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
                • Size 36.0MB
                • SHA256 db77b59c056f9216ef19917dad4fb25fca23acc7574b8bd99da73a51c7bc395b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jrunscript.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
                • Size 33.1MB
                • SHA256 ab353cfa0eee571dca663eea6a95ae768a363c02f79ea7e768a3688df7855561
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jsadebugd.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
                • Size 31.6MB
                • SHA256 bbad1ca638bc1e2632d08f6766af5b84a6313d5382fd4ebf87ae042738982639
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jstack.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
                • Size 32.7MB
                • SHA256 a1e0c9ec165171d6173d8138aa70583c60a24652ff2870245ac96ae751e16eef
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jstat.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
                • Size 35.0MB
                • SHA256 380ea384fa35c7d7a75260fc61415d46a9f9e3e002523367c1b1da06dd194e5e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jstatd.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
                • Size 36.0MB
                • SHA256 c3c1dd48dfbe11263e36abf54d7db076fbf20ad84818c930b6494cd71d60dadb
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                kinit.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
                • Size 36.0MB
                • SHA256 458a5f57802bf064279650cf5c1ca4b78695a8964b490653d064bb5aa4f8d33b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                klist.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
                • Size 34.7MB
                • SHA256 8a9d6678f048bdea4f2bdd1c279b4584a87de44cff430bd9523ca66ed4fb1f9e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ktab.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
                • Size 34.9MB
                • SHA256 ec6c5d537104c8c30aad628680df7e8e6a2e395f1d7ffc49fb2cc693af396a88
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                native2ascii.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
                • Size 31.0MB
                • SHA256 2a75d85a0151f0663baae0b304e989dbd8b69704dc9e055418cb37b6221da46d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                orbd.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
                • Size 36.0MB
                • SHA256 d4a2f9bcc0cd2e9c8bd5bd04c6545e8bc668818666effae50917470905bdd9b5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                policytool.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
                • Size 30.9MB
                • SHA256 6faedd2e9bdbe87de4c0b206ba6e7e66e1b367c5bb6159eca6d5cd9adb86571e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                rmic.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
                • Size 32.8MB
                • SHA256 c232124789b2239609ef84949f812ba55e80c1dd25d6910f6a012da0fa150c27
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                rmid.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
                • Size 36.0MB
                • SHA256 cfb3229dc58a3404b6ef4b44601249a8f2ce709a0e9d7b5a278a7f6c2367b96e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                rmiregistry.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
                • Size 32.0MB
                • SHA256 4a40bbc70949c69b68f6b12cd2d351b22057996f9e511b95c68fcad883c01659
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                schemagen.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
                • Size 18.0MB
                • SHA256 8f4f24b667fcfcf9534fad7609e273e84ee44f824451c24623dc52cf9581325a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                servertool.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
                • Size 33.8MB
                • SHA256 27477546a442a8faa4885bf0a54743f264e13a6c22cdcbcdedf159326a3babe7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                dotnet.exe
                • Path C:\Program Files\dotnet\dotnet.exe
                • Size 36.1MB
                • SHA256 19df978c9b5e505bbc6bb0e84a1d3aeff057adac0730acbf0877d8b6e34140e9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                createdump.exe
                • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
                • Size 36.0MB
                • SHA256 28a028e15f956eaa1bb9afc1b1c643d6f5ac082e75943a55b234058e5d59280a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                createdump.exe
                • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
                • Size 36.0MB
                • SHA256 8ae0771c27e0d418ab5f367590fa439a517c498c831daba3f5d7ac2136396774
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                prep_Activatable Class_Hermes_perf.cache
                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                • Size 595B
                • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                memory/3000-379-0x0000017E03E20000-0x0000017E03F20000-memory.dmp
                Download

                memory/3000-348-0x0000017E001E0000-0x0000017E002E0000-memory.dmp
                Download

                memory/3000-394-0x0000017E14260000-0x0000017E14280000-memory.dmp
                Download

                memory/3000-380-0x0000017E03C40000-0x0000017E03C60000-memory.dmp
                Download

                memory/3000-378-0x0000017E03A00000-0x0000017E03A20000-memory.dmp
                Download