Overview

overview

8

Static

static

3

2026-07-18...d_.exe

windows10-2004-x64

8

2026-07-18...d_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    36s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    18/07/2026, 05:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-18_ff59311896a0f3ba1284238034f2863f_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
  • Size 44.7MB
  • Sample260718-gc7f5acy41
  • SHA256 53073293fc1497b4633b03c74332b928aa29d154dea7cce9cf8c4cbf6d7d1aff
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-18_ff59311896a0f3ba1284238034f2863f_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-18_ff59311896a0f3ba1284238034f2863f_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3224
  • C:\Users\Admin\AppData\Local\Temp\2026-07-18_ff59311896a0f3ba1284238034f2863f_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-18_ff59311896a0f3ba1284238034f2863f_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2616

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 45.3MB
        • SHA256 4bcacac4d7b96c110aa2f01a0db829d1e436642165a7d54607e2b92316a4081a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 88.4MB
        • SHA256 07e5a5c349e0bb4e59a8924f53e67eaac9ae089db52f1341f2301c24b1efbd2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 44.7MB
        • SHA256 c7dfc4d6aadc5059ae39aadef461512259168c6bbb4b67c8db8df48bb6d668e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 48.8MB
        • SHA256 a9e90c7a39394352a20ef52f361cc6d8fc16f7a5375fbac9907f195911737041
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 45.0MB
        • SHA256 65e3537b0ae945799bef46aa2fe831649eb94d07123a82791f8aaf2780670508
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 44.8MB
        • SHA256 1b343c31ed36263f9e8ccddf27a4e3e04118b60387a3ca6f7968f46801a48e63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 69.4MB
        • SHA256 09a1cc59cd40c4abba3ae911b5313fb58acf8d53665828b6cf5a2f4e1282da7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 67.5MB
        • SHA256 b620139b4ecc47137f13f2501fac308eb1295925aa53d2ea28ec0edf8dca312f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 69.2MB
        • SHA256 9255272fe8f050bf6d2616b43f8218a2b8045b7faf97556675587894ff2d365b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 65.9MB
        • SHA256 77727f6f113d3e62bd19f8bdf6180a3c8e279634f9cdd564842b24ae05e2db95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 65.7MB
        • SHA256 702ce89c3b0afd7e28cad22b7aa951179bb62ca570e85f67dc81655d03bb8024
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 44.7MB
        • SHA256 fae18b9467048e4493a9bc8cbd20b013b05d9ee5c90f6c5694412a4893458dac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 61.4MB
        • SHA256 60d9084f11336b3f2a699efe83eecff754f56df12066574947e6aa019d26c763
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 58.4MB
        • SHA256 a269b89bfcf42e520a8f2b619510d5abe55e8006815dc5a0aa04959a90cb6332
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 1.2MB
        • SHA256 0d0258c89e76dc4257d5b19fb97ad8a3c681955e184d38b6cd889691eef84576
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 55.6MB
        • SHA256 0b8dc0e683519717e51bd037d82f522ccfecb8fea1cfdae0a55e290a99dd9e2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 54.8MB
        • SHA256 fd05c420a8e5db778292af7c750dd4648470086217da74dc03daeda9b74ca60d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 53.8MB
        • SHA256 06a52dc684c5ef85e760e87625409c5fd5ec9316216f72322ab8e5862018c626
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 51.5MB
        • SHA256 bb486d3866633e486875e4baece2b4d8b45e8b20116a93bb69e4292ba9346da1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 49.2MB
        • SHA256 df27251a88fd8031976eb947f796a25fea2e5573ae513a2ab2687d894b5e73ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 47.8MB
        • SHA256 812d14b38fe183508b9b29f248d07c40a04607d7ae7a2f784de26359eb8512df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 46.6MB
        • SHA256 f5295035845830cf0b5b5f08d93f12f913981b7fa92371bd3fdbe908c503df4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 46.2MB
        • SHA256 d26fa4346b7cc64731b002c49a76195880bcde62e7ff2de85e82c8b07b670111
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 9.0MB
        • SHA256 2f2d598adca6992d5836df017b84b431535ac3976bb0b54dbdb5267769ea7d41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 43.5MB
        • SHA256 64d033961eb7aa5116397d36683000d616a334662ee8c8913b09f5ff20874372
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 43.0MB
        • SHA256 c435d80d883d5ee193d954f750a5665ae9732688bcf279ee092e62a36f824ce6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 42.5MB
        • SHA256 d787d490202705168b2d72e3550f416441dcb6c278780f248fcb25ae1297c022
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 37.8MB
        • SHA256 d3ed0df70c0b5795ec4f47a46816df79d61fb82d3dbce1fd618e6904ebeb87a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 37.5MB
        • SHA256 83e944cf7a5c6a529b99a95140563e7dcd6d38534ffda2bbdb075a0a925739c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 35.6MB
        • SHA256 6628dfcaa9c9a6f9bfbe3428eebe1f30cb2629948ba302fc3e348d7d6c978c6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 75.2MB
        • SHA256 20ac1458a2ff5c3e0d4a1f587afe91430bb1835e4b1ae9eb403e6d163b37a959
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 72.7MB
        • SHA256 60f69d7625093a45924171d32484739e2f91a06282a83daa4c24ad1728642407
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 71.8MB
        • SHA256 9309c39a6d7a8480f828eb16def8eb293287bbe86bb84fb8903f673c3d0559a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 71.5MB
        • SHA256 3282814866758ba5cc9d29061b2e71f2669d14ca4e408db259224b0428cad701
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download