Overview

overview

8

Static

static

3

2026-07-18...d_.exe

windows10-2004-x64

8

2026-07-18...d_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    141s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    18/07/2026, 05:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-18_fe65bf979f3629a09de947387e38b280_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
  • Size 44.7MB
  • Sample260718-gdpygacy6t
  • SHA256 a94cf02b7853f7dfc655db58117aaf0e5febeafbaab5c70142b52f22b12dcf85
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-18_fe65bf979f3629a09de947387e38b280_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-18_fe65bf979f3629a09de947387e38b280_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3428
  • C:\Users\Admin\AppData\Local\Temp\2026-07-18_fe65bf979f3629a09de947387e38b280_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-18_fe65bf979f3629a09de947387e38b280_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3520

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 45.3MB
        • SHA256 6841078c5f2cb5b7208e9babc36f5bbfcece2048c25ba72e846fa8374ed6deb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 44.9MB
        • SHA256 1c9dbfd6545b805458be5efc38816ec1036b7475ca89da002efa180536bddef5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 91.2MB
        • SHA256 9a9f8b4add30a437289605490acc53688c380d1e17ab872eb46567b36b1514d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 92.4MB
        • SHA256 0fafbfe0fea5f476fc2f832d8c955d64bada09aa5bc61c9690361b7fd7033f8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 90.7MB
        • SHA256 c0aee909e84c14029e7a1d062045ef29312f0dfb1c227a593834c6603b45901c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 89.3MB
        • SHA256 86a152f7b4e66e78469bcdce9d3a6c7e7edc6d756b80ffbe306cc1249d0bf50b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 89.3MB
        • SHA256 bc5a02f753fc4b30a85057b28fdee521ac32d1b96d275eb8b0fc46005c963c91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 89.3MB
        • SHA256 203ec1900be4f54c228fc306266f3e34915814945ed4d9b6ea2015aceb3af47d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 89.3MB
        • SHA256 1acc77dd43b17e819ee91044cc80a171328f50eb6e56ae74564129f578f7fb20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 89.3MB
        • SHA256 0723f4d72e36c82c9523c44cd5941c9fc66817beecb4106d5f55bdb983451403
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 89.3MB
        • SHA256 235005f59925c3bb2aaa8324f68af310037857dd24c2593455ab59255f40c40c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 89.3MB
        • SHA256 4af33cb711a305433a387f4924c1859e9c2da1c815c406ec194df381d23b79e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 89.3MB
        • SHA256 f1248d2a1fd4e971dc769ea7d7d285193ed1b54f967f9c147932d7b29a6f6849
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 89.3MB
        • SHA256 131ac0c0ed7bd396f0888f19eebd3de6ad8a5f2f489013bfbad9e3c4e92f10b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 89.5MB
        • SHA256 776f8f86e5a44d77bba7a0d20b8c0987f60c0fcaf777d5cb6b85a136435bfe3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 79.8MB
        • SHA256 f145c55403f1a0ff59f6abceade551cc9eb3fab64f778e4afe3effa09786095c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 72.4MB
        • SHA256 1c5df36a2d2b4b66d1888556d37133f73f00c1adad0bd1fcc48b9926a56ed52b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 86.0MB
        • SHA256 6db8339f3973050a6cdb83d293f302cdf7efd82677b8534d65e6b9e20d9b9efc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 85.5MB
        • SHA256 ed43d04acc4264f49a37fc9900af8751094aad1aee3c597b7c087e43b50ab486
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 84.6MB
        • SHA256 eb269a41a949e91d1ed1be06b64cdc0679985bf69eb2c8ccdf5bc9ca75ccd6d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 85.0MB
        • SHA256 25a89c19d006aedb9cd79eaf4ba526315e13c1787640bb84e7c168ffba12d104
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 71.0MB
        • SHA256 f4d6fdd0f20c2b55a54581c3ac90d474768d4a93cb0b21a402599baf99c103bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 44.7MB
        • SHA256 a94cf02b7853f7dfc655db58117aaf0e5febeafbaab5c70142b52f22b12dcf85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download