Overview

overview

8

Static

static

3

2026-07-18...d_.exe

windows10-2004-x64

8

2026-07-18...d_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    140s
  • max time network
    135s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    18/07/2026, 05:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-18_fe65bf979f3629a09de947387e38b280_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
  • Size 44.7MB
  • Sample260718-gdpygacy6t
  • SHA256 a94cf02b7853f7dfc655db58117aaf0e5febeafbaab5c70142b52f22b12dcf85
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-18_fe65bf979f3629a09de947387e38b280_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-18_fe65bf979f3629a09de947387e38b280_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4548
  • C:\Users\Admin\AppData\Local\Temp\2026-07-18_fe65bf979f3629a09de947387e38b280_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-18_fe65bf979f3629a09de947387e38b280_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2924

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 44.9MB
        • SHA256 1c9dbfd6545b805458be5efc38816ec1036b7475ca89da002efa180536bddef5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 89.4MB
        • SHA256 729a4293e3b219ce3ea1fdc02cfe8ada6d421aea7ad7e16095a5c8c3b6774557
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 93.4MB
        • SHA256 013f6ec380bcebd3dffcfb8013ed448d7df69316aff509b3b7483e3e7f8fe805
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 89.7MB
        • SHA256 dcd97a60e7178fe139d7999ea1cc8f25d125cf0f618793481e837626876e65de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 46.8MB
        • SHA256 45bb05c0cda0826fbdf51bf15148ea01ed7c2e0831def56662e2574069e83d73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 89.4MB
        • SHA256 251224af72a258019d7c45b43945f5d6f412bcf29933f74770fe2f8e5d6f8295
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 79.5MB
        • SHA256 da4b577171a2c32fa7eadc721bda7a2e42b09282923ec7578576258eefadbda4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 79.4MB
        • SHA256 9a968d83df1fab31c8c640a906e49aaeb8e1685d0db1db2561bf44982bcca451
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 73.2MB
        • SHA256 a2b7648a463dfbeca8ea1406dd87027fed551e4ee3c9ebe7a2b1056c5f9ca43c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 70.8MB
        • SHA256 4213e48e1265adf4eb14a69cd637d46f7369917a32679018de2eac2206e7ae0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 68.8MB
        • SHA256 7313747890ec742b0faf2b182ed0646a56c0b7e116aab5adf0bbe8480ba965a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 64.7MB
        • SHA256 f2eb5e2c3c4c0d79e840a3b1c62d92122486e36a9cc0021622c5df7ca2a69f24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 66.4MB
        • SHA256 6353608fd43f5b4ac5e46508d3a27a1394979b657eb0f472f892d750263c1d65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 66.7MB
        • SHA256 8444a7002ffda9146d93ed98b386b77d63888e8931a5421aa46fb84c20925b40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 56.9MB
        • SHA256 566984acdc14f72e56b2275546865ec763abf9e4601854dd9e171bd5439274b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 56.0MB
        • SHA256 cfcea468cffca1c1d0ca4db5cb65eb5dcc0e5c9b338d1677622c0798721bf860
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 55.3MB
        • SHA256 863a6a46fb186dbd9c9983ba26597aca4064fe585cb0f5910f6a678021830c8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 53.3MB
        • SHA256 5f91af62355df5496c1e11e902362535ebcd93349f7e7935822febc4fe8ad969
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 51.6MB
        • SHA256 0a3320e7ab195ee77d872c160c8c2d69e39215965b40a7e2c2d4d3ea3089b89e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 52.4MB
        • SHA256 10cc1f525628afbd50bb3bac9e55bab6087fced5dba105dc6c64340c85d2f3cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 50.1MB
        • SHA256 031b61a0d8fa9380729016cf251ec5f5a7244d836ad8759b004a6b892cb33341
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 51.3MB
        • SHA256 65be141f864ee14126ed77f7550419c3b9dd0c1b60d4414eb5d7233474369852
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 52.3MB
        • SHA256 0c8ad369b0447aa40d1dba2f4d706458e9c303aeffebe49f2a69a579f231fced
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 51.9MB
        • SHA256 8fd59094b377b4b3df2c9c9838fc3f64319c6a041822de2790678f068d9ef0d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 46.9MB
        • SHA256 65800a103cb7cb60ce3af275e9663b580e895da65107a963c07bd8935479a537
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 50.3MB
        • SHA256 52f8efb7039ec7a170d27589c6d298ca3d202bd03e4b8de25186d5fc8c51f1af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 48.7MB
        • SHA256 14e310c74f35d434e18e1aa04de5fb09320f481747b454a6e67492ec86db3561
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 48.4MB
        • SHA256 eec68a45aa8ea032935b0c65cde73b55fdeb85f6d857fa3568a38de6ca229be6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 42.8MB
        • SHA256 4621848d9fd9874ee09e43068921cbed3280d4b76d04011f777e23737a0ee864
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 46.3MB
        • SHA256 f4d8a6637f4d6550d9b0ca2bfdd491ed854d41dbfd36fb4b7496a0d08e34c91d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 45.7MB
        • SHA256 940df7e4f8eb5df22b32cf0882fd1837a2eb16a47485db583bc9b6894ce8aa15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 41.8MB
        • SHA256 c53f608131278448d8d8f1e0428d1711e5474af14054f2c8766632715caafb3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 43.4MB
        • SHA256 002704c2e63ab7c9d75c0e6f93ff34207e3539ccae73066b2b5a5cce1af9eb53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 39.8MB
        • SHA256 88bfb4ad6c8a4c1bbb528c0e096f888d9a4e35424387c68236e032f1ffc566f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 40.4MB
        • SHA256 af488f0a64d1297aedc08527e73895540f77222964061b0a205c74432c8945d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 40.9MB
        • SHA256 ac30893ef2f6033a74297c65bca50bbf644cbf8b04dc4e9733b5e11ef98baf02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 37.3MB
        • SHA256 13a0cb314682a02cd8faf06cb77894786b70d58d1492dfb0bdc77e63c3f0cf7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 38.4MB
        • SHA256 d070c40655dd63abb86fb036c2b972c4d01b58bb1a7f73470b1851158dd8eb77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 39.2MB
        • SHA256 304dc5923e39e54a00ed848d3a5567de9b41f9950751e54dc2850f1f8cb9eb98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 38.5MB
        • SHA256 2f973a182cfc4a01cb28cf4bb3fcfc14e2112710924340bc3be9fb741a62644c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 36.8MB
        • SHA256 b824949ae30d404b9b4e8bc82d478f9a6f09d748bb36824f0d4e251bb2cbeff2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 34.7MB
        • SHA256 f353131afe7375b2854f3f99c232930505e17f18aae1be8113f8a85c1244c2d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 30.9MB
        • SHA256 df0275370210834b367de89dd8b4057211f932bd5ac4f168e1facce252f4b751
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 30.8MB
        • SHA256 594ef8d927ebdc037a0818988c2f4cbb28e19a926d47e3213d805aa8dda29029
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 29.8MB
        • SHA256 069fe367f379147726fb2c916f83c971b199f9e8fafa106d6fcd40317183f51d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 29.0MB
        • SHA256 8051608113af93d71c9731c34db2bb64335cb923b13cdd3dd7fc6ab7c0e7307c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 29.9MB
        • SHA256 8b85d09a1d77db1915da9b235d9123e7c88181615f381cb09f1139b47eb0711c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 28.6MB
        • SHA256 89ba243624036c26daf6786021a30e23886ba31499c6f8ca6810eb5583c2b38f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 28.1MB
        • SHA256 31ab4db4f19571484099c0b799962b60a0aff13944b342c07d78af288d71fc9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 7.7MB
        • SHA256 24d1d134f8e99bd64f8cde1bf809da5fb025d50341f50c57888ab24b84a752f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 7.1MB
        • SHA256 d77eb13a2f7576fd1b58702624b68298f586c294e6e0f252584bb063d4bcd59d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 8.0MB
        • SHA256 5853ac4136ca48feed73d650e1e96da3a1238675778b9ab93f07da017289764f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 7.2MB
        • SHA256 6164612b03eb2bd3d35e2bd8f206bc02fa1bc49d16da4dd0a86f21e1171f0e2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 6.8MB
        • SHA256 b2ebad41dcaa03167fc4349be9ed579460aaf4d35c41626f4245af543cc237fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 9.1MB
        • SHA256 d11b604a4aeefa17fcdfe19626657419b8c67fb229fb2d6e9f3226d078aec86b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 6.9MB
        • SHA256 998b0702cece92f3055020a2c911b683b745f3c22f440fd63fcd205b14dba4de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 87.1MB
        • SHA256 4f48c71d9ead3d585e0cd27bcb55146ac28b806b4fb8d08af43dcf60d3b63a9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 89.0MB
        • SHA256 f16f7f84c1d19566e37f0c88c7c4f4540998009162f9f49f1f8c2ebf51a77bfa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 83.2MB
        • SHA256 1024d0619b36fd001ba6f4b0453c50673910043e04b48255d142b8c60fb199c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 79.3MB
        • SHA256 4d1763caac54c533221880bba45760d37313d295fabd3e14d17cacb8759aa223
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download