Overview

overview

8

Static

static

3

2026-07-20...d_.exe

windows10-2004-x64

8

2026-07-20...d_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    151s
  • max time network
    115s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/07/2026, 19:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-20_9fb572b306a7fa2bcb2bfd0cb789b5b9_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
  • Size 28.4MB
  • Sample260720-xrfjysd14x
  • SHA256 9f574c4c6c9a989f7d249ee27262dc99450aaaa317d6edec712174073be24714
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-20_9fb572b306a7fa2bcb2bfd0cb789b5b9_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-20_9fb572b306a7fa2bcb2bfd0cb789b5b9_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4896
  • C:\Users\Admin\AppData\Local\Temp\2026-07-20_9fb572b306a7fa2bcb2bfd0cb789b5b9_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-20_9fb572b306a7fa2bcb2bfd0cb789b5b9_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5928

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 28.4MB
        • SHA256 9f574c4c6c9a989f7d249ee27262dc99450aaaa317d6edec712174073be24714
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 28.4MB
        • SHA256 29c42cd1ae5aede8a212c26dd43608d884f2f570dc787cbf38d2746241290ba1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 38.7MB
        • SHA256 0c78d5089411d29f6381c497b7e74ac46c7974871b1aef1fa938f3f2ee1b1c52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 37.3MB
        • SHA256 105fc56f2d61b095854b83a3b20cab99bd0b7d08687b3270c280d8ec5a02e3fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 30.5MB
        • SHA256 2baea2acd39122eb59665209cc40a16261799882ff906420f14faefbf0dedaa9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 34.2MB
        • SHA256 dd01aae3e12e735732fe3f6bb25b914d2a403489fb21a8788bd198e3ef80202b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 26.1MB
        • SHA256 821a050bb677ce178dba51d9a9620db72a8bbb176a0ec654bdd78c06735b6b38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 27.7MB
        • SHA256 747a11e506aede23056d7e05a12c48bcd608ec169d84ba269125856637ef182d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 27.8MB
        • SHA256 15e97283fedcf7769390448fc24bba0be47473878455887f2356f2d28e2df144
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 27.1MB
        • SHA256 7d2b72a3517f0aa5c0463ec13d9e431089999563e9b5a3c7bac1e5ea1a9e23c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 26.1MB
        • SHA256 2c40b75e945fb2dce1b4e76b0a51187437a0fb0a85e77830d46ddb27746abc44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 25.4MB
        • SHA256 1063506d1580cc5ea39f1af5980b808649545351ba47c8392594ab4e3f0352ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 25.0MB
        • SHA256 cb689aca9d7566d420b667a3b39d4cc7217e9b548f9a89c1878ec6449b8f3313
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 24.3MB
        • SHA256 d5ee0e658105e3d3446183b76f237537fa767b2428f1cb176f6f21c5417380f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 22.6MB
        • SHA256 5b8f46e9789f5e1993a528ee0ee89418b24a5cf24aab17a5214e2000ec9fcbf9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 22.2MB
        • SHA256 1b17b11217dc5d41a64c75a43506bb47415638fbb836ba478ea037810b51caf6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 23.4MB
        • SHA256 85329d20ce6e819fd55f49c5d05c2835eca1eb8be818341aea902e299f9c678c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 192KB
        • SHA256 56d5b720b4307ef448fb38ef6495ea0a6fb25e8bfa8f9c140729b820c8e0cc1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 23.6MB
        • SHA256 96eaccdcb2089b1130e13e2ad07d3f8a80e6eb8c00b38ae1ef838c11db84ee37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 22.7MB
        • SHA256 2aa1f2a5917146339feb56680ef992d0d5d9a9d1f7c67872dedda0273e232250
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 22.9MB
        • SHA256 3165943faaf2cfd9ccafa6514cead191d307c1ed5bb460c81d2f21d55c29c39b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 22.3MB
        • SHA256 c5c8b16a8fc9ee31f70455a03050c481210d8edbcdf4cee12ed8f3406d47bf9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 24.2MB
        • SHA256 ffd32a2401cab48a3fdef537d013bb0a85d383e4f7cee12cce1a922a6aadd50b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 22.1MB
        • SHA256 7ba35f2af8d1860e67a1973e50f90609ae9172e2e47c167e407fb285e15d9ca3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 22.4MB
        • SHA256 b59ac1ee8a3016409144c1c3cee2e93b0e4907405d8bcff7668976e9d2d822f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 23.6MB
        • SHA256 92c49334b6829a5b6b52b14afa685457a1365b180b882b93b4233d2e07cee2a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 20.2MB
        • SHA256 be27947be06b356dfbb458e100cb344e8273d7ab58382fea7b2ee610652fd4d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 21.1MB
        • SHA256 274290d0f20c1f863947be3243820ca0be96db091dfa10544684068cdb2e2c2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 21.4MB
        • SHA256 3bc48608ac0bd680c994b22ec62ea4b6c3a96debe5b02d503c2e8b3b00f93bb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 22.2MB
        • SHA256 f7985c57606e759752567e989173090b93d3ac585fe981a45dd0cbd0380a2507
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 20.6MB
        • SHA256 fb4dfe431101f7b1966bbdae02eaab43739548afef5590c52276e7989ad97894
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 20.9MB
        • SHA256 184c12551dcf80e464e459f3ac463f8bd1ad236bd0aee0171ed310df45b8ad23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 384KB
        • SHA256 3e4e65210d0ce663e458df3dc7915e7345a65463edc2c4781b0feb1a0cd3389a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 19.4MB
        • SHA256 d09ec23003e893faf27b217fb04ec41ca761d9458b517216ba1317e072fdd471
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 20.0MB
        • SHA256 8c656f98f95ec310eee5c412ee7d5ff9ecd12303f55991ad89fe4a2b0ffb2ea9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 19.8MB
        • SHA256 4d2a06b6d88728df50cfe082056b3041f4bfac7fa57f6f884d5043e8bf24949b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 19.8MB
        • SHA256 a473f4442a60fff12a53e6778a238c79d323266426bc04c6bf6eddb06345dd5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 20.6MB
        • SHA256 c7ea80cd3d1fa339c2d2f466c2b2f4d02950672c94b50fbbfbaf1165df73e757
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 16.9MB
        • SHA256 a644245cf3e9d807bbeadbb942bb9d93cf645b0067b93a0ad8f0e378a84115aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 20.8MB
        • SHA256 33f45efc662520338a51e06b21764f3ed655f12a7c6ea5ad858ddfeda5fa011a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 18.2MB
        • SHA256 77a30359087ddaa77043a1c9c211d2615b7e34ed6f17edda6145fe1081940e2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 18.4MB
        • SHA256 daf507e845cf3dfc98b22b78a7978900fb6174688dd10c5319ea7f699515367c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 17.4MB
        • SHA256 97f50c007f2f20a5b3cfded4431e4af7a8ced9943cf14dfc4111bb496f45819e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 18.8MB
        • SHA256 86e76b560fa4e7b2956b42f2a10e580ff0dc6a35535b67f002b2cb47d017b9f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 17.2MB
        • SHA256 ad3b91dc23edd660f6589ef4d723d6483f220f1e4ffb20c5fbb7446f72d4b8a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 18.2MB
        • SHA256 f74834f3d4c9203e11c11773643c17f628f2f7832e5293ca8d8b17dea228c988
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 19.5MB
        • SHA256 25c88158cab90f3935503f1388af68732bfb52c10197d9a81989ad4846c2a064
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 16.7MB
        • SHA256 c7084de2103ac754e8276ef3f4097a015be1e9be6c841e3e8825482810854b99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 17.5MB
        • SHA256 2381ce281b0c8a881ea4826a0888cc6e262d35fd52e3e9b01206851b2572d246
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 18.5MB
        • SHA256 8b68a0f6ef63987db0092aa85b615f8055ad09525141b461fb70c26cba54b011
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 16.1MB
        • SHA256 c5d222a553082bf58ef918c75d736319647bf2c8d31cb24a51bde85d22537be1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 18.1MB
        • SHA256 7a7c27a7bebe37d4aa3f3af978f5d5c9f31ca22dea9156e0329864f170d4871d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 19.1MB
        • SHA256 f4f16f0738858662d0a962011fcfe780672fb2ce0e323773ed9a685e71ceeb72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 17.1MB
        • SHA256 f75baf66a4fbc06f8f7d4f23dfec6a1808f317574e13ebc9ccdea560470f072a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 16.3MB
        • SHA256 91a68f22148f7413e6f008dd5d332fe930dd0dce3c6a85db53151ba60f1f2c50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 32.8MB
        • SHA256 563068b2d3f57c4a6de6025377eceb125ec32989826ad1454abfa89e41ab7093
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 31.6MB
        • SHA256 13065d79aeabc825beb398d3688223bb1f6c5cc1635f414b767169a90c913d11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 29.9MB
        • SHA256 b0cfd72dc21f141a9c9aae6863f01136f05d5f2d149e2a4fa8f1d26d9151b9d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 31.1MB
        • SHA256 4e39a7cec55566784cc6cb7abe700475d9f04441d4d39380f8a6de9e7655cf9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download