Overview

overview

8

Static

static

3

2026-07-28...d_.exe

windows10-2004-x64

8

2026-07-28...d_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    107s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/07/2026, 19:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-28_f70180c85df0bb989fb1f93dbdb63f18_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
  • Size 44.6MB
  • Sample260728-ye2gbswtcy
  • SHA256 75d5635a68f514da8aff4d504833e51e02c0695336c1c0f30d6f7c0b5e2a88d0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-28_f70180c85df0bb989fb1f93dbdb63f18_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-28_f70180c85df0bb989fb1f93dbdb63f18_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4388
  • C:\Users\Admin\AppData\Local\Temp\2026-07-28_f70180c85df0bb989fb1f93dbdb63f18_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-28_f70180c85df0bb989fb1f93dbdb63f18_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5488

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 44.9MB
        • SHA256 0abe3d078a9eca9834831845c7c5911b67379565581010e909f8b414b875b8be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 89.3MB
        • SHA256 4725c208aba00c56f339aadf79a203e0bf61bd6022738bcf97bba66e47fc3ae8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 93.4MB
        • SHA256 0c855632e2f4a6f9e3f0e1301f167804f0a349e8b37996e6b9d4d16acd2472e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 89.6MB
        • SHA256 048140bba3219349b30a49fb2ec2dd320b43d1f93242da1aa9e6babcc9bac703
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 46.8MB
        • SHA256 e5b6e8a14d5447cbf51906830ce643d45bf4a21d683bedeb08c3f6d6e6e49526
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 89.4MB
        • SHA256 ad3c0e765d9101cd5e770f958428eb7506df13a9f9ce3fb627c3b9e38990703e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 74.6MB
        • SHA256 3e1a45a148f3ba5abe1e5318bbb72584f43003fa44cf8cb483c6282cf1819de9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 68.8MB
        • SHA256 d05a64ecc38579821e1c76c102754e515bf54f7e686435b8b00e9974d33517c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 67.6MB
        • SHA256 ff3e8bb5f1d0d0043d9cb64835cb9ee9bd8b226574bed239977439ac22856698
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 53.3MB
        • SHA256 2aa2ef34948b9ffdf15548cf9c08eb928c9ac1bb04b56b130435cf15cd7a6db3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 38.6MB
        • SHA256 206f8b6fcb264c724937a081ce9c7456b78c2a6db93909f8178434c159818c22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 37.2MB
        • SHA256 5ec1573fe9f32c9681ec46cb1077b6918e55547819aa3107aed47a4455067b7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 35.5MB
        • SHA256 fc08c9ff5e5ed62f506644e8fbea7df10db51efc032f891c83896b5f44e15ed0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 29.9MB
        • SHA256 11f4db775b962e60d0eaf0eddc1b6c6ec7de6ba7d32c6219cfb414b1b633a885
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 28.7MB
        • SHA256 cea824481a312b0eca6d5457b01e4a747c069f790c9661ecb3cd6c8ce112fc57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 28.1MB
        • SHA256 786de35aa19ef42ece3de0741e7e9b253d8a551d152b0bfa0b6dd2a8cec42db9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 27.1MB
        • SHA256 4c812518c3c08b9d5211a6b7b24b47160fd3354971dc3770afc6b63659ae62f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 26.8MB
        • SHA256 cbbaf259d2a71fe8a77363bd22e9520fd4dee2f0a3980009ec4852618ac9256a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 26.5MB
        • SHA256 8d45324416c954a6ef39fe71ff541ffbd345979e71ae9e64fa67ad18d0872614
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 25.9MB
        • SHA256 ecf0517a5d85759401b768898e113cc6baa155d389dc29ee3521bbf874f3ccdb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 24.9MB
        • SHA256 1fbc253edc5f70ffd0170c82f7816ee778bf28b703c5133026fe1ae93d5f2e8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 24.1MB
        • SHA256 f625c1919e20b176e101217b667444888e75e1dba351117671602f3fd6a3a8e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 23.6MB
        • SHA256 047844365c2422a3ab7c0436cf96d88fb63224df5bc7f8ccd945a9a419d1dee4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 23.4MB
        • SHA256 55511dd1c2918469e55d39fac0b4dfc5e2bc81aa70cca7de418d10b6a2f5ece0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 22.8MB
        • SHA256 6a8092bae5cca6687dfdea1980a2c10730df29d0e9f58e736575f0de925d95c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 21.8MB
        • SHA256 44b251f737b94055340536617b39536e0373f8bc83517715dbccc1832d736f9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 21.3MB
        • SHA256 880368804992c4bbff7c6afc3d06747a55ffbb739fb627d5d02b4d20eab3b80b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 20.4MB
        • SHA256 eb8d87198f5140d6a8b06581c995d7b77ba44ee150eef0310c7e8f73944ce957
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 20.2MB
        • SHA256 8b5efe2cff9eac631004c689335cd04ff7c7590a83e4d147cefd5c00abff4b28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 18.4MB
        • SHA256 7b37f448fa36199ae183a47f23d60b739de126c97b54463801e0b0c5a82bc8a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 16.6MB
        • SHA256 72a12346f4b14852e5bc42aa5c4aee3e183a0e693e1446178ccffcbf75bcee05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 15.3MB
        • SHA256 5e114388db4d15c74a00a628d8e5a9556404565776e1eae639cbbc390261708a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 13.6MB
        • SHA256 d7d5a6bdd0c3028a4c84f1f751aa1aa39ff984e66456fc454f3f97cda555215a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 13.2MB
        • SHA256 3eac5ffdbb2cb3c54afdc01288e18989c89540d8da494e52e6ea322cd956fe45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 12.8MB
        • SHA256 a735d7bf7c883398e5ed23be2e162dd5a9dd12e3eb18454fc89d8e068745e7f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 12.4MB
        • SHA256 b3eac197bb53334f67254ecfc8c86b7d0d72f85e353da6bbcbb3fa433d2292cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 12.1MB
        • SHA256 f1b90791985e14d1bfc31e70c98ab765bd2cc220840879da7bb1e895f7c35d24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 11.4MB
        • SHA256 9a9d5e07bcfc85601a825f6503756b2dc8a159489e32b9217b7bcb43a9c09c01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 11.1MB
        • SHA256 d65516f733752fa5ffa57aa0e65b60146143e96084b669e2a48232358ccc38e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 10.9MB
        • SHA256 a1202988df5c9bde52fd1a7b660d90805dba5d94f2bc776aebc78df5ab9677bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 10.3MB
        • SHA256 e7523267739f0e7e2d3eccdf8b479213c5f41669d18712ac0693b38bf372ed3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 9.9MB
        • SHA256 62f3185e765f59d9284cd062884e6929d91b65730c687b0b70e317f1bdf0c636
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 9.6MB
        • SHA256 f69668abfbf70fe89f577f77503b7662a18f8bc2b59482d96f76f1d14c79bce5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 9.3MB
        • SHA256 5645b6fe45aeba212810357c48c85f0ac03ae30fee7c631a19b2a1644b869469
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 8.8MB
        • SHA256 e988a14bbfa9a96ea3b8fd639ff062637d68390a97390dd3eac6f50774aabd38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 8.6MB
        • SHA256 b78808647a359c31dcbca8613087ffab10cc2556603e6e6be1a989307b3cece0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 8.0MB
        • SHA256 60d12a4fd8c5e8b9a6a4ce197023ebe8b7ce237f6de8b41ad0427cede30c29f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 44.8MB
        • SHA256 f5fffd306943d7870923c835b5ae82059f6779788b4bbb2eb66e6600e5f82b55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 89.3MB
        • SHA256 678896cd4eb71637441c482399781068d0440094d2ac47e7b5901047a8fb09b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 89.3MB
        • SHA256 21ad43d12d0cf3bcf2897163fcd3fe78cbcac6096dad0793459e1d281a0235c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 89.3MB
        • SHA256 68f80d84a931855889ded30600ce73d0981296ba6a2f88065afefa27a0e80411
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download