Overview

overview

8

Static

static

3

2026-08-01...d_.exe

windows10-2004-x64

8

2026-08-01...d_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    135s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/08/2026, 01:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-01_26f916f44e5de635a1448d0d9dffcf63_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
  • Size 41.0MB
  • Sample260802-bg2tjs1erc
  • SHA256 6428fc61c1fde09e5f9c65cf306a44b83d11e3d5f718d2cf45a3d89afc161cc8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_26f916f44e5de635a1448d0d9dffcf63_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-01_26f916f44e5de635a1448d0d9dffcf63_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4188
  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_26f916f44e5de635a1448d0d9dffcf63_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-01_26f916f44e5de635a1448d0d9dffcf63_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1664

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 41.7MB
        • SHA256 c926f214d588804c519d36d222899e20f2b3c56f7ab3e63dcc8bee26b77f5816
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 47.1MB
        • SHA256 642ebf8e111eac417e511e04f10398dde01e0561ee4a9b0466f4e078cd1ca205
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 42.7MB
        • SHA256 591ced4091f2a876e25ace4f350cee5da402da703349ad0cc6fb491bb6e04642
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 42.9MB
        • SHA256 9ca3f8fe9e28b4564688f9f07ee9021b94295df0dd3503cbd144469d6a571c09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 83.5MB
        • SHA256 c4d242bbbaa2e3fc250d2aca961e838966d04e0861e77fa183dee610448d0595
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 82.1MB
        • SHA256 d7eb49ffedb47c38ac84012e9d579e16d427f25a42a52e14bf9368784a375975
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 82.1MB
        • SHA256 700b105898b82be11cec54bf03d2726607cdc8723967cb06570b617dcd008969
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 82.1MB
        • SHA256 090741bb5e81509c0261bee81824263e3fedfdf13be36114146f502866ddc4fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 82.1MB
        • SHA256 a74786c3e3bbee722159ac74318d3476275e8ddc03ff8cb788f3d2564ab07e39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 82.1MB
        • SHA256 3f4281062d242d240d4a31510a99f7460eded4c3496a2eec7b98b84f701ab29a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 82.1MB
        • SHA256 151928414dd48f83082264e211b5d9a79a69bca1da0502a568e75efc92320e54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 82.1MB
        • SHA256 c043046f05fad523069f3ebc79937f1da49d796479608340376687bed2f99678
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 82.4MB
        • SHA256 f18327ae6206f4c4806d7f8695cf64b245ef933cf48d381dade234eb46660c20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 51.9MB
        • SHA256 5d73678064aeef0fa9783e2eb05c38f29a3f9b304e16a0e922b766ee3b3bc563
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 57.4MB
        • SHA256 84fd006ff675e1a68443a96a2658c800bec9d92f93222fcf0b5879c677bfe0c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 56.8MB
        • SHA256 b8f63b6f477cce77d623251817fdd74e6f2b3f0516a9d380b9ad191fd953d75d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 58.6MB
        • SHA256 55ee4aab314df9bb1bbde072eefb62b3626825cc924a25284652dd6b5b09603b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 48.4MB
        • SHA256 511f111b03439d2b87c41ebe39201c283ab495c7ee01ecb9a595b5685365d33f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 44.8MB
        • SHA256 385839d8e0023d65317a9a77ba47dc9f986bc2a3c19f04dc8f2b0aeefd164b93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 42.0MB
        • SHA256 9a05e012abdb5f709aef8c99ba9c71f72f1f05b14954ee18267951bcd517d11e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 35.2MB
        • SHA256 c7061c4e7ee25d500eb4c1879b2b6fe1551f019a55d50bbc6d377224314af83e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 17.8MB
        • SHA256 daccc4728cd593f02bdee5fdbd7a7e5fb2843d084286ef699099724bc624689f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 16.9MB
        • SHA256 c90ad993e2b9e62a5ad45bddf2119325fb72d5457b2b05ea2664c0819f52542a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 16.6MB
        • SHA256 443ca7115afaa3e7c229c78590f93bb53fec25521c003deef11c13b0082a6fba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 16.2MB
        • SHA256 076e2862cc33b195ab0602a2c47daf4cb08f2476645f2981b4f39d48a07757bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 16.0MB
        • SHA256 2923bacb2de821cd96bfb180df594b7dd670f896e6ac19d8aa23e1aa7f9fb14b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 15.4MB
        • SHA256 49b87024166d9487fe380ad7a0cd4fe0c2d67efeec5a327c425dc14e1dc5f574
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 41.1MB
        • SHA256 264863fdb6bea9878f9c3fe26dc5193a70398b2cb04392740f3ab7f129f3bbf7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 41.0MB
        • SHA256 6428fc61c1fde09e5f9c65cf306a44b83d11e3d5f718d2cf45a3d89afc161cc8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download