Overview

overview

8

Static

static

3

2026-08-01...d_.exe

windows10-2004-x64

8

2026-08-01...d_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    41s
  • max time network
    155s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 01:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-01_26f916f44e5de635a1448d0d9dffcf63_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
  • Size 41.0MB
  • Sample260802-bg2tjs1erc
  • SHA256 6428fc61c1fde09e5f9c65cf306a44b83d11e3d5f718d2cf45a3d89afc161cc8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_26f916f44e5de635a1448d0d9dffcf63_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-01_26f916f44e5de635a1448d0d9dffcf63_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5600
  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_26f916f44e5de635a1448d0d9dffcf63_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-01_26f916f44e5de635a1448d0d9dffcf63_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4600

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        BlockRequest.exe
        • Path C:\Program Files\BlockRequest.exe
        • Size 41.6MB
        • SHA256 fc7045801ce8893612eae5c3101c9f60a5381a27eda5a71b91299be2dbed69e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 1.1MB
        • SHA256 6fbccd1c35daafe27229b2003f221bc373eb1f43c195b35fbf8c4ab6e1011635
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 82.1MB
        • SHA256 19e49bef61fab0c35550a8a8f0bb847afba3d5c3e34894df781679dc1f1a7304
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 86.2MB
        • SHA256 dd64d4240f3b0c67f000215dc6df845ff6669c593dd9de3f725425a1cce39960
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 82.4MB
        • SHA256 8d3fa555f30e7171579f5147cfa37a4fafa4f671711a7c84ef28a174e8bbf1ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 43.2MB
        • SHA256 db08d3bfa348bf7b334375d852ffd4930520b6744e3ade83c473791c683f1b58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 79.4MB
        • SHA256 5a41aac2c6cf69346dd3ce587cc3e09b30b5ef5a43fd4144fe2812c22c034681
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        FindPop.exe
        • Path C:\Program Files\FindPop.exe
        • Size 72.7MB
        • SHA256 d813dbe7a40744c866d3dba2ed84fdf9c72e32e5eeec2669ee12c08368e775f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 68.9MB
        • SHA256 4361768723f85a64afd642257da0dac1420b56b88d6eb9c48eec42eebab55d4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 68.1MB
        • SHA256 f5924e5f836add97013950395eeec39137cdeb4ba3ff4fd8fe1e63f384cdf1de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 71.3MB
        • SHA256 a967180e39f0dfe688148879773b3bff2a1d426ae13cde06189d040709ad9013
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 68.4MB
        • SHA256 84f0a8eb724ab2b041f86ef6c9bf3b90cf182ebae4061af4501ccdb552665264
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 64.3MB
        • SHA256 c34521857d7f5f893de769a58f7164cc92cfe740c77e679ee2c25acfc425e86e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 61.8MB
        • SHA256 8467dc83ac2e0be93f4d544a041fb173f5c2768ae52baae505a0476e44db3af2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 60.7MB
        • SHA256 1df579753a9ffc6a453eff1762f3fe0fdd7d2f8f56ce350ebb910b703b6c15e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 58.3MB
        • SHA256 34bded2822ca87dcf4348523a6a287a2748dad45cdfd53b23c1a170a1a72004f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 53.9MB
        • SHA256 3edd32e36f9b483092a9198a133bc1fdbc5fd8b331107887e6de5e3c422e6c1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 50.7MB
        • SHA256 982e31a6a14f3a20ae82240281cf4bc5669b096a8096d8dd342ad524a64b9b8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 50.6MB
        • SHA256 1032a7626099309b3af35bf52395db5c59e1e10f41a10167dd4f5512f61dbd7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 50.3MB
        • SHA256 1091302016069a4a0ea046bf4903da050871eaea4225061998081c7d8de7bb73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 49.9MB
        • SHA256 84e1ff8052cc3bf5a86b3707084bb4cbd14a6808ff432fdb6d96cf06f58fb6db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 48.6MB
        • SHA256 5bfd6da10d1da70c58207076b13cac24b42b0633e6d3926a533218fbc4344ad2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 47.8MB
        • SHA256 5f52cee082e6c4f9afd8aa17085f820c0269af07f0212a90361cfcd63856a12e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 46.6MB
        • SHA256 46a4df32ac05ad25e80d121c185f1f908b9a1cffe52486426f0d39f0325b472a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 45.4MB
        • SHA256 2552c58488a80aac0faa250686f716d8d5613980241f192905174dcef47fb63e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 45.6MB
        • SHA256 a83b777e0fd83519dfce6cbb97ba9359c11cea8bafdc1944fb79886b4bc3c923
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 42.9MB
        • SHA256 1a13e3d20eea9a669a99da7410c7753ae058b1d2686c4f1d2936ba9eddd5e0f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 40.9MB
        • SHA256 53a263e75fa74f2d54ad144ffd3a25dc2589c36bd7f78359b40fc11293085854
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 40.1MB
        • SHA256 8206cfaa4b63d094412d8b056345bd91270e23874fa0d0696ffd32eeeb86f0b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 39.5MB
        • SHA256 c775fc248fdf2048de6f10332b165250bfb80803d4a03e0c20a0468b5a8e5fbe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 39.1MB
        • SHA256 6c70358dea89911b6d5a1607d4eaab10817c1504af8d79ab89593f15f27dd845
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 38.1MB
        • SHA256 a00e4083b5ddb223ccd4e29f576d766f02a40d2fa7841c99f5e3a06784d20e90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 37.0MB
        • SHA256 6e28351961e0f33460f819677d27c7daa9bd682cad5ec988b9bf91ebde16725e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 36.2MB
        • SHA256 cf478dad0598070e3a95d5fad8187697d7ab99cff79b37bee3480d8d3d691bae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 35.8MB
        • SHA256 af7b32e5dfeea45429b5546c58b44a4ed56b52c80246b97c178d6589438dff46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 35.0MB
        • SHA256 7181f36bfc3d99d58168eee41275ad64e989b1928590773d00c8f6309c859e7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 34.6MB
        • SHA256 41b59a8d20c6f9b223fd3351e45a063019b95a340f8432a206209a2b72c44415
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 34.4MB
        • SHA256 6992db5f87b6a68e8745d8227cc30d4b8586534d2a3da0cb50a5e025495e1c61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 34.1MB
        • SHA256 68c6e454f2150a3c460508f3697d0ceaadd462df4f7177df75ccda35e648614f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 32.9MB
        • SHA256 0837f39441192f2bedc176736b59ca9c5804c857d4cc0143e14d2ed6a787c79b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 32.6MB
        • SHA256 03d2ff9993ec2472f7988d156ffb1ccdf03a94fed5f6cc6167a4d4378d1c7706
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 75.9MB
        • SHA256 ce91c1ad60d8d8b2a2008c1fba6daed2d714f2e938295a89202d159039680164
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 77.0MB
        • SHA256 7cc910577b69381d72511f296748a02ebc522765ea8bb057999d8a278961a6d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 75.5MB
        • SHA256 8aad8b1d23a8a207b7a6732a1b9a367334066b264c60cb5f22e097378f89c62d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 74.9MB
        • SHA256 0d0c6c3d497e3be13e233993fc7d31d72758d452fae28483e223dd1e575850be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download