Analysis

  • max time kernel
    147s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/08/2026, 01:09

General

  • Target
    2026-08-01_2274356bc49ef9a33e7a9e139f7cc745_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
  • Size 41.1MB
  • Sample260802-bjag3sbk21
  • SHA256 ebf53d6ab357e3deb78067aac04a14ce7453f56dd814fbaf120697bcdf7b9196
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Control Panel 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_2274356bc49ef9a33e7a9e139f7cc745_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-01_2274356bc49ef9a33e7a9e139f7cc745_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3892
  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_2274356bc49ef9a33e7a9e139f7cc745_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-01_2274356bc49ef9a33e7a9e139f7cc745_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1752

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe

        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 41.7MB
        • SHA256 9463786e0c5d9a98e1c4e0336906a7d98aa0cc4bbe194ff27918d9bae8205193
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppVShNotify.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 41.3MB
        • SHA256 abb6563450cd21d4ef29b1061d91bcb73c5545656d4aa8ee94db4673ea25730a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_proxy.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 36.8MB
        • SHA256 17a0340fc2376c148c0a08f75a1420b42e027f8ae32c8c09f42a033d0e9855f2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appletviewer.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 35.7MB
        • SHA256 99df1856736af97f47db810506516b59feccabcb3ae59bc8f4ba3f2f79350ff8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        extcheck.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 34.9MB
        • SHA256 b3eda6554f13094a0e9dee14b2416c31ce4c62f20fc983100c9560281345366a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        idlj.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 34.6MB
        • SHA256 e130c4a8d3eb84cc26d71e731f72f86803d6798ea5ecedc2fa4d1048fe92c518
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jabswitch.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 34.3MB
        • SHA256 7bcdc25cf6173fe1bcd709b1e7f6f6d7cac42894d942bc8a808bae090db02858
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jar.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 33.2MB
        • SHA256 5b18dbc8109752485ebe0d9f86951d53d72a18388ca9dc04697cb80ffe810d49
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jarsigner.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 34.4MB
        • SHA256 6992db5f87b6a68e8745d8227cc30d4b8586534d2a3da0cb50a5e025495e1c61
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdb.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 31.2MB
        • SHA256 3a10124aa279eb370afac762f9150edc1990a791bf71b8aa3aaa35cb479514e2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jhat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 33.4MB
        • SHA256 68fba33c175a91b63f576e82bc46527f3cf3495f5457451c878a14d0686d0633
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jinfo.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 34.6MB
        • SHA256 41b59a8d20c6f9b223fd3351e45a063019b95a340f8432a206209a2b72c44415
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmic.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 31.8MB
        • SHA256 03cf044c115900bdc7e2330a2c1f53a3b179c6843fbc5134b4e51ecd97b99557
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmid.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 32.6MB
        • SHA256 0f1518330a88679d6b93699944b467ac62194ec4732889027a7eb1d76c9f2489
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmiregistry.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 32.9MB
        • SHA256 893c90ebf5c2e13a294d44aae28e213e03f511b7a5ef0fd7e778f0f2eaf41f5a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        schemagen.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 31.6MB
        • SHA256 915c5ddfff53e4255e5268e1e904875284d3d65eb81ddba28ec1b36d71413c19
        • MD5 SHA1 SHA512 SSDEEP TLSH

        serialver.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 30.7MB
        • SHA256 9827c2e2fe974b4fc70f52a5128b056be24b8a4f33f3ad7b99b80300a4e49389
        • MD5 SHA1 SHA512 SSDEEP TLSH

        servertool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 31.0MB
        • SHA256 a39209fd7d6c85433dadf344bb398ec1c0abb094f2129c4687462e28e3c47938
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaw.exe

        • Path C:\Program Files\Java\jre-1.8\bin\javaw.exe
        • Size 26.0MB
        • SHA256 6ca469499f76ec6c35a477ccf0a76c031e00f5a46c2dac8d6893f377f00552c0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaws.exe

        • Path C:\Program Files\Java\jre-1.8\bin\javaws.exe
        • Size 27.8MB
        • SHA256 f3d385d5906b714aaa8d8379e90d671731eccde11b7a911d396fc8a8bb2fbc5c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jjs.exe

        • Path C:\Program Files\Java\jre-1.8\bin\jjs.exe
        • Size 27.8MB
        • SHA256 56642a195f768d175cb7ad3dec0400ea3ff3cc7e7bb7a3d42652ca8c9c8d31f7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jp2launcher.exe

        • Path C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
        • Size 27.0MB
        • SHA256 727f43edab8501f635e090da0dce732cae8cfdce415844a458424ee0f60eecf4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keytool.exe

        • Path C:\Program Files\Java\jre-1.8\bin\keytool.exe
        • Size 25.8MB
        • SHA256 61be35802a3789a1177099e23d85743bf17ea8f282dc248f6ea7163835c68f65
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kinit.exe

        • Path C:\Program Files\Java\jre-1.8\bin\kinit.exe
        • Size 25.6MB
        • SHA256 c879f612b0bc404135e9138cae619fd73469df1737086f11edda09b55a726eab
        • MD5 SHA1 SHA512 SSDEEP TLSH

        klist.exe

        • Path C:\Program Files\Java\jre-1.8\bin\klist.exe
        • Size 25.1MB
        • SHA256 b887f49db28a646b21d6fa4a3da5860a5534f8ad176838be79c7f1fb8fc5db6d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        servertool.exe

        • Path C:\Program Files\Java\jre-1.8\bin\servertool.exe
        • Size 25.3MB
        • SHA256 905a5038100fb0679e9d43f3dbe0a15b767632a2790e5b35cf009817a2e8620e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ssvagent.exe

        • Path C:\Program Files\Java\jre-1.8\bin\ssvagent.exe
        • Size 25.6MB
        • SHA256 23b4978ed7058b079a78fec926293e0c7396d21cff4af4c7848622f1e08d3d4b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tnameserv.exe

        • Path C:\Program Files\Java\jre-1.8\bin\tnameserv.exe
        • Size 24.0MB
        • SHA256 c2dbd8510a256866eb2ce505c01b6407146f8e69ad9351f76cafb0d21f2cc949
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Microsoft.Mashup.Container.Loader.exe

        • Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe
        • Size 23.5MB
        • SHA256 c046e573ce6304b7608d240e96347726bec169c92593f72710307f357ed13939
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Microsoft.Mashup.Container.NetFX40.exe

        • Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe
        • Size 23.2MB
        • SHA256 6a33d04c372bd39c7affc4b5045407701b49747f39e08cd41086d60a72e2a497
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Microsoft.Mashup.Container.NetFX45.exe

        • Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe
        • Size 21.7MB
        • SHA256 7f8c3e3a0c425a285eef5e415dfa8dbce65e4dd56b6455f47d7baa7b69cbaea4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Microsoft.Mashup.Container.exe

        • Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe
        • Size 22.4MB
        • SHA256 fcfa9d56dbfeeadad9f8d9c2c73f04308780918b750d97bbe65d475ab1db85c0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IEContentService.exe

        • Path C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe
        • Size 23.6MB
        • SHA256 908448ac9beb4e74ddc7dbc08984e1ed021e22d6b941dec6e5282de005028c8f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PerfBoost.exe

        • Path C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe
        • Size 20.8MB
        • SHA256 852324c72fca5237c9acbd751d5e77463bafeddbac46125a29672b4b032b439c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SDXHelper.exe

        • Path C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe
        • Size 18.2MB
        • SHA256 17df8ed361bc93d7b14b85c54303d35d8c63e6c7d76c391eab6df4f182d8b733
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SDXHelperBgt.exe

        • Path C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe
        • Size 19.5MB
        • SHA256 f2ef95f8929636115fbffb9d5f5897611e3f598b0afc6c0fe3e6cb8450c53591
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Wordconv.exe

        • Path C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe
        • Size 20.0MB
        • SHA256 ef45d4722b8f92e9556431ea582b5da6093de66aa2428aa39a1fe278cad82b5a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msoadfsb.exe

        • Path C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe
        • Size 21.4MB
        • SHA256 e990b1624ff9d9985ffca35adec60d5392e2b9dd632ed1c98d4287275e99dead
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msoasb.exe

        • Path C:\Program Files\Microsoft Office\root\Office16\msoasb.exe
        • Size 20.4MB
        • SHA256 82e1287aab934217f68a41634fc01569ee969a6f297496fbf37e67453dd64cb6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msoev.exe

        • Path C:\Program Files\Microsoft Office\root\Office16\msoev.exe
        • Size 22.0MB
        • SHA256 f85253d23f3d3690aaa976707b495c13b1ac894a076c876d97a6ca8498904e17
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msoia.exe

        • Path C:\Program Files\Microsoft Office\root\Office16\msoia.exe
        • Size 19.9MB
        • SHA256 f548f55ab2370bd6bd163e07da46dd07eb70ba5d3935ac3b24a6fa574a0b509d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msotd.exe

        • Path C:\Program Files\Microsoft Office\root\Office16\msotd.exe
        • Size 22.5MB
        • SHA256 834985460c793a167f3330405607ec5f02dc24e993c8c61f8de8345902ca49b4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        officeappguardwin32.exe

        • Path C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe
        • Size 19.5MB
        • SHA256 eaaa0069eeef78daf04eba0256d59dca50c2aa8cc4e2c92dc7caf37fde6a0dd5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        protocolhandler.exe

        • Path C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe
        • Size 20.6MB
        • SHA256 bd81d361cd6fb2103ce561d16b73f3726b83c900f936f95e9bad67ea9240cb6b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OLicenseHeartbeat.exe

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe
        • Size 19.1MB
        • SHA256 fdc40f016074de362e746854201417b02a740c0f8b2ab6606d2cdc1498106198
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SmartTagInstall.exe

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe
        • Size 19.2MB
        • SHA256 63ac97e25b946397d2c4145f41baf65e8720904dcc3b0f59c685e8a639769a1e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SQLDumper.exe

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe
        • Size 18.3MB
        • SHA256 40df4aa27b81850b887f121d0e643627784c29e1cb8dd3ffd2dede70cc44d4c8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SQLDumper.exe

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe
        • Size 18.2MB
        • SHA256 c9f91724d063b4449e1835546016330dada262109a65c601e6da6ec4884dc360
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppSharingHookController.exe

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe
        • Size 19.4MB
        • SHA256 d2e3066bccb24f1f2ae8b062d266b857014fb8242fc03ae1f16460a98037a3ca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Common.DBConnection.exe

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe
        • Size 19.7MB
        • SHA256 905d24faa6761481eda0fdbf68e1ed818ca1e6f6830ae3e9ad4c3544e1e0487d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Common.ShowHelp.exe

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe
        • Size 18.6MB
        • SHA256 fdef69920553f2ac6b5bb08b41f588b5f5cac547f20bdfe43dba854ae6ba3364
        • MD5 SHA1 SHA512 SSDEEP TLSH

        filecompare.exe

        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe
        • Size 18.1MB
        • SHA256 598d8b31ef0ca1382a35be88a1c5b4e23d92d33dd92cd34a5e38f4c9a4ddf60c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        accicons.exe

        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe
        • Size 17.2MB
        • SHA256 00acab82d2ffc0dfa4fa6fc1a98ddb1235d7661802e8e12c00098b6fc357d31f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dbcicons.exe

        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe
        • Size 17.4MB
        • SHA256 fbed63d081f8e512d7c667a46da5edd75fc06151e435669648356a0ad2e6fd61
        • MD5 SHA1 SHA512 SSDEEP TLSH

        grv_icons.exe

        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe
        • Size 18.8MB
        • SHA256 60dfe406ab5fdb19b958522794255d097ac758fe8ffb98466e9eece235cb2de2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        joticon.exe

        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe
        • Size 16.9MB
        • SHA256 3c1a6f86d08dc0d0dfcd635e17cc80cb549708e8e0b74eb3f850336c03385005
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lyncicon.exe

        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe
        • Size 16.9MB
        • SHA256 dcb87cc1b4109426d43370b59837e9972af63b99cb89bb385185a8a9d7348000
        • MD5 SHA1 SHA512 SSDEEP TLSH

        misc.exe

        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe
        • Size 17.2MB
        • SHA256 bde02d95baa1c885689e358fd89ec178ed24e61c8182219413c93f5eec1921cd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msouc.exe

        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe
        • Size 18.1MB
        • SHA256 23f864e74b449d0a63b27265f18068da322591ad399fad703d0736717ccbca98
        • MD5 SHA1 SHA512 SSDEEP TLSH

        spo0lve.exe

        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 41.1MB
        • SHA256 ebf53d6ab357e3deb78067aac04a14ce7453f56dd814fbaf120697bcdf7b9196
        • MD5 SHA1 SHA512 SSDEEP TLSH