Overview

overview

8

Static

static

3

2026-08-02...d_.exe

windows10-2004-x64

8

2026-08-02...d_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/08/2026, 02:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-02_989ce81df7401cbc2b74314d0d9125ae_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
  • Size 34.0MB
  • Sample260802-dbsd2a11bx
  • SHA256 9c0f9f636fd9a90cf94ae0ed41c9045a0e220b0ed8f421bf3f0c546c532cd002
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_989ce81df7401cbc2b74314d0d9125ae_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-02_989ce81df7401cbc2b74314d0d9125ae_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4776
  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_989ce81df7401cbc2b74314d0d9125ae_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-02_989ce81df7401cbc2b74314d0d9125ae_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1236

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 34.7MB
        • SHA256 9f994e2b09e38a76df097899dd53e06a746bbefc21a7336d7df3198bd04a3447
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 34.0MB
        • SHA256 343ebab896938684026e1fdce5151c9d551e2b06685e996cc564b2d59856396c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 34.0MB
        • SHA256 d9a712ddb8c1a31442133da6a010d2667014d50b4e5e074da8993967ac81f5ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 68.0MB
        • SHA256 9e4186140fd5b0b41dbcb91ffc58fae2632a6567e431a7fd87a46b1e768fc307
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 68.0MB
        • SHA256 06baffdbddf150bf0b0a85f57820711af744d5ed38228f4e66dc9ea95003cf3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 68.2MB
        • SHA256 a2432e3ae2becde0a5c08cf50791dbfc051c07a4e1f8da0d7002dc6b676bc37e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 68.0MB
        • SHA256 8603ca821d79178e457baf6bc272678b85ee10730de3c3cdf66d473e65aaf282
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 68.0MB
        • SHA256 cb13661e63f04c57cd0f6a3ad23857e82ccd1d8ca9db19773b2cda56324f8ed5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 68.0MB
        • SHA256 3ddece1df4bf05890fd5a1ee1d16d6684dd0c957006e34d13bbd73db06192425
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 68.3MB
        • SHA256 f9547be53db0216b6471cde8fe7102b3db1269c95b50799abd2a7e7ddafbae56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 68.1MB
        • SHA256 4f311f8b0c590f5e54aad806c89eb0f917da7896ddecdcbe983b50989b6177b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 68.5MB
        • SHA256 72cbb655c14483b7f083e3ebd8bfd8cddb2456723c72a69648dd19881443943c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
        • Size 68.0MB
        • SHA256 6d5e8473780c4f8277555e6284436797ce5a4b9e608be1616f0eb92280b7ecb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
        • Size 68.0MB
        • SHA256 c6920d8ad0bf6c262d63048ae96e9315c0f6207b00141c05231c760684b7b884
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
        • Size 68.0MB
        • SHA256 9da7bfd468bbc8d5fc6636136c9b8928e6a6b05b1f1dbf9a7488f069ea84d25f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
        • Size 68.0MB
        • SHA256 3e442f924637ac290363f7d96b4f2e38891fe0c2cc974953a26097c9d9532051
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
        • Size 68.0MB
        • SHA256 a0b83a0103fe2c3e1b2688e51641341f42cc581892490e6a794269dff29b7a58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
        • Size 68.0MB
        • SHA256 b530c00d64e16f7003fe4f0cf2ac02bd68dc3bddd259e42a66fe7122a97e6c08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
        • Size 68.0MB
        • SHA256 9c52776a26c28fddb3b8d9875e861151ffb6d1a2dcde7466d04517ac3cae2d50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe
        • Size 68.0MB
        • SHA256 cfdede6dcebab9f35e9978fc27da51afdbd799f7f8abce4e29a0e6439569f872
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssvagent.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
        • Size 68.1MB
        • SHA256 9e1f3d7a1776632b35a2e3b7bb95c3d95161ef6018b254abe9e6f59a83fd0220
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe
        • Size 68.2MB
        • SHA256 4a78ab7df9413a09b315fdf89fa662f707122ff7cb056911a407d1326815da5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fontconfig.properties.src
        • Path C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src
        • Size 45.4MB
        • SHA256 5adb9ef5b08a62e25a09a0d9d9dd1ba98fe4f5b6dd41b3e98b2204779f6fe3ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jabswitch.exe
        • Size 22.3MB
        • SHA256 08dcd63799daf670549223fdab9743be33cd6319061dd51534c8e87701f8de03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jre-1.8\bin\java-rmi.exe
        • Size 19.4MB
        • SHA256 756d27aee7e02aa24f78ecdf90300d4b6caec1831c5b0fa00ed5bcb9eea2fe55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jre-1.8\bin\java.exe
        • Size 17.3MB
        • SHA256 27d3140574da811d31cd48014e70ba9dc8b9f11c6b4a1c8a593668b516e072e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javacpl.exe
        • Size 18.9MB
        • SHA256 b3334a6f00e4fc1e6342e1d1bfceee3bf7d8e456a8cd3f3e86b0d7130a200472
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javaw.exe
        • Size 15.4MB
        • SHA256 8c6cd3ca54e16effa63822c43331359c56c24866fa11a375242fcdf5a8a6d02d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javaws.exe
        • Size 14.6MB
        • SHA256 23e5292e1c3ac4a98c09a47e7ecbad9b8a1dce3af27610ed8bbffaa30af005bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jjs.exe
        • Size 13.5MB
        • SHA256 189ad2ec0a11d112a748a5e73ef1b14b129631fd2e374ab4c970e650bf55485d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
        • Size 15.0MB
        • SHA256 ae3b556960a01f84c73ba9436673c02b14daf85b17185fc08b82dc4be6e81950
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jre-1.8\bin\keytool.exe
        • Size 13.6MB
        • SHA256 b61b70516588f2a138c87608450ccfa03c8b566fd21c72114565cdb2387f8abe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jre-1.8\bin\kinit.exe
        • Size 13.6MB
        • SHA256 e8b3c435199f7ea5b181b8ee8784b36d4fd160ecabbd7c0f0021572147923158
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jre-1.8\bin\klist.exe
        • Size 12.9MB
        • SHA256 982dce466f09c6ea456ee158e98dd6dd616120c02b81768b756ef7a6153c8fcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jre-1.8\bin\ktab.exe
        • Size 11.9MB
        • SHA256 9898000d8b28e1507b71b9d55db2b6dc246d60effa208580e6ace4b161f6b9eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jre-1.8\bin\orbd.exe
        • Size 12.1MB
        • SHA256 f0fc51369c0d975059f0b2952c14acc255291afa2d75c65283989f2dfaae8fac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jre-1.8\bin\pack200.exe
        • Size 11.6MB
        • SHA256 971c0cc7170c3d17b6b47f8261dcc13b7573dd8787535b2cc0f4c18a4f23bb84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jre-1.8\bin\policytool.exe
        • Size 11.0MB
        • SHA256 8441524bde9f87fcf7807e339c2c7bfbdf074b029abb6c7dfeef523f5a74114f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jre-1.8\bin\rmid.exe
        • Size 10.0MB
        • SHA256 727c740f56e953c2004655ff21be7df0b92d9ed1b605a6cbbf8199481740aebb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe
        • Size 9.4MB
        • SHA256 965bf11ca3e7b9eb7f495840de8292a862c299a8ef4f2f1be1666d2b65847cad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jre-1.8\bin\servertool.exe
        • Size 9.5MB
        • SHA256 6cb9634d81621db81f72a6123999055c98394c3ed86bfb911c61d6615e164d6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssvagent.exe
        • Path C:\Program Files\Java\jre-1.8\bin\ssvagent.exe
        • Size 9.2MB
        • SHA256 eb6f76776495d63afe67485ca808db0ffcddb3c79584c86bd184ce0e6d47f36e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jre-1.8\bin\tnameserv.exe
        • Size 8.0MB
        • SHA256 d5630376fb1acc26806cb512a0c177d03d229af48e12eac1678d3f75495e7684
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fontconfig.properties.src
        • Path C:\Program Files\Java\jre-1.8\lib\fontconfig.properties.src
        • Size 6.9MB
        • SHA256 b81d26f86e9e0a8d924a4a657c860124721683cf95c5a808b80768747252d949
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVDllSurrogate32.exe
        • Path C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe
        • Size 7.5MB
        • SHA256 240733db78602fced99e6cee0d3b0312f8bff06e51ef6def8784aa10cea1f7b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVDllSurrogate64.exe
        • Path C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe
        • Size 7.0MB
        • SHA256 b926ae2fef9f32c09f3b9b5ec8953afe0efcd2f7bc27a965406b1debbffbdd70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVLP.exe
        • Path C:\Program Files\Microsoft Office\root\Client\AppVLP.exe
        • Size 4.2MB
        • SHA256 581461bfe54891e620feb6c5d0c79d80558a55836402d38767d251cde354f8b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Integrator.exe
        • Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe
        • Size 4.3MB
        • SHA256 43f2fe9e976783fd19d2f381702df814cf46df065bd2eaa8a033b59d9a5cd696
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Mashup.Container.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe
        • Size 1.5MB
        • SHA256 8a3c368b47fb046e7fe20c1e6380fec7750fa5b34b11341878b391396d83b555
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 34.1MB
        • SHA256 6970b5c17ae88321b292f10622ded9ea8a4b76e5292d60cf1659643d312467f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 34.0MB
        • SHA256 9c0f9f636fd9a90cf94ae0ed41c9045a0e220b0ed8f421bf3f0c546c532cd002
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download