Overview

overview

8

Static

static

3

2026-08-02...d_.exe

windows10-2004-x64

8

2026-08-02...d_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 02:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-02_989ce81df7401cbc2b74314d0d9125ae_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
  • Size 34.0MB
  • Sample260802-dbsd2a11bx
  • SHA256 9c0f9f636fd9a90cf94ae0ed41c9045a0e220b0ed8f421bf3f0c546c532cd002
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_989ce81df7401cbc2b74314d0d9125ae_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-02_989ce81df7401cbc2b74314d0d9125ae_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4248
  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_989ce81df7401cbc2b74314d0d9125ae_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-02_989ce81df7401cbc2b74314d0d9125ae_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2312

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 34.3MB
        • SHA256 d84ca1e0e4559a654b852bceb9a779ccd8ac495d6f717643b7c54dadf90998db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 68.0MB
        • SHA256 3f25991739151874b66a8d24b7595b5987eefd8401198bc93ff8482027c58e57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 72.1MB
        • SHA256 4e02596e3e37a3af5ff362d6ddac186ad7f8a4a1e79b80d88e6494e831e919b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 68.4MB
        • SHA256 b1557b3e8161ebfbfb1cf2bf0bddb9a868c960cec945d73233f3247ad5ac709c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 36.1MB
        • SHA256 061917764d47eb6b6cb777629ec9fb25a5135c5b5f56c48af090d644077dfa15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 68.1MB
        • SHA256 a0ea6df33490ce1dacb951eacf3f8289c5e0f5bee1b6b521709d2f2f94a3ae32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 74.1MB
        • SHA256 2f113d440cd2b17fa04c4faacd21ee6e9fd4734f66e7f5ff9ef4d64672ccd86a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 69.7MB
        • SHA256 fb32afb6dc967efa8ce23270aa4c265ad969ed5447c2c639509cb5226e14337c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 71.5MB
        • SHA256 deb99a0bc03443af43b69732df5b8673fe11114b1fc014ee218de931db5d687b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 70.3MB
        • SHA256 5d2bd422de38d6c08b040b7b4e915cfa6bb53f2a1a144832c739edb2b4d61175
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 69.6MB
        • SHA256 99185f90c5ce3b451b55341378f1ed8f1d2badd1c6d5511fe4f413f001277b4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 69.9MB
        • SHA256 8a7f91418b2490ccf5d2e67e4a0ce960c734468bf3e39d2dd5b616fda700281a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 71.1MB
        • SHA256 906fb2e75ac90d32211356e15f7739179d69d1380593f78101d4d97bc0bdc3eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 69.4MB
        • SHA256 b4baf67c572928290615cd5103adc2d672c6d6b6a6b8104c1a45ec113e80ed8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 68.0MB
        • SHA256 2b9fedb9b3916f8020fa46570dc30286213c939e8fe16f98360dfb89182df22a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 68.0MB
        • SHA256 c95c772f25660b3e8a103f1230baa2e92c3c72dd0b86da4562455a7de339da7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 68.0MB
        • SHA256 dc97f771a46c9fa20a74941a40918cf0baa36c156c4589ea167dd05a729a11e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 68.2MB
        • SHA256 4df4a0ec856b0ab0911612a66c8632456ea7853fcefe79b513e32d631099a379
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 68.3MB
        • SHA256 67930b5f421b1eee77866e172ddd06955e364425a84349c80af3b63f52b28b19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 68.5MB
        • SHA256 e435d6b53728982d0ad6c3b85356381e8cab9c37dcc95f2b2a76ebb34f06d2b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 68.0MB
        • SHA256 a87846aa2cfc756b4c0e3d03f93ae7d918a78ad0378924b018e0d516de31c62d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 68.0MB
        • SHA256 7ab8627bf55a465cc30cac1446658cf58c3d4ad39f9658944ad7f54960cc63cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 68.0MB
        • SHA256 14c9c481258b3af629bbac6d9b4fa969f9b0a31fd66f3885422751a1a5c3aa30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 68.0MB
        • SHA256 c4928165207a864598be7687140412c734826e2caf073574942663f2c50e7b62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 68.0MB
        • SHA256 6767267029af8b7ddf3684e04d5cdbe9fd1b898ade0360deaec29294c8e65a8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 68.0MB
        • SHA256 9445642db4760ad340f52fa0f9a66c78cc2c3004b2ceedcb27e75aae11e2e530
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 68.0MB
        • SHA256 97a070146b23ed35cfc12b25232617ee453ab5cfe44c32d5b16254a74ef61d2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 68.1MB
        • SHA256 548a092d98543e8709d2087fcf601aa6b33f3e06b6d434c3b706cd8a39fe44ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 68.1MB
        • SHA256 e320adcff7d561bcbe57b9c98caf0a33ea0462e0d4f374db0554e8d23ea49fdf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 640KB
        • SHA256 6fa5e5aed102186d01a2241ae2a71ead0179d9242baa898b77a1966962668dbd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 68.1MB
        • SHA256 daaf42f892b729c6d308b37fa5d8faddf1190219725d371a9cdab04fd7d62c5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download