Overview

overview

8

Static

static

3

2026-08-02...d_.exe

windows10-2004-x64

8

2026-08-02...d_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 16:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-02_c5a74b9c37d68cbd347524b10f1c5d20_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
  • Size 13.7MB
  • Sample260802-veg6xaxbme
  • SHA256 551836077a9a6d9dba06bdd7c75f276393798a524c3c50e3e79a4910135ec592
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_c5a74b9c37d68cbd347524b10f1c5d20_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-02_c5a74b9c37d68cbd347524b10f1c5d20_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2668
  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_c5a74b9c37d68cbd347524b10f1c5d20_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-02_c5a74b9c37d68cbd347524b10f1c5d20_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4140

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 14.0MB
        • SHA256 622a575855bb4dea8581296a5f245c8143b07f9ee0865cc37898b0fe38a5758b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 13.8MB
        • SHA256 9d06990f3bad9e7a58ba4c21aa2e481d48c23c0b582005f3619a6cbd881a28db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 31.5MB
        • SHA256 da4f7dc36996a34b6e59e7410710c97f05e8f097b382869a2e5fc2e276dbf204
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 27.8MB
        • SHA256 a6afed0383eb2f1dc97852e7e5f6d63dc3317a3167ee42e7a5e8838a9b6c8ed7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 50.9MB
        • SHA256 3ca5645563e3d6c5c306896a79fd53c7906b828b49ddc2e1f4b8f9ec43517a83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 15.8MB
        • SHA256 cda5431deb875bb2756eca5ef7154b0f64c14a67f7d0efef763910cfa2036254
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 33.5MB
        • SHA256 6aba48f1e10c1b2639b8ef7f306925482437c8d18317a075f345fa221530d5fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 29.2MB
        • SHA256 5ee114bd3cd98fadb7195de4298215d460aa952e9311a5c03e71c5a9fd293382
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 30.9MB
        • SHA256 a7ce15fef31294ddbdfc5e3c400582c4cef4a7086ee16fe4828538150bc6563d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 29.7MB
        • SHA256 d54ef48e3b44bd507cdb67fa0f5d32325072ce6e1e3306d08170f008bdd1c940
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 29.1MB
        • SHA256 4c7f9c733c15dfa3171ff0741ae00bd9f3af26fca8e83901e56626569b355f0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 29.3MB
        • SHA256 3163e5e4a02a7de4df76582311767b765f1a7f5f01e03f4f6a27e7f572fa010d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 30.5MB
        • SHA256 5f9e8f29863b5aed2d2430ac1a08c37bbfa6e892a03d313f0f30a53cd37a7129
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 28.9MB
        • SHA256 632bc0710f6236c7977bf2a95a0520262cb26800e6ab3aa3c0d363e518452602
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 27.5MB
        • SHA256 4f7fcc29c7bba83887452349e734c007bed73c756c047780d307230b9ede9863
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 27.5MB
        • SHA256 28138ffcc438fbbda5a088e86b0e3cf07d210b4d912c9794c091bb55db77d7ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 27.5MB
        • SHA256 3f180e416632d94af93d9eea612cb0cca622ebdfb09675dbb4acb321fbc665df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 27.5MB
        • SHA256 d3cfb0ae03415da7100e48ba78226056b12d7922844d35d79abd221c3326eb2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 27.5MB
        • SHA256 6f49f40f05ed56024a7dd91bdc711d4b1633fc38879b76df88bf586c3e202cfc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 27.5MB
        • SHA256 2c56cbd922f1fc314046189eb265b680e31039d33913fcae792f31366581cfff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 27.7MB
        • SHA256 9b105a273eeb433eca5507bcb9ce80d85d29a6b6c71b9976a9b85d6dfd386201
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 27.5MB
        • SHA256 3358ed19f732caa2d436da3f62a26405cf27a9f70090cc00f21bf21a533dd70f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 27.5MB
        • SHA256 2a2ded2e6324b1231322a3de0621d065a1d7ec62b7f99980d4b592099a9a8c22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 27.6MB
        • SHA256 ac25c9e6b020db5c792b6463e2dfb33ed0f8ede9db59fb1fbd3717423b5b85cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 27.5MB
        • SHA256 46a799c920c6ab245f591d0e21796bb6a6c2bc3ef3ed73b1dcd6e8634a4258a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 27.5MB
        • SHA256 606ee8880c33c03533185a65c38eb7fef2015e45565edb6300501904b27d4d7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 27.6MB
        • SHA256 fde421d8e726ef7f200df9fc098e266625eb1924bd7d2976eeb831f0006c9d6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 27.7MB
        • SHA256 175f4d179826a14955c0cba22a9d3b6a253ca27c268f2c25355a8b5e6e31423c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 27.9MB
        • SHA256 2c87b79735a2269c3ead99b5fdc13b327fa103ff96d33bc2b1e89d1ab671ab0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 27.5MB
        • SHA256 68d5a0e7fb94da40b9d8b5be724cc99c1cba19148b4dd744a8de43838a29a853
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 27.5MB
        • SHA256 8f8c61211942c16986f8f87c7815acc9c975763c6738bd6ed5694065bdc4de48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 27.5MB
        • SHA256 535e9ca4407b6cc791311da5459ea2786d1d6fe85b21fc3e63a8d8043049d1c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 27.5MB
        • SHA256 7de05e6d500c6fe061571d3a458dd5d13cd152f5502422ec7ea610c34d146101
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 27.5MB
        • SHA256 2760dc54e140cd2db86ec587cd4b00e08346fdbbcfb29d471be85ac2cea74487
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 27.5MB
        • SHA256 b797c385a69d4d190b01231ab997558752f1ed6241c1c337753e323dc81eea98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 27.5MB
        • SHA256 c82a78458919411ff785509a5020cb7c771a45a4389c8d8c7346c73fb0939ac0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 27.5MB
        • SHA256 433cde377e8a50e68ffb48edf44158761b1d194d21d9fb9508caefd3ed6bc40d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 27.5MB
        • SHA256 6a44e9302b25b57b549232007aaaa569a13086fd96ce216484ed1b9475d2b51a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 27.5MB
        • SHA256 928db852e23cd06d16b49ab49843f7e6746bc7bf12a2a59321c1f009980019d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 27.5MB
        • SHA256 07e2ef2c180fb3874df573bd1aeadbe0b06a89f9b562ead695c6e0ec84598401
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 27.5MB
        • SHA256 78eba12e07bc008a897f13dd0a30758af187b5aa8588ba2f20e3bc9eeca75f71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 27.5MB
        • SHA256 151aa2f0c29aaa987ea8577ded573e0e7bb017232980715e5efbc429fcde71e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 27.5MB
        • SHA256 91c1b91b202090f341d3fb238f74b33ffe491dcdd995314fadd378482d261573
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 27.5MB
        • SHA256 12e747a60dccc14c2fb8eeac233777f5ef39b51768e237c4fb884607eaf0209c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 27.5MB
        • SHA256 153ed0df63e99d6062647c7cb94581db612f2cbc9f15a58764a63c1c6ad53e2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 27.5MB
        • SHA256 8154a226c7f66ea535cfcd439ca609e6ba41e05dcfb82ce0434d2ff91c47cdef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 27.5MB
        • SHA256 e3115e6a7580bc18409c6c2d2d0ab0309be6687e6a5ea23cb6b878118b06ecc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 27.5MB
        • SHA256 83cc34bb8cb61ae68bc515f732ef4be773e871a72c97ae6093b1786ef4fafabb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 27.5MB
        • SHA256 6bb90d6311a138047aee209f8cb7c86d8a13feecd4689fecd9f126ebefbc3772
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 27.5MB
        • SHA256 004cdee2626a07ef1da5981e6fd8de08098ce02e1d42349f602a7a765f196b4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 27.5MB
        • SHA256 fdfcae07c54e1d0f28c826fe8fdf61955dc036aa9fbba9581aa0c47162c66eba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 27.5MB
        • SHA256 a30b07aff46d5f73db10ea51b6bae3cd3cc0bf21a40d6bdb92a50a216b70ac84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 27.5MB
        • SHA256 3e17b2d7d2598b1547fc2d3fd4f00866fbf626ec8a99204e294970ef1b12dfdb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 27.5MB
        • SHA256 7104a4bf314e13eba8707200d01d47e708ecc0ac526861597c437091304f3935
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 27.5MB
        • SHA256 7366d5bb2c08fb2e2516c63b8db5f9dc378b98699004aa1d070614e71630f6c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 27.5MB
        • SHA256 5ca522e8d7e589416391375af479191da4a04a331fac8e71410142717ca5e033
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 27.5MB
        • SHA256 bc8678918749477a0873cfae08410cb11f9824cdaece466e2803fb0ad89ecb1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 27.5MB
        • SHA256 1f8bfb827f144598467fa2be7d63f05f77bd1e77245b6346381bc48d73fc2342
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 27.6MB
        • SHA256 4f3432b59458c00843e2ff9dcf6d160ee439a0557de75d29c5e4c3e4ba7cc4c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 27.5MB
        • SHA256 b783908793244877314ca5207d0cc4fbfc14bc398403b0659c22ce1957138597
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 27.5MB
        • SHA256 a32f775cd600c6d039f5ffbd1f91182e82defb3a778d49510f399af280fa4542
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 27.5MB
        • SHA256 afa1eb72e11e5c25768afb3223e334486aabc817459d24cd08731a371c6b1574
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download