Overview

overview

8

Static

static

3

2026-08-04...d_.exe

windows10-2004-x64

8

2026-08-04...d_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    31s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 22:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_c3921677cccbdb3cb2bd0fb3e9ad692e_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
  • Size 30.2MB
  • Sample260804-19d1ma1hjf
  • SHA256 b4dcb4afc850e015fcd6a230475519e5e5dc0a16b46a4ca2d7f1fbba7a96c782
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_c3921677cccbdb3cb2bd0fb3e9ad692e_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_c3921677cccbdb3cb2bd0fb3e9ad692e_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2956
  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_c3921677cccbdb3cb2bd0fb3e9ad692e_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-04_c3921677cccbdb3cb2bd0fb3e9ad692e_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2472

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 60.6MB
        • SHA256 d8e29a8b3b644d937129d767197e74ff14310ff7f5e69e183f17868bfa096885
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 60.4MB
        • SHA256 c3c34f60107aa2e0f6053dfcc92e5dd27f819149cc942798e8a8e5093380ae55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 64.4MB
        • SHA256 7fbed430893f5b88aec5ff0b3fa9715b6f66ce50876a06cbf42f9769301c8d20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 60.7MB
        • SHA256 8e6ba61aad0b4b99285edf38b77f29c4957232fd12d23ff9538576a94fef0d13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 32.3MB
        • SHA256 9878140bf6f196bd5a99dbc5d5f64abeb012b6eeadf6c0d961bf1b1bad299a4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 60.4MB
        • SHA256 7c946d558f84f30ede95c73736413d4ffc7c13c2b47e3c0c992aa3646f935c57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 59.7MB
        • SHA256 a0cd16e6fea0b2ce79762882d32eb85e4bce6e868688a9d53e48e5b62d26b24d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 56.3MB
        • SHA256 04ac2c5d509295c4e0d7cb8005f7c1cb8bb93b39586ca171c21b68ca55c0b089
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 61.4MB
        • SHA256 42f5c14665081bf28321c76b1d3cdedc515819f7a90105d787704debc7009ec5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 60.8MB
        • SHA256 54413406920c1774c5d2feba39181a409cfcb085ae343c587b60ca267720803a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 60.7MB
        • SHA256 fe9f8dc9f3bf43081301260e2725dfc45ee6a191b22d03c5178cb1998d60195c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 57.2MB
        • SHA256 fd5ccdd8e7b864959c6b69eb959cab2f0463269c304d99318ba1eea04655371e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 55.1MB
        • SHA256 04c78f7b0e5dca77de6cecf768cc626f098582625fe37eb76911decea7b84424
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 53.6MB
        • SHA256 1be83c6f1ea5d7d1219fd5ffd5c9e1484150f5d1b739a04e06ababaaa1b9fe3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 50.6MB
        • SHA256 db41e6c3d5bfe370744f5eb8decfe3c03199304973068c4c5ab6590838dea808
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 51.6MB
        • SHA256 410930f8ded2498f8a4c228e0b240e8eb8dde4b84170e046a60603e658b7bb04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 50.7MB
        • SHA256 6bbbf605480e15972d3a92afa62cb4dd5b1cf654309fa1ae0151efba7967f68a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 49.2MB
        • SHA256 beb0d2ffc3c8a7cf840abfa5eb82f7d018fee752bc1166e0f30d08fa75bcead1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 49.5MB
        • SHA256 daa7509c610bc910c32f8a0962ece650dc995efa00954d16b22cd6f37a9909a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 47.6MB
        • SHA256 0927e138556ef35a6e2a36b5907e2d2abbf68ebff07fe6a2f16f288a35b86e76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 46.6MB
        • SHA256 cf6062bfdfb08ac916cc2aefbfc607547a7f14de84a69bdd375617f59e5004dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 46.2MB
        • SHA256 e377665b2f4e5cf848a9411dc982bed3aea3dcd4e72d90053cc26609ff184eeb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 45.2MB
        • SHA256 286137ba668ff686947f565a79eadcd7687b0dd1609a2d8d6affce64c08bfd91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 44.0MB
        • SHA256 cf27e8407abdc9916f6817404cdf9efbafcc7e2597437c66dc40285e41dee472
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 43.2MB
        • SHA256 e275afd51160bceb9cbed87f75ac2e9a1589b1cc740d8d39f0b1cd1d6c9b05dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 42.1MB
        • SHA256 187e85a9ab9b7203d1bffaeaa1e6420aa3f4f635c5c661f1c831003b36f9fe00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 47.8MB
        • SHA256 77bd23bb14976ce773258ca5663b4ee26a82b76e76ab1a533680b84cb8d63b8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 47.3MB
        • SHA256 fb5ad33923593afa3126238216932909b857a7982bc028a94170a49bdaba3dbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 46.6MB
        • SHA256 43e90e50224fb09ff65aa529b54f3917752d036fa24b355c9521084e6614395b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 46.2MB
        • SHA256 9c3436768ced680b170cfb6b4df75e9c9152097b9ee0a6b7ccdd0a0b8bfecc74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 45.7MB
        • SHA256 9748ccf3e31dcb0b6a3964729dc0636bf3c31a4698a2f18acea1796bd10776c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 44.6MB
        • SHA256 e82ca691ddde9cdae327c84632edb46eb5675b987c4234bcae6094644fd0f4cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 44.4MB
        • SHA256 6deafea3eabcf85ea3f2bf8091e46f3881b1982715d81885d8b7e6094f4afa5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 44.2MB
        • SHA256 b253e4da67030e43a1fa87756c77df648b7ce5f9436be9fdf319de98494aacfe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 704KB
        • SHA256 d00fd9890e5b8b4ab20c6c689c78fd344e6f1bfc77541401e70ed34840570659
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 60.5MB
        • SHA256 6e826c91d07b4d732383c07c7d6ec69b9b0c124b671c63b16a1729b43d8db068
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 60.4MB
        • SHA256 4f76c0d1245274a9b4a2fafeec32e9f7b03a411db17aa888b243d13d24b5ec11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 60.4MB
        • SHA256 2a19e7c23fea451e21586fe366dba918c16b5bbe608e4a775be950ada26ae9f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download