Overview

overview

8

Static

static

3

2026-08-03...d_.exe

windows10-2004-x64

8

2026-08-03...d_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    98s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/08/2026, 09:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_e80ccf643934a8e1b4325129052d40f2_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
  • Size 39.0MB
  • Sample260804-k5bfyaweph
  • SHA256 9ddd9516a44e525eb63218d39304f29bd63e3dfc5d58760fb3809dc1910fb2f0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_e80ccf643934a8e1b4325129052d40f2_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_e80ccf643934a8e1b4325129052d40f2_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1924
  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_e80ccf643934a8e1b4325129052d40f2_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-03_e80ccf643934a8e1b4325129052d40f2_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3016

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 39.7MB
        • SHA256 348667c597d20d0fd03d7bed679f268958818001671d1e936922bf0ca85567fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 39.1MB
        • SHA256 e35ea641bf5d2079a86ace64e028421bbc8349cca40dec8bb4d57779ea49244d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 78.3MB
        • SHA256 48bce46ecd52d5e98967ab59bc6a7c20f11639ef9635f4a2502bb8b05ef7a07f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 78.1MB
        • SHA256 8aa24c0fc238cfca6a03913327f22ea0a8fe8553c56786785e29f8982c1af86e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 78.1MB
        • SHA256 4586a24d30105865dadfb424b880cb440e8887faaea23bfcd6e1292279331595
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 78.3MB
        • SHA256 6436c0ae518309096df21beb2b0c98438ec9f3defafca11653207a71976357b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 78.4MB
        • SHA256 7263a464e754fa7a719e4ab8a9ae2452fa818958c28d3cac6aff24ea5cb0669c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 78.6MB
        • SHA256 d807435b0fb0af5f15a2ab6a48719550df3a9488931013c48fd2d504cb2b9335
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 78.1MB
        • SHA256 dea4fcdfb35f619cf988ccd52dccbc1f96c8f8954ed441fbdc8bd88d15b4f5f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 39.1MB
        • SHA256 8deb154dc8db313504f114e0ed9d28dd9e04a5079fc8a1a24b5f0693f86a39ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 58.9MB
        • SHA256 4f034b82531c225f2b01f92f795c743c2350b07b76ecfc1004587d08ff4f2166
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 57.4MB
        • SHA256 8e332a1669ef1e3ce895df6f7d0264ae21cebca826f8307da58223dfbba34303
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 56.2MB
        • SHA256 834917a41726c61fd52367694d1860518b717da9d20b81e31fd02428e441947b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 54.6MB
        • SHA256 5033f5ac31921e2c21c6708fd27ec3a99af61569b1de3760403432c607ac7ae0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 43.2MB
        • SHA256 1a325decea6283f686ab25d930d9b88b49dd7c7c256c5d691db25b6f5259f5ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 42.4MB
        • SHA256 30d9e6bf13857bc30a49e2a894b2324711b8746b6dcbc450c051f5b759fef06a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 42.6MB
        • SHA256 eeb6568d3e0be6437b3cb32c533e8d8db17cde55346e2d85678bbebfe6eeb2ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 40.8MB
        • SHA256 6216fd709452e21b1aa466783275961018b7f543edc86c1f9629afafa0936805
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 40.3MB
        • SHA256 785bff4edf6262b92596c2823ead35cc2f8fa0a5c635f91cd012926142c06da1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 37.4MB
        • SHA256 92a552cd360f463ebec09aaef7892d69d155758ad6773cc2309f9d8da0ea0cbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 38.8MB
        • SHA256 05e0e45c17805bdac8f45af2b70783460e3bfbce26f0922cbf952e348a5cc546
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 38.2MB
        • SHA256 9ee758c3fe26ebba341d4ca86e45c416b1fc45ab45582de25106718e94ac9988
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 37.5MB
        • SHA256 1c86a893a2457ee978cf77990bbe00524a8f7e4d52c7d14c28fb90b1c634a91b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 32.5MB
        • SHA256 147143517c12a42715787caedae9961d9b522b0a210b28c3534466b4c532cf30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 28.0MB
        • SHA256 4c6318ddb49579e22d54d4154aeba03f024641b011c25d9866627b1de0e2b614
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 31.9MB
        • SHA256 77fc15293b903b27173ed3a31b6915c5fd4c4dd3288e3748a05bf9e391c1bfa2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 31.1MB
        • SHA256 f3e901fc13d789b0676e7e09a376c44c1c09ccff66ed546f61b7f20465da92ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 30.8MB
        • SHA256 b77cbc76cd0ee49eb8b4f6b64b0a32fce255732875fd668abdd9ced86d658d1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 30.1MB
        • SHA256 e7097fd62152d0727b240e1090bbbaddb2aef9db0698c5ec113d09163e006b5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 30.6MB
        • SHA256 b1967596b0b4830ec153d477fd56d8e3e09c0d01d08d4d7be66d5aafed56f30a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 29.1MB
        • SHA256 108bfd2cdcfb06a39a4a3a067ce8771466732e1c71dda84946b0d1761a2665dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
        • Size 24.8MB
        • SHA256 0333c63122f5670f61b25e66080adf190ac4341f36c571631ec1aa1c54d4e4e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe
        • Size 22.2MB
        • SHA256 2ccf1bd96b3b1aab91801fe4e8537e8d01a585cc362f8b9e5137bc41f1a6c2a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
        • Size 20.4MB
        • SHA256 0cc032164bd64dc104a595136163b3559dee62640fe0330d4d7d539f269d2824
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe
        • Size 14.8MB
        • SHA256 508e09a46e9191db3aee68d39866e0492562fb92c69e6e16cd2832d4d3d8578f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 39.0MB
        • SHA256 9ddd9516a44e525eb63218d39304f29bd63e3dfc5d58760fb3809dc1910fb2f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download