Overview

overview

8

Static

static

3

2026-08-03...d_.exe

windows10-2004-x64

8

2026-08-03...d_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    46s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 09:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_e80ccf643934a8e1b4325129052d40f2_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
  • Size 39.0MB
  • Sample260804-k5bfyaweph
  • SHA256 9ddd9516a44e525eb63218d39304f29bd63e3dfc5d58760fb3809dc1910fb2f0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_e80ccf643934a8e1b4325129052d40f2_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_e80ccf643934a8e1b4325129052d40f2_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4136
  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_e80ccf643934a8e1b4325129052d40f2_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-03_e80ccf643934a8e1b4325129052d40f2_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4824

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 39.3MB
        • SHA256 8049e0c401b26fa1646b464a0df80b668b003e8259468a8333add0a8faaff7fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 78.1MB
        • SHA256 c5e4ca375e46e9948a597817be69cbdd299600dda18295836491eadcc3884116
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 77.5MB
        • SHA256 64e70b68d7d7ae07c166bac350447fbe57e7c2d4637de0bd1255699ecf332655
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 78.4MB
        • SHA256 9615d2f2fb7bcba4fe71608d545ba97cb78fab0492378e24ccf8d81a5bc58005
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 41.2MB
        • SHA256 52f31fef3cd6ac016a81fe71553602f639a0d8e697bfa6ce8e5f6bcd0893caaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 76.6MB
        • SHA256 01e19b3603f8d73de6d2b6d02b1592df13e724a77f3850f068621b8520fadd21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 59.9MB
        • SHA256 3c4e2a2705b2408beaf6d9ea922a16d5bd9bd4b33ee7f631d8ccc6c5f6c256a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 60.3MB
        • SHA256 bed5d2a4ce7be5f1a4806733801261fe492c5b2c9a495ca0f244ae635dd80983
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 68.0MB
        • SHA256 a8791138c0f25ba3b402a14efd6bc7c145c0c93d6cb642b6f88aa0c43ba6207b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 66.1MB
        • SHA256 2709a112adab6c0622544ce4c896ca9eef31a78f32b5c6c92d2e5e535ad89bc3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 63.7MB
        • SHA256 df1e9f32af8a583694fda5cb8af8c2e573efb621f7a15ab662b2b1d43d9085fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 59.1MB
        • SHA256 cbce171fca4370adfd1d0703b40a52b393e97363955d23c3937571dbe45d1970
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 56.7MB
        • SHA256 b345de58b19576cb8634644199077384580f253c97245fb831a12dc2897fa206
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 56.4MB
        • SHA256 fdc159c0f64072f1dead7e32987beda36ad3fb7bc6161846f4dc5d4e8175fd1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 53.7MB
        • SHA256 f5497b485b84c2b88db9cc32a84bd201048d97f591c32d2a104b9ccba63b064a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 54.6MB
        • SHA256 b81a409ec9d58dba117577776af516b170f20649ecb65f6b772a0390aa6149f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 52.1MB
        • SHA256 151a72b35e3c38623a79d0a61e751406a1edeb0f3d7924256b5a800d83cad18e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 51.0MB
        • SHA256 b727e6d20c241484bb1659a506352a7b76a1e1a244aee1393182455120d321bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 50.2MB
        • SHA256 b5de9683c7fe6e05987b0c07c232b454baedd9fd448414a442731de3b148544a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 49.8MB
        • SHA256 854e185b80f82608c36987476e804304bda23f1fe9e50651cbcb3ce941d4f875
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 51.4MB
        • SHA256 455d3f04184a6de935c93f7d4e35537d0f79d4c8bc7f79d23c394933cf609352
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 49.0MB
        • SHA256 e8cb3adc1443790520b346049bf7369445d0ebb986f3fa6375456468b78f05b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 48.8MB
        • SHA256 a50bbae6b872ba2a9ac16bac168d74f8e6f8098a93a1e617bc05e7fb5c370b0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 47.8MB
        • SHA256 0e1aacea0fe10f15da15cbeea17f9fda8a54a3753879cea6a45dedcadaf93209
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 46.0MB
        • SHA256 d7ab8e4126f9e697ad10bd58ac3fef11fe17e64713f23255aa3ef17665b653fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 44.1MB
        • SHA256 a1e181c8df7b12f28b51251a965106af2467d29657451b5a9f357f2af1e606a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 43.4MB
        • SHA256 382a622ca6d65b3ebb2f02bb27be88a9b36f60ab0b563be9a0dd03d8829ad1d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 42.4MB
        • SHA256 f12063cb07e6ac004153bd1788922598bf87393e02ce09ac1a6284b3a9cfd05f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 42.1MB
        • SHA256 cc285572d58ec15452b10763900d7c95bcc6af8870fddc465fd06112e6efb037
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 40.8MB
        • SHA256 6216fd709452e21b1aa466783275961018b7f543edc86c1f9629afafa0936805
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 40.0MB
        • SHA256 d388bf615d4f9feac39e71c08f66b6fe5296d91e91ad3e101b2188da627d62be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 41.2MB
        • SHA256 d7629a68dbfff949c1edf8d5e408226b60e1d0b67202f7d4731b55a0de3844db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 39.1MB
        • SHA256 41e2c55b26b01bdea4310d2ac5f94ed1f2b8d1b8afde555d4db2f4788bfb330b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 41.7MB
        • SHA256 60a472efe6d7599389e226e64ebb5924fb047c6d98290ab3301830271a15c328
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 39.2MB
        • SHA256 5fd57a8983e4aa6f5e7665df07da5530907bdb138772e979870d299a403939e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 73.0MB
        • SHA256 3123bf38811d0940d87bd53a87acf8a59d55f1bf1e058325e49d02ef45ea9b4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 72.8MB
        • SHA256 0417498ba2a6bf947f15b305065525d85478c699b9f93e2e63ba92fb49447aba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 69.6MB
        • SHA256 ec86e132afcd6032b5eec67ff3d2b7ff40d107d23017df65c1aba322cd7ebf9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 71.2MB
        • SHA256 1c8f054d7a1c108e99c38f546ce2b2f02ffc492bfeb1cd57a12c235fdd98a9a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download