Overview

overview

8

Static

static

3

2026-08-04...d_.exe

windows10-2004-x64

8

2026-08-04...d_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    30s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 15:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_77f2e613c6cba805a6c3be3caedb759e_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
  • Size 18.2MB
  • Sample260804-sp43batbmc
  • SHA256 17df8ed361bc93d7b14b85c54303d35d8c63e6c7d76c391eab6df4f182d8b733
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_77f2e613c6cba805a6c3be3caedb759e_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_77f2e613c6cba805a6c3be3caedb759e_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:6036
  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_77f2e613c6cba805a6c3be3caedb759e_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-04_77f2e613c6cba805a6c3be3caedb759e_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4860

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 18.5MB
        • SHA256 eee5454d6672f7deb9c5da6a020ff5c849c85105fa6890e8cfa9971e731a8212
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 36.4MB
        • SHA256 368460081d9729c6b8a959c837fa558544b55ad5c5a15f63a5aec6cc6d316ade
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 40.5MB
        • SHA256 46546c14c64564fbc4376806ee541c684965c3f0d5dccc593d7a7f0c502322ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 36.7MB
        • SHA256 7af89c88e62edfb3742721b514fca7708083bcb3a7e4549e84381903fe2c7cba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 57.2MB
        • SHA256 cf9de6554848fe40b6629aa58e2efa647918c41ba9a72974f684ccd115276ea1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 20.3MB
        • SHA256 5397d786836bcabce73b78f98d1c02e37bdac70b2f799d45fb610f80bd9827f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 39.1MB
        • SHA256 f62939c61986e2a4f040b587e9bf20a2a1b5659cab44c476395a366e304dd831
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 38.6MB
        • SHA256 29a5d758bf669995d3c36f37db9377895e190f2895db472df361678204310980
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 38.0MB
        • SHA256 ed541fea4411f5cb6f9fa7c8b5b4a9172e1e6f966e75b2e974d9bec4a2089a56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 37.3MB
        • SHA256 6228286e37ad888c53f77dbe4c7f7bc65865882ea38c6764ec2ed317c844cf48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 34.2MB
        • SHA256 01a0a7eab8a3ec43a3d5f92d04570ea86daa364517d38f5ed5c0c67da2160a05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 32.9MB
        • SHA256 a19176f3abd5cf6ebffa2745b7567e91d09c5725b0e39368eb4c0f4f5c60687d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 32.2MB
        • SHA256 9fe697c17407144b27a0c083202fa7df5434f8bc65ea95d5cfc69ebca5c2e201
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 35.3MB
        • SHA256 96de5fbfb538cb9547b89bd8a44fff1d1b9449d36d01cf2cd706a133da416570
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 35.1MB
        • SHA256 8790b91efc95ad897d20ab10462910c666866c3a89406fb6738023b45477ba43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 31.8MB
        • SHA256 4d6cfbdd3055438c0da7f2d9f51efc204503d48a31e61545d9971ac42ccd7031
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 35.0MB
        • SHA256 2ea16e6e6dad219d6171862682c007e07f3968f5e440785c5f6d6bf078b595ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 31.4MB
        • SHA256 db123a06c1792d1cfe32706b02321724d8f96e1cfdc107dc115c1dc3dc8638b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 34.7MB
        • SHA256 e8b64bb774ef6c47c48b3108ce7d983f47219d5427b1f2107f4d93e42b9e8b87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 34.5MB
        • SHA256 09ed26d6c97f0c7c44a61a646035d0922a05612b644d5ee2a90129ef672f6227
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 36.4MB
        • SHA256 babcd914f21eb89ffa4af30481a113cdf39e1d0624905cbc06da210ddfb4aa3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 34.4MB
        • SHA256 83a2300ae0950d0aafd484ff12a829c341e7185c2be46633c4030a56167ffc6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 31.4MB
        • SHA256 4769ee93a16491cfded4736e2c86df4283bc056d3b7dc15c433572667adaeeff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 34.1MB
        • SHA256 511e6fac01fdf4bcae582531a01608a744c6410271fa25f2b09be4ceda5d058c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 34.6MB
        • SHA256 ca497f728accefb3b14a3e3d2257ad245eaa31a0e0aec8952faf3afd3aaaf780
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 33.9MB
        • SHA256 7440a899b6cef651d35b11800a1550dba5118149afebe3933f38feee204b118c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 30.4MB
        • SHA256 ad3de6da531757d4dfefc36eccbc2fb4957c51219efb211d369b19636f9d0915
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 31.2MB
        • SHA256 1e7441195968f7e819479523622643a9dff293476f9695cbdb2aa44e61ae1516
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 30.3MB
        • SHA256 b42409aeb150d423ad2f905a32acf9b7af9e13bbe8f536a0808f0580858981f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 33.8MB
        • SHA256 1b01808d0f9e671a226fd98d005f5e371b0fd2a544562b89f64036d53b5eac03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 33.6MB
        • SHA256 c77e03861f390188fa5da7b954cfdf446dbf9dc8876cce348ceb1287dcc4acf6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 34.0MB
        • SHA256 27d74e3160b76328d949f99c91152a31a9c1d3291e23789716bb5c4845c7bd3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 33.9MB
        • SHA256 a5454d60d98a0027247f5fb002fbd15246d171d8e4289d6d7fa41824029aee69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 33.6MB
        • SHA256 78433978884571fc6ed57548988b9db844934ae83fb19efa469617f1291ad55c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 33.4MB
        • SHA256 e8384fcfc88a9ef17a77ca163f82214f78872122214b6d0fa31e8e35e76b6d88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 35.4MB
        • SHA256 b1136d1a7cd8e86cf1cfd9d3fc68a9d8b7c361e6f2033abaa36ea8b835b959ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 18.2MB
        • SHA256 2a991a73189852cd8b3c369c3060326e285fc96a9a073f3b88f6c7f50b151eb9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 33.2MB
        • SHA256 f6953cf26b057ee86b3d20e13efd860fadaec9c914ac9f087afd5b1ce61a4cd5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 29.6MB
        • SHA256 cf7619fba0df56514a242ea6d96b691f94a76962cd6f4a83ce0b65c30272baf7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 33.2MB
        • SHA256 3cb18c0d5cf3828e7b1a0cb5c65a81074b06cbf5a8a59842b58f23e6bd8a52bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 29.5MB
        • SHA256 cbf85d28409dd9ce42e0e18864cf32281cf4ff3d32f697b58f5ebfa6ae695923
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 32.8MB
        • SHA256 2cb85b7edb674e0542dfdaa2a7de2993521023364f55f6da6428e92c9a079daf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 32.8MB
        • SHA256 ec0837edd1ea34f1c30b7d5da2ff27911ee41cbd89639c4539d66953eb54ec2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 32.9MB
        • SHA256 9cae365e0b7d362806e2b775e8e93a17bc7bc67505cd7b09e3f97194f5c621c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 29.1MB
        • SHA256 1d0fe3acbad76fc180c187e4d3f9eff8028c2c5b14ceb10799b03a4b266f9928
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 29.4MB
        • SHA256 9af011792b889f522614d229c1de9f36a5e4084b4a744b796d1a66dee0fbd526
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 32.5MB
        • SHA256 efa63a6d455180b54d9e0c1b8109d1e88e3d7d00e115531176668ecc85a303a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 32.6MB
        • SHA256 b4837c51e305de037aa970189cc7f7aa95efbb26d253c6bce8df79d9c187b7c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 36.4MB
        • SHA256 6b9744b43a7d82359f8fbde158433e4690a678561c010924d34788f68a6133dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 36.4MB
        • SHA256 e9911bdd84e0d4a60c133c9a339611c1c681dfdc1e57f374726531edf2c2181a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 36.4MB
        • SHA256 7ce1c829d1fa541bba25ad8a84333f9dfd3cd489eafcfa226ce68c55ba27c2e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download