Overview

overview

8

Static

static

3

2026-08-04...d_.exe

windows10-2004-x64

8

2026-08-04...d_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/08/2026, 18:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_d0c44d733873835e73aa3f0f8c50e632_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
  • Size 17.4MB
  • Sample260804-wn9syswgrc
  • SHA256 94f8fabf2affc712e5977ef53eac0175e618fab0cf5fad08dcc2e758bac9b58c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_d0c44d733873835e73aa3f0f8c50e632_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_d0c44d733873835e73aa3f0f8c50e632_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1676
  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_d0c44d733873835e73aa3f0f8c50e632_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-04_d0c44d733873835e73aa3f0f8c50e632_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5064

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 18.1MB
        • SHA256 7f7e7fa7fdf4751622a12ffc1212cbf772bec09ea3c33b3ca0f231dd8fc4add0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 21.5MB
        • SHA256 daef74eb2cabc741b2b96465c7942f1d133ca1165838769329fd87774023c73f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 19.1MB
        • SHA256 f24d9fa466a5330b1ba1b8ac62e3a800f7617720a7a2f34d33f233fc0938dc30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 17.4MB
        • SHA256 500b2dd678179a324c72e5648be7b8a9b60cd5e9d8458dcb2daadfaa139b2226
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 17.4MB
        • SHA256 2c52388e38dde96e7a33630f59c25e8d9dc3da127884f429d29df673e9a865e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 17.4MB
        • SHA256 e9d8d466744e2fb499e627c1b345b42133f748e94fd54ad1ead5916b4138d870
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 17.9MB
        • SHA256 e95ed096fdcf67dbcd7d4e0229178e0a392ba31db85b594231123915222996eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 17.4MB
        • SHA256 e3ccbfabef3f241b9720486a155bcca354850548d87b051b33f71bd783cd0b7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 17.4MB
        • SHA256 7dc56efb17e7266e0e71752ee297313e44f77837af0866ec6110b15002b910f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 17.4MB
        • SHA256 5db22e5c45f5fcebb252714b3a86ff062d2c3eaf399f9c9c561f5666e8acd9e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 17.4MB
        • SHA256 e1afbec9c2ac84f6dd8ec3ae272856be4416aa5b45f6e52a4c29a32a5b6f02ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 34.9MB
        • SHA256 c7aaf12f983ca279ae8f40f71a08012535690550d080ace98e111e4e42ead634
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 34.9MB
        • SHA256 c7e552a717c33694a389097816fe472c0d4251054a8f2247880b4fb0b5b3d9a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 34.9MB
        • SHA256 42c9b2175c600ea4f6c3b7dd83cc1456172afc13bf24728b339509351dd93bdd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 34.9MB
        • SHA256 5398f9aa570edaba079ce70e46de3dad97f56a5f74202edf0cb6e94d8a30a122
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 34.9MB
        • SHA256 2b6ac1feca54290a7fa70b8c5505ccc2dae813869296c30fd76f3b86bb09ae64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 34.9MB
        • SHA256 5eba6ec83bf2d35499ce8a76e0eb78dd6b2c18ffaa293e30d3afa630088bf7b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 34.9MB
        • SHA256 379846d5011b0493ccd2eddccbad582078521fd7bab3437c51a4ba211d5be850
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 34.9MB
        • SHA256 89909a9209cd495b9695707207dad7883c696ef0250b06da83f29b13314d2e83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 34.9MB
        • SHA256 9fd7da0e1c13545cf74dd4a60f330850afb834af6d9b73d7e4a788730fd4e038
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 34.9MB
        • SHA256 04842354e407e1d0c936959587905d8c814ac82a34b9bcc84015864943591f72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 34.9MB
        • SHA256 0ea7efbe114271bc9576877bacfa25b1b659a543a4ce0b33ddd1eb4e637d0241
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 17.4MB
        • SHA256 c4a26c9b270cbd1cf01e70dbe903a1417c4a94cbc32f148e6ac70dac77e46d2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 17.4MB
        • SHA256 cb132399b1366a6ebf400b6696eab11ccf328baa1c53c7c95f9d750573d4251d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 34.9MB
        • SHA256 decd3dcbed868a8bab7a866946a63a7ce6f8f6ddd98a118e603718ffd8107eb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 34.9MB
        • SHA256 cac2d2e066e23f5656666acdbb4bca2bdff274f6de0a51d915fdbf28bcfe5457
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 34.9MB
        • SHA256 f0eb4760ecc402af42e7d1eadd975ddabc27abca388c0b5a040886eb292e70a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 35.1MB
        • SHA256 fb68efa59aefbe18cfcbd6f9f0d1006a322739770c84a6f9a0e848797c6106af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 34.9MB
        • SHA256 94abc629e4dc84d56f5d6d21b5b933fe921c1100fc50136dc0e9060d8c282c9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 34.9MB
        • SHA256 022b0deb69a14dec40671964ddbdaccfe5a0fa5a1789f6d01c1d705d3da5eb53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 34.9MB
        • SHA256 b209d3a623db54e43a534f1f30877e15af0218990f1efe4c0cf8f5b67890b301
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 35.1MB
        • SHA256 ed0159148bd6df13ce09d8d5dbcac5fe631bc7f374ef97c5e2a214a45516add8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 34.9MB
        • SHA256 ec2b8a3c54c57a78b63a9b223a834de420d37572562b14e2bbb9254c3040309a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 35.1MB
        • SHA256 91f9f83129537dc416029a08cb860c16b009289c19cea5b485f2b85b7aa4517d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 35.3MB
        • SHA256 bbbe0e8b6126cc5e55dba4fdeef0060c5bc876784c42b83f70a89a5c704ac757
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
        • Size 34.9MB
        • SHA256 d14c52835a747dfb7e4d499e1d3f3bd7d97fbead7f336b47b30e62acd08fb7d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
        • Size 35.0MB
        • SHA256 2cf112cedc0a5c912f67d8854a5a6e2d800a09b144cd63b698d69a4e07f3a72a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
        • Size 34.9MB
        • SHA256 9770768dde96de4bf2c9d1df0a32c2ac2358456a2c076ebd4ec1d844edf5216d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
        • Size 34.9MB
        • SHA256 5ecf2438026a417f9526c5ece9cee4b123e9c35a16878b9158350db3e423d312
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
        • Size 34.9MB
        • SHA256 41bc943a56a43b9961c64640bbab5aaa9ddfc1d64c3a6f18353c04af42555a68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
        • Size 34.9MB
        • SHA256 76b92302be90271d6d143d185168c5318a6b9cbf8ceca701ece703e218bd318b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
        • Size 17.4MB
        • SHA256 c9df51556bfc9cb54b03bcf4db18029f117470ab5403a1d959e3fe10053f2b8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe
        • Size 34.9MB
        • SHA256 31d6437bda7a2d42f2ae4ee13b7e9de5164b1754ad5293f77df27957a7fa41d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe
        • Size 34.9MB
        • SHA256 b220dad4e1e86342f6d6c4e7302adbabbc4a6482bb2a7ee6f6b4fb34a3ce7b83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe
        • Size 34.9MB
        • SHA256 2b79b711092f87e1e1630683ddaeab471809907f8f8af75217467ba907dc675f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
        • Size 34.9MB
        • SHA256 bfb2b9aa8230ea725efa0806412311693787e51b8f01afffa70b04adc3643aec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe
        • Size 34.9MB
        • SHA256 7b178fb8ac5a7f6f57f13f090efa23bbad58804d305cf124c0b3bbc24fad0182
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssvagent.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
        • Size 34.9MB
        • SHA256 8f5ef186ce1c7d6b76d254fd8445784d7aecea67bd0d4d37ab4216f3c805dd07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe
        • Size 34.9MB
        • SHA256 e07584de98b9483bdf1e042c25d102139c7aa598a4f0294627f55ea78d207f9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe
        • Size 35.1MB
        • SHA256 9a52833db21ee115fa87a89f877233de0643d0ed2271c461239854a92996763a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fontconfig.properties.src
        • Path C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src
        • Size 34.9MB
        • SHA256 89bfb5ab7befc2fd3f659fe0ec2d99aabef95cd80e987bc1249f75ab3b71607c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jabswitch.exe
        • Size 34.9MB
        • SHA256 4bbcb9e52de34c897b4372ed933f51ca8b3de8c9863cc866f6dcd694bccf5c9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jre-1.8\bin\java-rmi.exe
        • Size 34.9MB
        • SHA256 12e5b98da3a332d42df441f2f01b02524d99e8d8533123aeba030c3183674f18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jre-1.8\bin\java.exe
        • Size 35.1MB
        • SHA256 9bfe5e4c5bd9ad74c18fa88608a004f44f421420a55946f696a289d020eb9bb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javacpl.exe
        • Size 34.9MB
        • SHA256 395e09649dd77e97286598579ea54659d2b166dc21893becb75843cdd568fb58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 17.4MB
        • SHA256 94f8fabf2affc712e5977ef53eac0175e618fab0cf5fad08dcc2e758bac9b58c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download