Overview

overview

8

Static

static

3

2026-08-04...d_.exe

windows10-2004-x64

8

2026-08-04...d_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 18:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_d0c44d733873835e73aa3f0f8c50e632_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
  • Size 17.4MB
  • Sample260804-wn9syswgrc
  • SHA256 94f8fabf2affc712e5977ef53eac0175e618fab0cf5fad08dcc2e758bac9b58c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_d0c44d733873835e73aa3f0f8c50e632_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_d0c44d733873835e73aa3f0f8c50e632_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:920
  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_d0c44d733873835e73aa3f0f8c50e632_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-04_d0c44d733873835e73aa3f0f8c50e632_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5732

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 17.7MB
        • SHA256 e67c410895903b4ad6deafcc09b7dc4b42777dce7d4137e5241210c8ff561e1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 34.9MB
        • SHA256 78d3b24e99630e91af0405ab5dc768ae33dbcacabe267752850f449ab63c039c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 38.9MB
        • SHA256 66495a37f8f77df78110c56cb1ae60aa97f4ea162a202055d633b0e3ac1bb39b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 35.2MB
        • SHA256 f05d88ae89966d2d5db7e5c4cef9bc5e539c11756c2c688d201384291827bc6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 58.3MB
        • SHA256 8c2f70a4e5457fad636ab0d2f5808dee7f8c3b5b92442ccd116549081dc533cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 19.5MB
        • SHA256 640cc39b78d43639ddb38e17bb49b3ab3cc262a067c35bd572e610aa11036b41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 40.9MB
        • SHA256 b30e48151c29c52b360bdce7124e44e3548ff8527a8cada6d72bbcbb23a99073
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 36.6MB
        • SHA256 aac0b8f7f82d0504d44157342c779a3370aff020af0e53f05b9cc7334b81b205
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 36.7MB
        • SHA256 0bbaf22e446bb9417466690f876c1b0b24b26a1da7b065d112d5ce5f35220c20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 17.4MB
        • SHA256 a7fd82273d817c3439de1247e74ff0b6fecd08e256e6c0fbd0ec1dfff15a8e8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 34.9MB
        • SHA256 0a148210fa0d9c3a8fefa2d5c0b65f8accafd11d628be956e5493bc8f9909521
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 34.9MB
        • SHA256 9ed23822e1fd8fa21d879b241c5f4240c4be06d21a3a4d0edcfa8b6f492be7d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 34.9MB
        • SHA256 71a1bdf865960e541400fe6fadcab5fe152b9d0b42175fa4b064b236faa93861
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 17.4MB
        • SHA256 9096a9b52f11fe8fbd5576752b01ebcd5317b5af2ac5936cacc75ab7332303c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 34.9MB
        • SHA256 894448e5ad4ebd3b75cc80854986b16426ff5f698f1a3fc3ba2a3bab2e114cd6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 35.1MB
        • SHA256 456569a9e3b84f5ec013f261d60251ddf80383ed400153205b4803c52817ad8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 34.9MB
        • SHA256 8aae8fcc46a4676ae2280a6089f12769e6df64589b36bbf920638e692c485581
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 34.9MB
        • SHA256 76ef131a18fc9e044e620fca5a7fa38eb856efb5838399e074a98ede19325d5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 35.0MB
        • SHA256 1bdd579e7c25b6b5dee0eeb59d5a5bac613b63676d266f7ae3f18c57457ee4ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 34.9MB
        • SHA256 0ab54ea3c6220dc2ba4eb9a5a79df9043b6b243ea1fcc7a1ba15e749a2f5ffe8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 34.9MB
        • SHA256 273e61c003f22d8efad01759bfefcd6dc0aeee8cde3f3453a98441fd1d28c8a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 17.6MB
        • SHA256 213523d6f07bf472f50c2687c49e4d05f8ec5599b1bda00f1366252ad7d04d39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 35.1MB
        • SHA256 a6835a70ca5e15ebb58ad56b7800ab98fdc0bfc83418673ec1eedbd702c02fa6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 35.3MB
        • SHA256 01a396e58a276a6aec2e5ed6db5e03d1f3e0b0e9768bca2649b6ff1e562f5bde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 34.9MB
        • SHA256 8a1dd4b2f5a46f023326b4bb14969563d02b789ff2a4487199c4cc26a9c330e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 34.9MB
        • SHA256 ae349ceb244941056e2c1eee0f59a59fb851c8969e093a1dfd74b16e667af51e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 34.9MB
        • SHA256 55bf68cce8b25c8e57c1cdee47312b963ec44cf5e233443b5842adab6c62b941
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 34.9MB
        • SHA256 cdcb5897ce6a99f34f44bf6fbc5643d0b4970c27a073bc325081daa1390acac5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 34.9MB
        • SHA256 064cfbd018f79675b9e39a11387f018d96f708db8757fe7107fd20f25f903aaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 34.9MB
        • SHA256 1063c9f4694236338355785f01e36f2b88712e848a12239e7b23cfd69ad08de0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 34.9MB
        • SHA256 17eee7af87eb61d8afbbe1170a46c6889b2184feb65e593a6e3da5c887ec4a1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 34.9MB
        • SHA256 c7aaf12f983ca279ae8f40f71a08012535690550d080ace98e111e4e42ead634
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 34.9MB
        • SHA256 5a07d05b8651add530e6d6e9d0368e478cf1f90decf49e29ffd566ca14d1a400
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 34.9MB
        • SHA256 9cfd5c3ddfe36519e031a4b7eb2e8fc5558f9385f3659c7cf197f8a9dc612ba2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 34.9MB
        • SHA256 6cc051bfa367ee99b0aed7badcc0c58bdf3dd86ca66d4e5fb7c6b0dbff553c08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 34.9MB
        • SHA256 96d4911527b5c439b1af1fd8536d85b5bed2c9624ae88b56e9835c30190a4359
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 34.9MB
        • SHA256 c7e552a717c33694a389097816fe472c0d4251054a8f2247880b4fb0b5b3d9a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 34.9MB
        • SHA256 42c9b2175c600ea4f6c3b7dd83cc1456172afc13bf24728b339509351dd93bdd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 34.9MB
        • SHA256 5398f9aa570edaba079ce70e46de3dad97f56a5f74202edf0cb6e94d8a30a122
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 34.9MB
        • SHA256 634f8a2d7679c83f3933e38bdaf3ea21b2f1b52ca58fb330062604dbdcd05486
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 34.9MB
        • SHA256 2b6ac1feca54290a7fa70b8c5505ccc2dae813869296c30fd76f3b86bb09ae64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 34.9MB
        • SHA256 5eba6ec83bf2d35499ce8a76e0eb78dd6b2c18ffaa293e30d3afa630088bf7b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 34.9MB
        • SHA256 379846d5011b0493ccd2eddccbad582078521fd7bab3437c51a4ba211d5be850
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 34.9MB
        • SHA256 89909a9209cd495b9695707207dad7883c696ef0250b06da83f29b13314d2e83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 34.9MB
        • SHA256 9fd7da0e1c13545cf74dd4a60f330850afb834af6d9b73d7e4a788730fd4e038
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 34.9MB
        • SHA256 04842354e407e1d0c936959587905d8c814ac82a34b9bcc84015864943591f72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 34.9MB
        • SHA256 0ea7efbe114271bc9576877bacfa25b1b659a543a4ce0b33ddd1eb4e637d0241
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 34.9MB
        • SHA256 0685db83469a899ab6d8e18a9bb952eb5b1cdfeed18ec1854996caeb564838ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 34.9MB
        • SHA256 27a76e3d05b4c009334a59a9b606ca7f04ab4735c60dd966fb222009a39f3056
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 34.9MB
        • SHA256 78f00752e3080feb936ea705a4a272fe0aa081a5024abe338d4e7d577321f0bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 34.9MB
        • SHA256 decd3dcbed868a8bab7a866946a63a7ce6f8f6ddd98a118e603718ffd8107eb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 34.9MB
        • SHA256 cac2d2e066e23f5656666acdbb4bca2bdff274f6de0a51d915fdbf28bcfe5457
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 34.9MB
        • SHA256 f0eb4760ecc402af42e7d1eadd975ddabc27abca388c0b5a040886eb292e70a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 34.9MB
        • SHA256 6f0ef9ed24abc24550299bc4fde7f0250f7cf9997b3114dfe1e9d3c14e9d335c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 34.9MB
        • SHA256 9ef86704f1ec59c9a4fb643897ea15b7597fba9b1975f8bd5cda5ef251e322e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download