Overview

overview

8

Static

static

3

2026-08-05...d_.exe

windows10-2004-x64

8

2026-08-05...d_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/08/2026, 15:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-05_a6b483933f18d74884826fcbf32fde41_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
  • Size 9.6MB
  • Sample260805-szv76acb49
  • SHA256 4344f9edd036b500fb1c774c1bd7af4337d4e8156abb22b3d9ca6458a15a4c0a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-05_a6b483933f18d74884826fcbf32fde41_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-05_a6b483933f18d74884826fcbf32fde41_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4080
  • C:\Users\Admin\AppData\Local\Temp\2026-08-05_a6b483933f18d74884826fcbf32fde41_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-05_a6b483933f18d74884826fcbf32fde41_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:6272

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 10.1MB
        • SHA256 4375d28cf2472584c7e58d83dc3f26489a1e8575e0a88f034592ae05fd4f4c36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 10.5MB
        • SHA256 4f4f9c6ce3216204e6f8e6674a68a50f3f021c75864756cbc750b5b6c095dc3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 10.3MB
        • SHA256 f168b4e518f0221a3a784490214893e8ce4639373522a8a14b7e22a502075c98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 9.6MB
        • SHA256 2bec1044afe32379ace8c122305c79e42c31d89f6f498df63183ddc86be54487
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 19.5MB
        • SHA256 8578c48cb75075839e0682dcddab9b9c983edf00381fefc03e8802724b3b6b46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 19.3MB
        • SHA256 5578dbcf4f6774d01218e9033d49f366e774021385b0a96c5652b132f838ae1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 23.3MB
        • SHA256 c6b6b89bc8f00b654a61cab01cc752fc0174d9e10b811397b1f00970f8ea29a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 19.6MB
        • SHA256 7ec676ed73477d04c5021fcd1b0c7c405bbe74228a19c84bd94d7101ba002999
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 42.7MB
        • SHA256 5aed2bdebb6e4095315e888a69ec93a327c1e7bf608bd0b81727c3d8671f5005
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 21.3MB
        • SHA256 bddf3d3fdc5d1133c82e3ac83a07f08649f0c05595aa06feaa0a00f90f53998d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 19.3MB
        • SHA256 47e2d877d95f30910782aa7fa89dba370c63335c8fa2085ca36b30b533307390
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 25.3MB
        • SHA256 c72e11252a013fb7f1b28b0344387c12ba4ff98279c43051923c0eec20667397
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 20.9MB
        • SHA256 8f29bba69eb95eaa1cbd772e5a953ea20b14d1166c496e6424d5b08a8bafc8ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 22.7MB
        • SHA256 caa1e3a1c0be01393a524cd6d9e24b47ef8a538363e06361f51bdf6499922778
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 21.5MB
        • SHA256 ba4e427ccc6ec132bdc854f9f2e1393a41c29f3e1699c15b424dc9624a3f8b16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 20.8MB
        • SHA256 58121e7d2b223c2786c517d493a8f5f8885492ccddee95db50d5c1123175f179
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 21.1MB
        • SHA256 cf9a565dcd0869414c058bc2183d9a5f4bf3d2e0c7b4714a964300c89b28d04f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 22.3MB
        • SHA256 09f3b8374897cc048047783641e350eb363acc8bde8f040cc1765ba48ce83a03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 20.6MB
        • SHA256 abe3650b2b69849865612f3a9b8af687e66460cd6b495f74caca3f754fb949af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 19.2MB
        • SHA256 45c4d2a284104a032d27f775fc850b65b5570a30faaaf20b1c053104560cb465
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 19.2MB
        • SHA256 1e9220f324f91a039cdefb925c993faf1593ebb33a20ae8220e580335450d85f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 19.2MB
        • SHA256 923d9b239790fb131d1cb3484cba24e43263a42b17b15e95726c0bb93e53660f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 19.3MB
        • SHA256 1790632c614228b633868729d9d87d630a68eed1f7f13cc0b38e4f57b56bb53b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 19.2MB
        • SHA256 fb3942c0b0b6350b456e966cdc0311adc1dddf2d0c805b6ff375fdc26a9116a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 19.2MB
        • SHA256 429c918d10ccecd927b4dd4b1870e182c97b0a9d333f36b864f00d538905a2b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 19.2MB
        • SHA256 6a71956822430226bd935b3410bec6c25081f338f13a4d7364fd208902967ab4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 19.5MB
        • SHA256 7fbc88a6a8b7934f41c310f244e3ea61e612f73256fc8a2ff146c28b291dd1cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 19.2MB
        • SHA256 1bfc9e58bb3f8e1a7026ebcf12e9147fd3eb43cb0417a00a51f526fdf4ddaa33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 19.2MB
        • SHA256 2984ff39a66e97a2bb0e4276aac9336b4ed215508d2ed137000b97d049e5d524
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 19.4MB
        • SHA256 d5dbaefe5a7cc04ff3e14e164b5e7aa3dac9c6463b63c30965a4f4583ee503db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 19.2MB
        • SHA256 9ebdccb035fa6ac37d8d74664b531558537b7a5d259d41f591e918f8e8b73371
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 19.2MB
        • SHA256 ca6f661431a1807458d2f4e9fc8dd9c91b2f1bdac15f8ab18d0b06a3ed95f823
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 19.4MB
        • SHA256 69ba4d757d751f7a4932f257fc819d3a3748b2bb99d9f0e971757281ba8db033
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 19.5MB
        • SHA256 c7139c998e3414b890e20850a0d8381d95d2456217e837c8fedc308f4ebd5f51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 19.7MB
        • SHA256 ce115c8e9c2e0cf338e9fc83981c5680c8ea4359ba4ff23f749836c8eee82734
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 19.2MB
        • SHA256 12bd1b5546bc770cb47acb7ddd89d02fcaf45eec51f19e9586780e60706c2403
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 19.2MB
        • SHA256 ce5119749440fc03e1488a1e96ea21e6fe454c6fa609a933c4a52a2ff2a30b9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 19.2MB
        • SHA256 ec459f650aba0265dc6519008e596b6cf395050032c6d79c13e400883453b575
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 19.2MB
        • SHA256 ea491a825e3cfc5e386e77d64ddb231af36af858585a8264487bb7fc8f08e7c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 19.2MB
        • SHA256 7123441ef898d343b26f27f269b94fadcc226484c595bcff9c7edc64843220f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 19.2MB
        • SHA256 d1506f4fc1692b9a8e81d4322461628a09e65970b5f52aa239d411bb804cc1d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 19.2MB
        • SHA256 b64284b519443ce2b7017c218f5b41f5c74fcfaf4937338b823ed8b7fb423b26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 19.2MB
        • SHA256 ab49a6d96641e7ecb43a175168f70559b8c22c4102339e1e9249ed1102c52e36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 19.2MB
        • SHA256 0118ed23c929fa9e2730afff5e9b099580671ce4d7dded806f70815cbc0fae02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 19.2MB
        • SHA256 bfaca576a67c0be516fb6b82210920a0f9674e3c2fe06f7c3237d6a28de25233
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 19.2MB
        • SHA256 d5c69c7fd1cfe1fdb70be012448bc18f923d737e6ae435b70644d71f14271468
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 19.2MB
        • SHA256 94a17a503f6362516a32ff299d859cef7fe9c29cf8923360e077b492ade8d53b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 19.2MB
        • SHA256 da59d44ab3b63a88d6ae66dd8610f02bd2c101ab2561aac05737a27f54bc8272
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 19.2MB
        • SHA256 70253a24bbf94538d58483dd3eda44dfd824aadb615cc3e010e26883cde143b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 19.2MB
        • SHA256 a493615893ab576bff8c50cb819dbbd85f1b462101fcb2ad2bd4eda68457dd6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 19.2MB
        • SHA256 70ffd3cc9331187ad04953910cf91af7095562bcb4729614773fa6fa4fa47da3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 19.2MB
        • SHA256 24d0d5a9d668ebff8b0f8b700aa55cf505a48b28d949d33dc14db2d2481aa937
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 19.2MB
        • SHA256 42ec2266f3321b59262069d9151f905774fa7c002e71b917357266ca381cef41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 19.2MB
        • SHA256 af7730146e274a98ac0b93a77ed90b55bf92a6a76e76b8d0845e7ee2c9c70106
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 19.2MB
        • SHA256 14c7cb371dfacc555d789e7dda50bf9917c4be316a6bf62b138a6876ec507811
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 19.2MB
        • SHA256 7209b159f2eb3033cc324d1df51f21d41a0820d5b80a296fb2664bd1cd3b29b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 19.2MB
        • SHA256 a6af382006e4823db77d77fe103aa152bd0961683036bd62b6f9ff832bd3f8e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 19.2MB
        • SHA256 d31e2fcb5d4ee139917678d473da535567570e02d70128dc2e42ff993e57c5d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 19.2MB
        • SHA256 d5b5611e280412e374d0a558050d9d2f2d873942d184d151245bb5fa06c701e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 19.3MB
        • SHA256 708bb39e5a77233a11f04a33f840230ab9fb99f28ef42bf541b00321ef88bb11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 19.3MB
        • SHA256 2ca9f237783b67c64814c156821cb03d1794afee0b68a0118d2605a8693ca263
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 19.3MB
        • SHA256 768c0cc2da27b1b656e90b40c3528289a2d1538b6ce183fd8f73b0cbd126259c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download