Overview

overview

8

Static

static

3

2026-08-05...d_.exe

windows10-2004-x64

8

2026-08-05...d_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    05/08/2026, 18:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-05_7d39775ea5dfc02d1362d0f6f33bdebb_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
  • Size 13.5MB
  • Sample260805-wswrwsshla
  • SHA256 2983b1b1a8f100466591336fa50d0a02909fb0fe429f14951d8cbc4e865a990c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-05_7d39775ea5dfc02d1362d0f6f33bdebb_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-05_7d39775ea5dfc02d1362d0f6f33bdebb_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1448
  • C:\Users\Admin\AppData\Local\Temp\2026-08-05_7d39775ea5dfc02d1362d0f6f33bdebb_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-05_7d39775ea5dfc02d1362d0f6f33bdebb_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1332

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 14.2MB
        • SHA256 1c3c99ebbe4e6143731bdf623410675f86144b853254e069b8c3c0747adfa5b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 27.1MB
        • SHA256 bf2865a019c8687f58b7e4ed509d37a98b277fb81df6a6fa7ae40013845b0620
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 33.1MB
        • SHA256 b98149ae8a765fe2e54a5bc28f4d705f60596558de101708d28c5fd648cec912
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 29.3MB
        • SHA256 f478a4e0e882c05f2db12065cf5d6cedf3fa608d1ac83cad0cef68acbdb84753
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 28.7MB
        • SHA256 46f1025bd2d34adc1068cdfe0b318d405480e92bdeb88df8a8a532ba03a0c840
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 30.1MB
        • SHA256 d41a82bb28dc014d60a6dae87c661f6647153767ae7be8a1a205fda656091cc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 28.5MB
        • SHA256 952821432de73ae2bd59e8ade06bc4ea5715443474837d06fb0613457ba0e6d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 27.1MB
        • SHA256 a3e789fc3e86427da12428b25c5846da2b6a05cd94d1e4bf16d7165a507b5a06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 27.1MB
        • SHA256 6cdeb7bd4c79c2e835f158df6776958405c362647b3e4ce2be192f15d35672d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 27.1MB
        • SHA256 c1a60e018a81cb317b4e35e3288a384cd70b124a5499fd3ebab2d4db4d8a2289
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 27.1MB
        • SHA256 220b02182bd5d1bc65478c6dc74d095c208f2a64b5b1647b67e1f051f3ec7e90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 27.1MB
        • SHA256 8cabcc0649fa356b0f9d3dd92e51025fc8a4bca55365b5c35a79b0f0d075def2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 27.1MB
        • SHA256 fd187673af3b87351ec1afe20174894b19f73fc3dab90598a8d252c18f75eeee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 27.1MB
        • SHA256 9cc1e882b4b79868b380d01f9396e5033f66ab8bcab0b2feee0b2c464521b236
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 27.2MB
        • SHA256 ba5ec80fe8b665cd1c5207ab16d74e8f88b2000b423418532a50b86c99a1ac30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 27.1MB
        • SHA256 6199c2301f251164188b206108771aad220fcb67c1ff27edbacbd4f66465a548
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 27.2MB
        • SHA256 0a301ecc3af09e4e05940342c8d85b50612f98ae05a53729408ac476a09dd4d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 27.3MB
        • SHA256 634e0a865c5ce69f39626684b1773cfd0ea1166691610e8219b46b6aa6bfe825
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 27.5MB
        • SHA256 6a83b7e7e61b02b83109bcd5c9f69ee88a3c8c54ef470ec99b95cf1eed85d950
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 27.1MB
        • SHA256 645b90e49f544a1c37411b8b9dbe863bbcb99aa100e9e9a44f8f6378f52fa962
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 27.1MB
        • SHA256 ca5edb815d779ec72fd1a0e71d94783b41eb65e6fe618c3bf22307518a5fbe72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 27.1MB
        • SHA256 ad13668ea471d0cb4b1a03589a8f701d17110f3905abfc466e8c73af8270970b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 27.1MB
        • SHA256 b9680c652b871603f4d766bf22c366d096a9e62eb1b4f5a900c78be34907ec70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 27.1MB
        • SHA256 e2857dfb7cf8a425665f08f4b95f36ec1ca23abcbd9b51422453d901dcafc1a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 27.1MB
        • SHA256 6519968996d47fbcdbe99d240402289927896fbc3b0adfba2e0d197cc5c43757
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 27.1MB
        • SHA256 eadebba3ef6080df64b29ea48f96824ba53609525bb4d9ac70b4acd6ab01a91b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 27.1MB
        • SHA256 6f007511d047dac2b2ff139c048df646f39256444e5635dc071fd4ac5ac038d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 27.1MB
        • SHA256 0231629490d47009188fa4880420524dd6a63d6e9262f1a25434274605229cc8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 27.1MB
        • SHA256 f4d74c283c85c447664894cf89d9d8b735237a8c7035e038022a2ee5295cca5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 27.1MB
        • SHA256 5b128a8d107376d903175ad8a97762e63302567c0c8077caea444c6b2de26794
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 27.1MB
        • SHA256 d644415af8084e6f9ec34be27d133d24a8458b53c1884623ad70eba28703c8b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 27.1MB
        • SHA256 be827b7dba2aa8e3cf7b125356bc86d7863f6cfa2433bf80560b1b102a29833b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 27.1MB
        • SHA256 f6b58fdbafb3c410e5e0ca2b364ae3641ab63d00be1fc2a139bafc78945a64e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 27.1MB
        • SHA256 075eb18e2d59016bd28c5ca64505b24d154c08ae6db7ea77ae067942744e83d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 27.1MB
        • SHA256 e10ebd39fa0cda3bb37642d426f025ad700265e55fc751459fe55e5ef4a61a48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 27.1MB
        • SHA256 11d7411fc2c1400c9d0fe2650d5a33dd01de1f0b06719b2590a0cad290f81c22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 27.1MB
        • SHA256 015b1223b2cac42b1228c27fc0d67beee3299e40961d871a4fce04928fba8564
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 27.1MB
        • SHA256 a53b1887093487d73f11e3fa0e195f89caf0374ea1402b56f08e23e5f50fc507
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 27.1MB
        • SHA256 2499e8ba016363fa814cb2213c1c4e3ce482f45da8ffcc2fcdb3e3b9d8abc4e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 27.1MB
        • SHA256 9c4c08a888bdd34232181d85de50ffe0f462f429d4454dfcf7043bd0d7cea370
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 27.1MB
        • SHA256 c037c708530ab0e00d01efdd1f1fa6c7e81026c5e464bdab9be685f1e3c4e627
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 27.1MB
        • SHA256 4783b801c0ae94d937bd2c33fca63d958b8e19ddabdc2c693badbce8be0b8eee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 27.1MB
        • SHA256 01436568f3aa461f1f48eae4ecb74736a09e969bc3c8ba3e891e3740398983c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 27.1MB
        • SHA256 5f84ccb730b69cb536b117a4af453bd4c9f71e9efd52ca26f99a1428d00ced8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 27.1MB
        • SHA256 8121f6d224b45100e9458ecf66c2d49db8f7d60bb035ad0cfadc6a2d970056b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 27.1MB
        • SHA256 d87c0b71456fe39a35cbe4ea5b59fa14381f67db9e3d41525e30c57ce9e25052
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 27.1MB
        • SHA256 3e670e1b894512336c3b2045dcd374f2369f8671c5392c8fdfdc994479154149
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 27.3MB
        • SHA256 4fad143e4043e2bd76fd3d44b40ca6f9f0bab98c99ebe534a365866a9ba687be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 27.1MB
        • SHA256 d485a7fe19454b7c248f67c6653d63ca9c0ed51f122ca8baff4efe5c666fa4f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 27.1MB
        • SHA256 807c97cf90574816b9b826f7135d3957538c31c2f35b5b7a0429c40f1a5ee30b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 27.1MB
        • SHA256 05cfa7294a7573afc3a7806bc6b4addb3e3e4ca1585dc99bca088c8d550fbfd0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 27.1MB
        • SHA256 bfeaeb0050f14d8a0ec0e2a4d7761d06a8080e5bb1c8cded5468a7aca0ffcb62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 27.1MB
        • SHA256 63d3082a6e24656a30d4efabfea043ad61cf2811498469c7279b5f0e9a5c8ce3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 27.1MB
        • SHA256 2ddc6a51a540d5a72fc9182fa4ad839596dd36bf80a01e8ac3e64a7f19f5c632
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 13.5MB
        • SHA256 2983b1b1a8f100466591336fa50d0a02909fb0fe429f14951d8cbc4e865a990c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download