Overview

overview

8

Static

static

3

2026-08-10...d_.exe

windows10-2004-x64

8

2026-08-10...d_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/08/2026, 22:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-10_a6ba026996671dcc6c742c9ab8909492_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
  • Size 19.0MB
  • Sample260810-1wwcrazcka
  • SHA256 cddd8eef1479ca35a8c477994d686de12b06b247ca9d85edd8bab8ea3ba6b375
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_a6ba026996671dcc6c742c9ab8909492_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_a6ba026996671dcc6c742c9ab8909492_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4920
  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_a6ba026996671dcc6c742c9ab8909492_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-10_a6ba026996671dcc6c742c9ab8909492_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5044

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 19.3MB
        • SHA256 8f758594100c5b549978524f6ee022580a4b68b4e7d243f0468be73361f1e31f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 38.0MB
        • SHA256 ea953e43c08fbbf91f060dd872833121ec18616417c80475872914e62134c5b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 42.1MB
        • SHA256 54e22f916370e82d25d9a9ede854d93c2f57917c9680bd3b81b9137fc3c79a51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 38.3MB
        • SHA256 5c2f68360194627951afb5df362592f41948566003992d7fbbcc192978b6b8d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 61.5MB
        • SHA256 6662f5a868e7dae0d93a6ffb1c71c29ff7155890d041eacdb696ba621fd8acd5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 21.1MB
        • SHA256 fe610328b26db649c3f9b0e851aaa67d9576b012136039fcc2da6ac503919cf1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 38.1MB
        • SHA256 efd04aa91c3db12b1a2a2c8d1be514b9dbcb9d8b49323c52125507162e840284
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 44.1MB
        • SHA256 3960b3fa1af8f1d560e4b624ba360b5b5eddd775abeb58641e7807b587873d71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 40.3MB
        • SHA256 10df67893a8411004f9bbba2687a5f486e7d90d115ac0cc8d362a7376785e9c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 39.6MB
        • SHA256 b545a8d86d8dcd40c2196d61405fafbe1e2fff7f2371b5cc1154e40ef0979793
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 39.8MB
        • SHA256 aaead6c3438a63f597614e0310897a6037fe9f50598bfabe8c7aad04f9c34c04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 41.1MB
        • SHA256 96a71d9115a29a475fabbe0abf84971e613334987deb0f9932cdeb8722358d8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 39.4MB
        • SHA256 f5c60e1242244bd8c6943b1f1b271a03953b038b6406cb8175a8d6db292ba292
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 38.0MB
        • SHA256 1f3159a2508e349a12df77fada67cfef63bb4c67a303ce212681fc58b98d7b82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 38.0MB
        • SHA256 16e360d1828f745c66c6a2b9a6be07a0a48b50a0abbe4dd1e306a888aa8ddfd8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 38.0MB
        • SHA256 7a144993ae221de7174d40c5240d8b6912e43a76b1854ca3897fba34340ffd18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 38.0MB
        • SHA256 6d92b9fcccdf53ed5b0ab4163ba480f45cfce156eb65f21a96f02ff0692f412c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 1.2MB
        • SHA256 0d0258c89e76dc4257d5b19fb97ad8a3c681955e184d38b6cd889691eef84576
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 38.3MB
        • SHA256 9dc63728e67d788047647ed01b3af0785544d11543ba69c93bfc52870d7c38a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 38.2MB
        • SHA256 e0a27d577643574a904f97c497a65372752c3cfa4e01fe40a9ac580a1a20480f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 38.0MB
        • SHA256 cb0789a012674df09c29fb3bb420e81167dabff97b96cca5a3eca69ee8f4a964
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 38.0MB
        • SHA256 e5514f52c9843856959d1a0e7c11a6fe031fcfd7b2a480af2c98c442f9f2a0f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 38.2MB
        • SHA256 0b5723f7160a9fdb7738129102af684279a71f4d82384a6d1da594f57ab48a14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 38.3MB
        • SHA256 81aa2f783ed04eda8a0ebfb759dd21d1e10815a0fb7686a656f60555af4ac7b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 38.4MB
        • SHA256 d15c9096c9317caa80ca3e40573992271bb13f7d0b8d0a117d6d8b9cc5d17c82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 38.0MB
        • SHA256 6083a49cde442672f83e6b7bb84f679450d7ad5f931689f192af29be369c7184
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 38.0MB
        • SHA256 18c06654abefde2dc3e18c6c331cf580a1428144cdb5f18042a26da6086487e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 38.0MB
        • SHA256 5d2df9ebcb60dac5095d7493609eb03fac437f69bf93733cfe146b743e48b374
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 38.0MB
        • SHA256 8c0b9434ebc050b4515fe86f9126b31c3b032cf57e66b66dca5e082ad74f250e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 38.0MB
        • SHA256 6c6e8f923ac64fe7a2ac57548fdcb7af687a7dfa373d0ea440a80a6cdbca1630
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 38.0MB
        • SHA256 6c8d4b01af82e35d02b1d76412573b2ff06348133e9cb5ad7bb215c29a15fc23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 38.0MB
        • SHA256 84c29187018e95d40b6f386cf0af343013000efdf6ae02c746f063c89505897b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 38.0MB
        • SHA256 ca0b3e2751a985b01be97faf5f6f74c42c9868b292e77edf6163aa705b7fbd8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 38.0MB
        • SHA256 93249d5c13ec0e0f19840e11504183c40ed966be8b5c7e6cffcb52419cbb6cf4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 38.0MB
        • SHA256 7f851a25ab30e57fd4dd5b5ff4d6015554632a3224826faa35a90b40bb880ac5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 38.0MB
        • SHA256 0fe12bb4f756ee258ebf9566949a6d4c09a07564abece6668395b849571b681d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 19.0MB
        • SHA256 ed656bd89faed4c6322d273bcb2fe68859d9f2749a238d6564d57d3e7ffaff9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 38.0MB
        • SHA256 3a25e89f4bceefbf81d192fa2a4f6de5880c3dd62d7d9d2842b2a917220d2614
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 38.0MB
        • SHA256 d38b108375e8758189b7e872e7ed46de92fd725e4839db36579713c935201e46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 38.0MB
        • SHA256 fa221b2e1e0bc20426030e2c56cb3bcad800c842f64a11f458add34300a9663e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 38.0MB
        • SHA256 01ac9921e89ae4a984dc20f7b9b3e7611fa62ffca1ac9dc745637a18906c298e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 38.0MB
        • SHA256 96f1938a0250220e1bc427d66ffd58eff9f6ae8dc3a4d92382f4a9f0f8be7e6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 38.0MB
        • SHA256 b6a76490e2d1cb86081efff291e4f9c456f231b97f04bbf2856e4ed8af8fc740
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 38.0MB
        • SHA256 091adcde432888d2015ae1a19a4e57d11e8e617a130af2688d6ac664f086c270
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 38.0MB
        • SHA256 be931be572cebe9fd26db3721a5bde55bffd9ccae16966235c2ad353c98c4a89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 38.1MB
        • SHA256 844e774fbb987d30520e0478ead165286d304124b7338c7e43b5f1a9d27facdf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 38.1MB
        • SHA256 74227ac76adcf0371c3627cfceb874632d9cc8862f786a7e9009437b57176d00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download