Overview

overview

8

Static

static

3

2026-08-20...d_.exe

windows10-2004-x64

8

2026-08-20...d_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    46s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/08/2026, 05:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-20_90a64c088bb02e0612654a65b8d5f3f3_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
  • Size 41.9MB
  • Sample260820-gd3vbss1hx
  • SHA256 31d3ffa1ce488570af67efff0dc811f87b03ccf7538eb63a068f50de98c01f89
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_90a64c088bb02e0612654a65b8d5f3f3_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_90a64c088bb02e0612654a65b8d5f3f3_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4604
  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_90a64c088bb02e0612654a65b8d5f3f3_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-20_90a64c088bb02e0612654a65b8d5f3f3_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2660

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 42.2MB
        • SHA256 adc5f4f1076cfaaa579167786fbdd5a377e27a6c6019d7b4af22fd9711d05205
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 83.9MB
        • SHA256 de8a4cc2b59ab97f0e38a209d20706a448f8eb4fca2daa39ca0c128c36852f6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 88.0MB
        • SHA256 e38e80b9922c6dfed5722d35dde098bd911eeb78a319622126ef1f1c14583932
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 84.2MB
        • SHA256 cd1883752680cc207bd0cf244adda9f1fb46a32d4a1572b0f903298285eeee1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 44.1MB
        • SHA256 f58236082527b700fa5eff8c07c947ac6968aaf8ee51e03f123707f972f827e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 84.0MB
        • SHA256 203d81fbbcf60f903c9742df7f90e0751298d3c7c0edcc4f58584584e00ab18a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 77.0MB
        • SHA256 c7d3df3b5c10456624213b6285e62b9b8dc051c27a3c500e530e61879b619bef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 76.1MB
        • SHA256 6dac26f308cb127553559d8ff00345d513a28442b13e3f9d8fc54ff1df4c88cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 79.0MB
        • SHA256 daeab16db148e52d6da3e15a8df6ea708c220981472c9d5d58f6cff7bdf9944f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 78.1MB
        • SHA256 43eb7ede26d9b4076269f023de15e337f01d039bf9f30cb24f05cad0e6aef42b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 77.2MB
        • SHA256 bf004173b0d90d6c1efd72827fe316ddc02d05a04ac3de4c006d1edfe0766344
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 74.8MB
        • SHA256 059fa911755dd8eb3abc534f51f3ce9ce99e16f08e397774178cde2ca32a9417
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 72.5MB
        • SHA256 3523536975ba7fc9bb0347618d6d6074e9a41ce66a61ba687557294ef90aeb01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 384KB
        • SHA256 3e4e65210d0ce663e458df3dc7915e7345a65463edc2c4781b0feb1a0cd3389a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 63.2MB
        • SHA256 0f747fd267f9cf967246b6f3d055dc13110f397381ffad2397ba648971ec3c3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 62.3MB
        • SHA256 e41420b5d27f4a853b40414511460d6c958f907d5a8eb402ad887fabc5992dd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 61.3MB
        • SHA256 cdd18927fac816520b263f67d1681cda0557f400b153a4123a96f14942fc7b8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 1.2MB
        • SHA256 ca5130b7ab84764dda57a4a526cd89549d9eae798db67702e30fda706e3e6ed8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 55.6MB
        • SHA256 65ce2a2943c0964f06911aca31c0cf2832f61808c887066031cc4d78d8dad0bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 54.7MB
        • SHA256 d289979ed88059df23834b7b3476b6f69968a3ca501f82b0770d175acc0837bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 54.4MB
        • SHA256 45e98424a65f31edd1e08e588239c4f6ea90414d6e31f07d1e896e9119badca1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 54.1MB
        • SHA256 4a9d8257ffbe539100d559d440ba787a9a6512e53df759de160d95b6252e135d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 52.2MB
        • SHA256 fa19b1f8ca65aa9b180fcd2c3a7f3704dc9a195b28f8cbe21c3e009feecea856
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 51.7MB
        • SHA256 36660910688eeb4bfff763ac60f9e4dae90d692e724cd696c8e2c43fe848be89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 51.4MB
        • SHA256 a015bd78c7f07469706d08600af0dbcf5ae196a87b40e62475ff06d2300e3b6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 51.1MB
        • SHA256 305112b62c134ece93e98f09194a138f65e25cd6a770c72f19222942e16afa40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 50.4MB
        • SHA256 bdffd8a5c438181699f77a61272f6edee6c6cc8f14fade8012b6868c1ca7563b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 50.1MB
        • SHA256 9ff4292338def5e1c0a8b2c88085c511bcbd9979c318722d626cd5e3b8bafb07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 49.2MB
        • SHA256 a0be2250426cc5a91b55d4ecf32e00c5fea255d5062056d7f472dc52a4106950
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 48.6MB
        • SHA256 d7b4bcc4cea54236e3467af4823f6266b824451080b8d4b3ea783d6202fe91df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 45.0MB
        • SHA256 7287c0ca4ed614b5cb17d7a7a114ed3072b4db21e1a4d3286077510a618a1f45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 44.5MB
        • SHA256 361217098de370ed4a83d0011dcd166402e9d6330c04db49e7b409a22da47d50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 44.1MB
        • SHA256 e1d38d3dc2546de979c40993c77481cb8bf51f6f6c1dd9d51c6369eee67738f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 42.0MB
        • SHA256 a80acde6fb835f4b25acdfc2a371712e06dc2b5068718d5e769be7e3a98a32be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 84.0MB
        • SHA256 9394866421292378b5c664d2a6e88a63bb88c152dab3219ba3c4bdd4177256b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 83.9MB
        • SHA256 12f30a2f77e3b6e1e01056c2020ab6ec4b8e0e9d8c99b0e3f8ef3bbfbda0ba4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 80.9MB
        • SHA256 014bd6e0b0662935f978514a63072b6fd5d4423eaf76c540d97558b53d422c53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 80.6MB
        • SHA256 23bec9885bef808c24d88546b9516821563c1ed53546cc1f4ee9793c7eedc241
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download