Overview

overview

8

Static

static

3

2026-04-15...r_.exe

windows10-2004-x64

8

2026-04-15...r_.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    131s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    15/04/2026, 23:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-15_35e41d3f78e11a3edcf92cc5fd0b742b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 36.1MB
  • Sample260415-3mcv6aev3y
  • SHA256 6259001256ce89b6036df7f6dbb9e95a203bd95abf25d226e179400f97aa0710
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-15_35e41d3f78e11a3edcf92cc5fd0b742b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-15_35e41d3f78e11a3edcf92cc5fd0b742b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1540
  • C:\Users\Admin\AppData\Local\Temp\2026-04-15_35e41d3f78e11a3edcf92cc5fd0b742b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-04-15_35e41d3f78e11a3edcf92cc5fd0b742b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1872

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 72.6MB
        • SHA256 f4b4572d23446ec1a8f9fa9bfb39c055e53d3f56577c41dde5f462c98d5c4e94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 73.1MB
        • SHA256 72dc87c8695a1d8f1b277395a59011ef4a6b7f76cff5c9c5056b760bae705da2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 72.8MB
        • SHA256 50f06e49c88aa3de98afd78d4772ab865b769cd21a27ac4101f1f1f990461d3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 72.1MB
        • SHA256 c80241327b38502247ba4c512dcebc92013b88cc95e2f97c6c78b8547e1d3633
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 72.4MB
        • SHA256 dc225409dab302747cd4cb24b64addde54a43dc1b20c8761e3844d4263190c88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 72.2MB
        • SHA256 d44040443faea9400722e0061523a65ce1dcf9c491ad37fb88d6434dd9fe4c4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 76.2MB
        • SHA256 d9ec7669485e8858865c6e07e8ca9a3958e0ce85d702346b6de8d70f11473a2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 72.5MB
        • SHA256 5cfb9607c34e66455c0b83f7e91904d68ffdf97a8f69e9c55b2912b129ed2de3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 74.2MB
        • SHA256 3c79c9735165c09ceeeabc13a653cacbd5433cc1f3eae9cd0006add829740d85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 72.2MB
        • SHA256 0811728b2da256e1991392e2ebff96fc54d32d64f4a7125f9fa6f0c333865067
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ConvertBackup.asp
        • Path C:\Program Files\ConvertBackup.asp
        • Size 72.4MB
        • SHA256 021ca0e1a56cc7a91167a85ee20b41cc4cfb3b352df833b4850fbdfa49a58632
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 78.2MB
        • SHA256 f8354f838d550f80dc4eb81494732f476261a1dbe0e8a5c3b90590e9846dfc9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 73.8MB
        • SHA256 48a5664a448caf70d8b5111ad6f898d7fccf474914c2192b9ad252d8c652961a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 74.4MB
        • SHA256 9a0276ec4fa9647a397ab6a6dac4cc0b25cf0a6340076d96b7d694cd18fc8408
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 73.7MB
        • SHA256 72fb07fe53f1bff0b5735e11f14bf589125d6ceddb1ec960d8a6328893904351
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 74.0MB
        • SHA256 259c353d17d7ed7e66f0561e8d02713ed353266c748f8ec3d3eb44f7d4aa47bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 75.2MB
        • SHA256 604103bd39553c1c5afd323339bdc995748e90eed3c8ba3c3c6113b2ffde3c1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 72.1MB
        • SHA256 6295499f5e16667d40ec7c2e73103d9b5e39d4f3d3afe439f20cf3abbcacd3ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 72.1MB
        • SHA256 44e1857d1c3a403a4203dd05343c8fae840f9a4fd75860632c2749e27aa9c664
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 72.2MB
        • SHA256 374e8185a7f58bab4966117d56725d41b7d70a70f1c3c15122cfb659c00031e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 72.1MB
        • SHA256 52312cf3dfe9ebed9cae709cea9edcfbaf57e23682a7bc2e35e5311561b21a9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 72.1MB
        • SHA256 f452ebfe8007fd5c43e7997bba53b756c567bef7ff5fafa699b09b30695fe95b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 72.4MB
        • SHA256 8950ffb19e1e94d5ad446826de83ab56e4c4826f530e23790c94c410ccfe60a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 72.1MB
        • SHA256 66f79f4ffb93eeeef55c0bd03e7125b3c7894f0a114f902ef751d61780b0a4af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 72.1MB
        • SHA256 58e9188870047529a64cab8361b6705cf8d6acdcbaa3ee81e78263bf271a1e5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 72.3MB
        • SHA256 7058541cc5ea06db7e42a9f698a9b503702f64b23bc108ee266d5b0c3585d7b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 72.1MB
        • SHA256 06c0ee39ac9a4cdb7ff65599e6d5b105f6d24f2410c60aac845608065f73adf0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 72.1MB
        • SHA256 02d18e2831b6757ec1152994857d847ce3b4ba3313d560e47a6ccdb1b6876fa1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 72.3MB
        • SHA256 10ae5948ef46dbca10e0a53b41f6f9289aa2835cfd75cd351fd2988a75fa8b67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 72.4MB
        • SHA256 281b1307696e105ffe5c71f579c082c541e654a815a4a7cfe4e08f32221c2945
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 72.6MB
        • SHA256 e7eb19f4dd2960ef5925d49509a4d34eccde881ac73749738cf91d301cc6a002
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 72.1MB
        • SHA256 3e0858763c41e9dd187262e8fdc9f1299ce1231f7b8b3af3257af01b3be84620
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 72.1MB
        • SHA256 cb4ba37e0c476829c6e984ff7f1f9e24a378e7303bf2ad9d9c03381af3c9bdc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 72.1MB
        • SHA256 0279bc7f5f11e74623b6efa8734b9f8d52a1fa92ece4e4543193c5041f670561
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 72.1MB
        • SHA256 727a44f83a057a526aa9153fc55f730e7916b0bd566d827ed1810ba9b9031a55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 71.4MB
        • SHA256 56d8246b741489ae3b034cd3b7f04f80f145c0876c569e5f33d122dc2898714a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 69.4MB
        • SHA256 d851048efd150f1039614877a80991468376c656e2744d7f7742ba4c9a7be5a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 65.4MB
        • SHA256 5f188744f75a76ed74a833dba587bfc3104d805e8d398e5b82a2d07c4b2549a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 64.1MB
        • SHA256 c053536027241a3a2cea0d19074b383f3805df76ec565977a8b2918effbac9b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 47.5MB
        • SHA256 8fa77c8ab55e9fe4e14d87a9cab323d207870e960bf312d833d89f4d4bc5b7ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 53.3MB
        • SHA256 6f04ef401a242e728c3baec002c42c0ed57d66290bb0f633df1c03155c194d3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 50.4MB
        • SHA256 292fb2e21983233b4ee3d783263fea5b54aecfeb016e21921064534072918254
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 50.7MB
        • SHA256 a632e046a76f6ee694218e386f866827ec485b1fdd06a7f9dfbc1992f26d2f88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 72.3MB
        • SHA256 b98e0c1c428e79f773b1da36b6a4591c275f11b602b6abdcffb92d6af3097ea6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 72.2MB
        • SHA256 f21304aec24c10aec09ff84db638eb8002c4ef4bba20910fafb38cdc943d4b9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 72.2MB
        • SHA256 df092344aefa4116e887ebb083d31b5d96f5ce33c54b8cb74a1623eebbab6b34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 72.2MB
        • SHA256 9c756e3dfab985377bfbd1a1319c88e2cb7f632d2b7b547634e6840dd25dd758
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 36.1MB
        • SHA256 6259001256ce89b6036df7f6dbb9e95a203bd95abf25d226e179400f97aa0710
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1540-10-0x0000000002420000-0x00000000024F3000-memory.dmp
        Download

        memory/1872-11-0x0000000002280000-0x0000000002353000-memory.dmp
        Download