Analysis

  • max time kernel
    149s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    21/04/2026, 23:28

General

  • Target
    2026-04-21_c42679e5bd5145da1cdccd84185588c4_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 23.0MB
  • Sample260421-3gdkhahs8x
  • SHA256 c873591167f29b3cc5336781989a70d2e3200b087f3cf646ea6f2446c019b76d
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Control Panel 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-21_c42679e5bd5145da1cdccd84185588c4_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-21_c42679e5bd5145da1cdccd84185588c4_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:368
  • C:\Users\Admin\AppData\Local\Temp\2026-04-21_c42679e5bd5145da1cdccd84185588c4_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-04-21_c42679e5bd5145da1cdccd84185588c4_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2432

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe

        • Path C:\Program Files\7-Zip\7z.exe
        • Size 46.6MB
        • SHA256 c5eebf933b4c47ac4569141ae004535e264a8e09cdbd3793e6202b18801f43c5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7zFM.exe

        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 47.0MB
        • SHA256 957cc4a40365d63f53b8231b0f68c2f4e232f14aa81a93887fdc32c78c1ca4fb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7zG.exe

        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 23.7MB
        • SHA256 60f2a6c8641831b41e24670fe9a64855316b9b6bf5e192a6504be1f9cd2bfc2a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Uninstall.exe

        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 46.1MB
        • SHA256 a4e9c2ab51d08dc58eeadd6e6ee9b0929b529c1ca7ee713caea43f02fc1d4d8a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppVShNotify.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 46.4MB
        • SHA256 ef563628409b82a82e9ce48ce3fc3879967e82ee0464a269668fa1c264065abd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InspectorOfficeGadget.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 46.1MB
        • SHA256 2d6856d37389a73951278e3b80296f878c837edc64a09ba2acdba99f9ab06bb7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IntegratedOffice.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 50.2MB
        • SHA256 284974a26f7b1a1500ced3500f94416ab08f9e674b81500bfcd997eb1f0b08c6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OfficeC2RClient.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 69.6MB
        • SHA256 7f3ed2f630054c4fb2fd04d99914d3001ea20ed27bbf4d020b19d11e455582c2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appvcleaner.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 48.2MB
        • SHA256 af6cf9bd9451c0be0e9f538cf4c4430d071ddb86486f82b7d8c5cf9662c6ac35
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VSTOInstaller.exe

        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 46.2MB
        • SHA256 e88438712e70e3df682727e8012eaa40ad54cce87cf9f36495f4e717eba4cf72
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrmstp.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 52.2MB
        • SHA256 26cee092b3cdd04531f20f2f37f65f52f63d61328c795a213c7d93582735106e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_pwa_launcher.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 47.8MB
        • SHA256 933c8af80561268d0719144990969bca6813b05747bafc3aa70601ccb6d22ddd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevated_tracing_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 49.6MB
        • SHA256 b47e47e4f0bd07b3312476295f481c305ce19aa6dd735bd4bb1eb4ba5e5e7f9d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevation_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 48.4MB
        • SHA256 9e394e986341c2bdaf13c432ac1b7deab4c10c9df9fe021e10d336ae85f0c89f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notification_helper.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 47.7MB
        • SHA256 4c9ff0d1400bc3f2444e1582319c14024e99aff4d17f82e92f26f010e97960f2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        os_update_handler.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 47.9MB
        • SHA256 c9716da93b3bbced5f3e8fba69b79be5f575afc819494b6146ef07ef33598e20
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_proxy.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 47.5MB
        • SHA256 aa39741ec2b49c087cc09a3824aeaf917d84bf564c818893400b76182ea48322
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appletviewer.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 46.1MB
        • SHA256 9cdff82c2c1dffe82f6da0b4bdef47dde6b5dfbf7b037e99f5e0d1231fe8b14e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        extcheck.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 46.1MB
        • SHA256 7ced311e9cdbae504572463c2864824468544ced7c9ed5fb637ac223778c40af
        • MD5 SHA1 SHA512 SSDEEP TLSH

        idlj.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 46.1MB
        • SHA256 e2335671405b1c51099b09f0654e6555869fab81d1c8ae6e8e850db04df6edaf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jabswitch.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 46.1MB
        • SHA256 be68d04428e7a1913b554f30f498d3fe8984ea70ef9721f8f9c79ed5fdc6751b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jar.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 46.1MB
        • SHA256 ba87574e358fc1b81170cf6c1c4a0188474de309fd0b9f017b30cf319640f174
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jarsigner.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 46.1MB
        • SHA256 b0796e1749d4f7fa15dbed52e96c8e2ba1c34268517c43557f81405c10361948
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 46.4MB
        • SHA256 81bef31a2ebc03e03db9b8e39440bffaa4984e7d9fe443693d1377b009f8e123
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javac.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 46.1MB
        • SHA256 604bcd0a0f0baef0c4145a467e58b2abcaca188104aa47d554ea929a6419327b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javadoc.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 46.1MB
        • SHA256 f95aadf1c2c4de6ee2aa748e285f1cbb0cda5dda5541ddcd2e7760886be401f7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javafxpackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 46.3MB
        • SHA256 e5967e2064ef5e6ac4632622fb755b0a3f4e7e6999e0873d88a0d85f00967ce8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javah.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 46.1MB
        • SHA256 d3f1c6e38955b547f21d37e33b8d6f5cc72564e77aea09b258095bebf169c586
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 46.1MB
        • SHA256 f86ff92936063c515ee1ab761a990ac4bb3ccb8d3048739f363a3c3298547534
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javapackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 46.3MB
        • SHA256 58fec44d9ff739c87ccfdd314db0a5faad9380707543c8b6971e39075bb20c81
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaw.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 46.4MB
        • SHA256 2abf75324710482beec1133868c2894b299b66827ebc1ddaf859dd12cf1b52d2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaws.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 46.6MB
        • SHA256 f9c820a8d0b1a684179e2ec36280fbf4d6fae460bcc05f941fa453df8aa1ea58
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jconsole.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 46.1MB
        • SHA256 69b06683f12a771d3feb5444059b7cf19ce42e55b81d0bf120d6317aa4d42501
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdb.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 46.1MB
        • SHA256 7ffe9a66c2798892755a1ae41b9213df3d240e297694e904a2dfeb856b3a4732
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdeps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 46.1MB
        • SHA256 ae7dcb3332d671cd0a0481d0e71a8426a1d08a592c15c33115931ab5408221e4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jhat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 46.1MB
        • SHA256 ff76502c5cfd78b7144f6781149a296e5b5efe08883a4414375158ee3e9bb946
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jinfo.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 46.1MB
        • SHA256 de311e7cdcfcf85973ad2cdc5de50d58819aa84fe9f60440c348aca5655d9fc6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jmap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 46.1MB
        • SHA256 8ae648d9a0d2258c9f0e4e374211d9ddc0e66d83e595b4ec5568e1c9aded7e0c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 46.1MB
        • SHA256 d231a1ddb59b6a98a39b741662f2c7c6f1f6c2223154329639c1944b14a0e934
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jrunscript.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 46.1MB
        • SHA256 8519484999e1f05854997cf90e7d15957a6c5acf50a3e0a1013b1d4d65b41c7b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jsadebugd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 46.1MB
        • SHA256 5fb30f03ec0f7ce9e4fcf4122850c88debb5e44f7e4927339439b0e98dbd03ab
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstack.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 46.1MB
        • SHA256 6761c4aa7e3584c585f839049387adcd9968ba890d93c767d0326e22b7e2e7a3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 46.1MB
        • SHA256 fd2101fca2c4a653d27a2370d8ef3216f976fac0c16a5f1f381ff278c963ac2f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstatd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 46.1MB
        • SHA256 347f801d8eceba105dd85ef8cf3b34829aa55dd0e938f8d10755ca3c8ecc6436
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 46.1MB
        • SHA256 ea31aa334ade36fda648f872b94df0718258f63da7cabec4722fdc5b5ed4cd72
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kinit.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 46.1MB
        • SHA256 3aef6643f288fbaae04b7fc30fc4420b01c2d35d15a7d01169224e47c90d22de
        • MD5 SHA1 SHA512 SSDEEP TLSH

        klist.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 46.1MB
        • SHA256 00a32a35030ae6d141ca4aba78023acadd800ff46ae6f12faa829f9b47be5e91
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ktab.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 46.1MB
        • SHA256 f485d553e05d6f04e4161c6e62b76c084366830874300288334bc3c5e53f1053
        • MD5 SHA1 SHA512 SSDEEP TLSH

        native2ascii.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 46.1MB
        • SHA256 f06185be5a829201f69165ffb2cd42f397c7e625b9800011d652f53b932b486d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        orbd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 46.1MB
        • SHA256 0323a288897b559fb9b55d73cf9b5f21cbc6a639fe3ad497a166dc77580934cf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pack200.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 46.1MB
        • SHA256 08826ffffc60543235b96cfa25859df3ed5c62c3a9934296e408dd7faf6cb5e0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmic.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 23.1MB
        • SHA256 efa63630485e332f5270d27c6d5d2c2fedbd7d8fdf27f2031af1f08688ec768f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dotnet.exe

        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 46.2MB
        • SHA256 6a58f6b822c458c90bd5916cf657999b8dea2c7ddb0ed44662aa54950267bf69
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 46.2MB
        • SHA256 80dd1a9645c59c8d2e9a8b8c264c1562ef01184200da95e6dc4bc1359ce5f21c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 46.2MB
        • SHA256 d3b8b4b64273e07e7731e9bd297f32cd401db3e8d570e98aa24167287ee21377
        • MD5 SHA1 SHA512 SSDEEP TLSH

        spo0lve.exe

        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 23.0MB
        • SHA256 c873591167f29b3cc5336781989a70d2e3200b087f3cf646ea6f2446c019b76d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/368-10-0x0000000000670000-0x0000000000695000-memory.dmp

        memory/2432-17-0x0000000000950000-0x0000000000975000-memory.dmp