Overview

overview

8

Static

static

3

2026-05-05...ij.exe

windows10-2004-x64

8

2026-05-05...ij.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    05/05/2026, 14:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-05_12ae15201039dc0877bc2f35a08c046a_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe
  • Size 36.9MB
  • Sample260505-ryrmxaas2t
  • SHA256 bfb2d9c1760ee67a43bec200fd040f12ee00726143463136a010885b5ca936c1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-05_12ae15201039dc0877bc2f35a08c046a_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-05_12ae15201039dc0877bc2f35a08c046a_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4900
  • C:\Users\Admin\AppData\Local\Temp\2026-05-05_12ae15201039dc0877bc2f35a08c046a_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe
    C:\Users\Admin\AppData\Local\Temp/2026-05-05_12ae15201039dc0877bc2f35a08c046a_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3280

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 74.4MB
        • SHA256 0f07f27abbae22bf27f86dbbcfb78ad9b7b48223d67414e75105c9f24ba8d651
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 74.8MB
        • SHA256 0e93014d70b351f56af116ccc10e670afa131f010e5e0578668cac1c43683574
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 74.5MB
        • SHA256 073070ec5d7d10ba951e35ccc04d9f128b3123a0c17628603c6937ea599c380b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 73.8MB
        • SHA256 f0441a9e2c0ff0a692964d2270a46cae2627f88a7eda5696053032ad2bde4923
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 74.1MB
        • SHA256 018af79e8226a3383dced50febbc1ae6a63caad9e41d01d209b4d41a93c252b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 73.9MB
        • SHA256 f16514e0b5a81f87af28818d8813d591a73d9287829fc57f0d8b6bf8436b6e71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 77.9MB
        • SHA256 70f72e195138df004e5ee22b5b216d45cdd2cc7ffa0381ed2a495d3ce07a71c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 74.2MB
        • SHA256 8c1d59aa2141f841f3005f71c845cb604505f6db3e27ee73e63cc7c127e87796
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 76.0MB
        • SHA256 c9b334c7112ecea537c9c7955d28e413cad410b3ea9bd14841f9ba7c26da6df3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 73.9MB
        • SHA256 e3578f754471d5c5d59de90b7b1b5549cad55cd542d0f6dd2dd6472f502ea007
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 79.9MB
        • SHA256 7743b6a1eb33d59aad22c4041e4649d2810a809333ce9d886972149c23f622fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 75.5MB
        • SHA256 0a74442c02bbe0aa37b4f638ea8f54b70182e66fcd50d383ddb63d6d9c4655e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 77.3MB
        • SHA256 745f88ab2712e3e82cd45c1bf93dfe01c7cbd6261b335bdc97e4941b8cd02e9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 76.1MB
        • SHA256 3d347faf2b929a87b0fff41d2b0e6aa0a49a0ca2d582e6cf8d8b7294d2373ab9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 76.9MB
        • SHA256 992ef2b54e17d8543a8646d1da59877bc3d552ddd6408f7741fbb7f142852df3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 75.3MB
        • SHA256 720d45822dc527cc3f5cedf7b42e27d9a0822ad80a8e9b58c895df6bd2497625
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 73.9MB
        • SHA256 f9fe8de06476186d8f80fb98383f78cdf7195987566342cbd22bf2d794c1e84b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 73.9MB
        • SHA256 4eed3d9ba626886977c5c90d24e3697923b81e16eca3d65567972234949f53cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 73.9MB
        • SHA256 4b69248bbc4d2f78f351447588f679a3e66d48dbf14f8cc6fdf42265f88a0900
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 73.9MB
        • SHA256 18624d8cb5575e86b52a9123e6c9d53949b575aff78cd2eb4e39ba72acf63b7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 73.9MB
        • SHA256 5992f087201e9ae5b4be3535d66fc9d67ddfc30c1416c4ca0fcbabcdbcd5f15b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 73.9MB
        • SHA256 487db6bf0bce0a41030b857d792064afa9c18f291887fe213ad82a1aaa4089fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 73.9MB
        • SHA256 1add31da3d6963358cb5187c8c0d71182f7814f896e00cfd32a0aa1c1f64ee39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 74.1MB
        • SHA256 a8ae07de31c549edddbe8b5de484f8c28734128a1c97a875d9f2f47a25098815
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 73.9MB
        • SHA256 bef2fecde4c9ec4021ef0ac2d7180e53133ad411528c4127a52cbfe8e6fb954b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 74.0MB
        • SHA256 b705d83c3e5145064dce8cdd2d4743afaafbd79f9e5bde88df2e7ab0ff5aac0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 36.9MB
        • SHA256 4ffdcbe5ae82b11a7e31188ee85ae2fa20ac46103bf5c6d3fc725863ffc028f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 73.9MB
        • SHA256 60b37d344010ddd4fb60f99dce5db698576954d811b2f359b05422521650e4e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 74.0MB
        • SHA256 4edb2703de428de5b2e21e05a7d230d0f3ea94feb764b3b1b56c9139152e2ffd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 74.1MB
        • SHA256 be731d99243b89d17dd0a791bc9c98e235a858d9b2880ab21923a3fe36d08570
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 74.3MB
        • SHA256 e285565138a07ddcdb6686f00bbbd6e4ce7b6156c99b544730da30d77bc31310
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 73.9MB
        • SHA256 c4f6d67e88bf2964cf0ef52d9575c90becfea5a3ae29762fd710516e5ec6a962
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 71.0MB
        • SHA256 6b1c2386fcde1724a821c7b40fe5d41ad5cfafd932ed32f13d8bbeceee8b1f75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 61.2MB
        • SHA256 99c0f3630eb66b169ed69f4faed4ab0002d9cbdb3aa09ed9ef7f69111d60d34c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 54.6MB
        • SHA256 46b8e21700f3bf157667bfbf581b22f0e77d800b3a9156767e64859cd38bcdd7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 50.6MB
        • SHA256 640048ff8b832114ce558e48534af1805f31eb3b4e46bbd6237ab97964584006
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 45.0MB
        • SHA256 6a7bc36e7180f81feafb016ab6660e133574212810ef03811242273c35bab9c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 36.6MB
        • SHA256 90d88ccde6bc643bdfa73a45adcdbca04a0377dd983b84756ac72736b8c45d67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 25.6MB
        • SHA256 63814004895a64023107920abe4a6b784c5cd47fb458562ca74df2a571fde26b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 23.7MB
        • SHA256 93ba2b6c4455c44e53a2484ef27dde5d4b67b38795b7d25e7890119633a5f74b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 20.1MB
        • SHA256 92fb927fde03593a9600c0f9bf06e8d099d2c62535acbb358fbc4299a3070146
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 19.1MB
        • SHA256 cd1523c94dc2b9687e5bbb5b78781b2d2ae69c07e29ba1540b77c0d2ff652a34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 2.8MB
        • SHA256 4bd3518754396109c845a538ef7e453af33c5f73025c4520a866406c5e1c6360
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 832KB
        • SHA256 91e87ea8965ca651069ab0adb2259ef2c29f8f8fa047b85fc96b7d972de972c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 74.0MB
        • SHA256 6e8a44c8e2686d0c741e22c2a5bfe28510607ccb59ef51cb78f05c956a3fc794
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 73.9MB
        • SHA256 35d6d779220422611786de53a8c394d7ba00f30770dd406a455de21b9aeefb69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 73.9MB
        • SHA256 5f14c4d116aa54f9bfd01abe6e0a22e3b4977b13005b7bcf0ebb3e50965d648a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 73.9MB
        • SHA256 2118ca07f0c5c6a992cb75f89670ed930626e737f217a12d759224709476a2fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 36.9MB
        • SHA256 bfb2d9c1760ee67a43bec200fd040f12ee00726143463136a010885b5ca936c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download