Overview

overview

8

Static

static

3

2026-05-31...r_.exe

windows10-2004-x64

8

2026-05-31...r_.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    72s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    31/05/2026, 08:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-31_04861c9fd87f37493d840508f63048ad_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 22.9MB
  • Sample260531-krnjcaft3n
  • SHA256 a7e9fffa7f008ac2e95bd0753036b50d0f061695fcfdb5bd9a55bd9ee4663a8b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-31_04861c9fd87f37493d840508f63048ad_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-31_04861c9fd87f37493d840508f63048ad_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1380
  • C:\Users\Admin\AppData\Local\Temp\2026-05-31_04861c9fd87f37493d840508f63048ad_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-05-31_04861c9fd87f37493d840508f63048ad_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1832

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 23.5MB
        • SHA256 c7d7022d9b0d5c6d8e7ab525a9374d9b869371f543935bb66f006b016ddccc53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 46.5MB
        • SHA256 9a94fc1b4d6c96d910d15e7853380ea4eb3343c32df208ffbfe152cf2a90b323
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 45.9MB
        • SHA256 97c84819d3140f47226f9c9360c324409a5a95672923bf916b1fbef38eeec2ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 46.1MB
        • SHA256 2156c9cad39caecc8432998580e419309c271609084c4080667f057f1fec0021
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 45.9MB
        • SHA256 b835f71f327b9d8ec4deb33bcf7e11077660ab50b4bfdbd982ed0f3ed61b47a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 69.3MB
        • SHA256 52f828cf227111ec60cd7abe6bf0ee03a6b1cc0cfd0503b45af32391a5903598
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 51.9MB
        • SHA256 94006f46b36326d617dd474334527612138a7b38340448add47c685848f88bf1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 47.6MB
        • SHA256 e983a8022288068d9ef69b1f116f76a45bbee470a20d1aa9398abd070c2c3473
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 49.3MB
        • SHA256 1bebfb6753eca230bac54faaade1ea3d2612834c94453b7351c2623b646ad1ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 48.1MB
        • SHA256 4be7d032c5895a99677d5600b5e8a0c99add5fe908f1e0ea16bd1d1e1c591a7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 47.5MB
        • SHA256 674544d891d48da819a2e162cc57c91939673479271d6342582af505761cc045
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 47.7MB
        • SHA256 781418acebd69141f4445a833e5d9ade0dc2a7667a27c07ad3cd82f50a98e6d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 47.3MB
        • SHA256 201551b646dc51b74d9f1f3bd550dc575ac268e1eb0cebf1c64ccf3ac1ad52f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 45.9MB
        • SHA256 8f29e979f4b133af289933d48ab52e19d72fd53fcb15cdc3ba3f7445c6f23b89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 44.6MB
        • SHA256 ce6ab5f992c8ac8f5b8288c2b70ca43baecd039a887d1157c0be8c714ace1d02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 44.0MB
        • SHA256 70d85e4d8e897968e8bd9c687151394eefe37029996764198cfb49b0500f136d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 41.4MB
        • SHA256 d4345639550e8e712a5f772196ffc2a98211ea38b7c12b1f13b30ec99e7ca66e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 41.2MB
        • SHA256 ba9746e19aa4aac15cf3492671dec5aba77120d84db683b21977181109892b8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 37.0MB
        • SHA256 dd330fb9989d40fef0fb498ca2eb572d21fbdfdeddfec19b3e707cb760d5e3fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 40.6MB
        • SHA256 d45c753c71d03b43276c9f5b381bed07e6fbd811189213f2ad4c6380c0d39110
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 36.1MB
        • SHA256 c828b03e5f6441e4c7abc5d6a96d24fd0c223eed723260a975ae640f7f1c635b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 36.2MB
        • SHA256 00374bfcbb6701493ef8a5f5b2fafabf4a6983d783cdb06587efceb3212fa17d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 34.6MB
        • SHA256 aae6e422594b5daf0ca41c5a4ab4bebdf71a6d588d420a622cede4dcbaa9e8be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 31.4MB
        • SHA256 c8e90f6fd6c00b1bc78ceebe8f6181a81c22577e352086d437ac27df3789f093
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 34.1MB
        • SHA256 561b039ca5edd79f9e54144032dcae080235c40a69d660711a52510942409b40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 33.9MB
        • SHA256 b79d05fadfce06014f82baf37d620359de9c8b486176a481639edd994f168649
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 31.0MB
        • SHA256 cf0ffab058f35f1887efcacc56ab1864e9fcbc13ec62b98fbbdd8ba4f008f01e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 33.8MB
        • SHA256 83c56ae1cf625138dec63901531adf56cfe135719bd5461fc498990afb25ead5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 33.7MB
        • SHA256 ed045649067de74f42c5e226a18840541a27ed29cb2898c1049f94154089b390
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 32.6MB
        • SHA256 a7466a2a2d0423c3772ac58eb74b4563c9b0163ca7aaa86c934119fc5585a2d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 33.5MB
        • SHA256 68d00c7f2b9c3dbb09ab0c315fd3b198913cb523d5ab476c95918d22d5905a78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 33.4MB
        • SHA256 84a1e3736d93355c0c3b6445d041afc625f1f48b8328060d638fcad1d2e06f44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 33.2MB
        • SHA256 9171a4c73ca5635367ed22525e713111a5d44976a8d8114bf69c7cad6df00eb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 31.5MB
        • SHA256 26d723f2549b6dc4b742d0a4065dd2c3aebbf6176d94957c2f5cacf5ba9986e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 33.2MB
        • SHA256 688851497dacb602285828ed03ad76ba3687b4b0b339f3928b338a1dd4aefd21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 33.0MB
        • SHA256 0933ca3f18c85fb1fdee7b55c4b5119f126161c382ae71bcd506f56a587e51d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 32.9MB
        • SHA256 775b540eb3528c2e9fde582dd4b6a255b26d3d53c6e2c77bd874930d08316012
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 29.7MB
        • SHA256 961e8f9689dfe2ef79f1694052c2da53e9b096bc087c743c56e0b1fada214a32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 32.9MB
        • SHA256 0d50fa9d5cea1e351e4941254579b5ae7e7cb91d211d5850125e40638c36e385
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 32.8MB
        • SHA256 948996fcc9821cf1b6200da1684f49e0341ac3db74ff621fc967d0ed13cc5bf8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 32.8MB
        • SHA256 4c5022d3f5393b2f3fedfb4fb99052b9cfb91b649da64216ac2505d2b94b3e31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 30.6MB
        • SHA256 7cd74666609d1ff139848732ca7bf45b6062f02e27abe7c0d675e4c6e8105da3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 30.3MB
        • SHA256 24ed26115c7612bf72e7088f534c4f20d17b9fc3e14bf708df669331f90cd81a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 30.1MB
        • SHA256 607ebbf2f6797dec1ec7a63613c8d5ea5f2e13b02c1ef37bc78484931bb5d519
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 30.0MB
        • SHA256 68325706d4a9f51dbb6ab761bbaa3f09ba46226a04386f2765c7bdccc93e3e0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 30.1MB
        • SHA256 40c0a9629d0fb3b8d4fcf5dbcc17b7b8e683b538fcf1c5cd9a62128f1c3512d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 45.9MB
        • SHA256 650d03116fdaafa12240ce27b249ab9e245e6ece67bc634c36bb0996bf198f8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 45.9MB
        • SHA256 20b85dc913fce3bf01de9eaf3a29669053e194672de7db7080967d88a027dd35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 45.9MB
        • SHA256 dcc5dce97e05aa456ed31693d1725a80fa525c92b4505da30a94331c3f992677
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 22.9MB
        • SHA256 a7e9fffa7f008ac2e95bd0753036b50d0f061695fcfdb5bd9a55bd9ee4663a8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download