Overview

overview

8

Static

static

3

2026-06-26...r_.exe

windows10-2004-x64

2026-06-26...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    94s
  • max time network
    96s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/06/2026, 16:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-26_371bca562f32d39fa7914e3eb8fdfb8f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 40.3MB
  • Sample260629-vfky7aas21
  • SHA256 b81581cc6b31b6a5ce13ba646e965c99dc46329f7d818cfeb180341187363b0f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-26_371bca562f32d39fa7914e3eb8fdfb8f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-26_371bca562f32d39fa7914e3eb8fdfb8f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5384
  • C:\Users\Admin\AppData\Local\Temp\2026-06-26_371bca562f32d39fa7914e3eb8fdfb8f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-26_371bca562f32d39fa7914e3eb8fdfb8f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4756
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:2868
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
        PID:568
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
        PID:2524
      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
        1⤵
          PID:4072

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              AppVShNotify.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
              • Size 40.6MB
              • SHA256 b5c74ec287692815f20e883280a2964b23f4dbd40add166e46a2130a61117323
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              InspectorOfficeGadget.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
              • Size 80.7MB
              • SHA256 976abf8e4066523f72b77dd0beaaf349655fda9ef0394e83dd1b41e548752fa1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              IntegratedOffice.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
              • Size 84.7MB
              • SHA256 144766a54ef70d352d54e56622daedda092de9061a7eaf8559869590bc0dc5e8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MavInject32.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
              • Size 81.0MB
              • SHA256 257a866d01077a255c2347bd9647adc877dc539c62358e8f8b369f4cb5de4e04
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              OfficeC2RClient.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
              • Size 63.8MB
              • SHA256 9630ba178c1d3ef19495d73291981e1cd59e710031ae2da088a1d22de965ee0e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              appvcleaner.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
              • Size 42.4MB
              • SHA256 bbd946b21785760fc6511e47000e1a80810ee4023009bc199f3e7ed62c7d7886
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VSTOInstaller.exe
              • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
              • Size 40.4MB
              • SHA256 16f7e63d42390b82f0d7adc0cd0434df6709455732850555447d0dc0fc3a7096
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrmstp.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
              • Size 86.7MB
              • SHA256 fd753153c7f0b215f3582e01d1d3ec5cc69f00337175b5c0715aab4827b14c04
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrome_pwa_launcher.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
              • Size 82.3MB
              • SHA256 226911cd36e1b3a5bcdb8f5f9f158e8310a0c9abede507bb930c21f1412647e5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevated_tracing_service.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
              • Size 84.1MB
              • SHA256 883123abc945d1495026fe61ff2a56c68ea1d337b95133ea1d818c0799234eb6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevation_service.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
              • Size 82.9MB
              • SHA256 7087fbcf86434847fab2c555f60b1762a682982351ae10e3ae6015e05db030ef
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              notification_helper.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
              • Size 82.3MB
              • SHA256 5e96522ae00e9471b7c148c53d12f2164ddd84190b26ce15ed996b3bcbef8822
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              os_update_handler.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
              • Size 82.5MB
              • SHA256 218a797688fd9c183f25e27cda0729249e1744ee93f49341e3436c1524a2224b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrome.exe
              • Path C:\Program Files\Google\Chrome\Application\chrome.exe
              • Size 83.7MB
              • SHA256 7e346322b374a7cc907b30720911ef0be78a5f5a17a807672802b47963da4d13
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrome_proxy.exe
              • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
              • Size 41.7MB
              • SHA256 a3bc28a88ce763d6afbbbb82f6bab9d68fef5f544fb82ef597af283e7cbe17ce
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              appletviewer.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
              • Size 63.3MB
              • SHA256 ef8894918acf3e9a45cd5275111240222cf97e15c8fe32ac79e0bd0da833a459
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              extcheck.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
              • Size 57.1MB
              • SHA256 ca239a0b51c00107210d3d5d93a71f7060bbd83146a31ed4978e9b9fd85b4765
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              idlj.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
              • Size 57.4MB
              • SHA256 f46988fab176e33f81c4572d42568586017f3064b02048b6cf1b18e562bfbe5e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jabswitch.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
              • Size 51.4MB
              • SHA256 39c5f72e4be281a6256f74122f6d9bc8fb4e3b7bbf3bafb8d9e1eb23aa5a02bc
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jarsigner.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
              • Size 47.6MB
              • SHA256 076cfb7a0fdf37b2fcbad8186e1ae092dc1b5b6d5eeb8b0f13140d82626edeef
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              java-rmi.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
              • Size 50.9MB
              • SHA256 f6f6d928244c40e24a07b63a7dfba52b3eae0dc1efa1076b14b992040745c867
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              java.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
              • Size 43.4MB
              • SHA256 d1d70878e5487767baff701c7a8e3297ab469e090f7d438650032d34e81a4427
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javac.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
              • Size 42.1MB
              • SHA256 80eec82579ac50b3a635483c655e9dd8823d74256385fca5e571ec40e994a1f7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javadoc.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
              • Size 40.0MB
              • SHA256 a1c01f36e121d23f39a07271fa1b1c41410c60360f5f588e3fb1b762a59e51d0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javafxpackager.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
              • Size 38.3MB
              • SHA256 31a3775719fc7ed605b6f92d1efb71d4dc19b6cf59fcca4a5ce5ceb63158c945
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javah.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
              • Size 37.8MB
              • SHA256 e8224cd954f4b827930c36db11dc1510bf3ad40b120b73f124ecaddd10148e23
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javap.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
              • Size 37.1MB
              • SHA256 79165c13cf42e076a87ad3d7b230e7242d1c5d15633343ba02b2c72db7b3a0eb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javapackager.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
              • Size 36.0MB
              • SHA256 c5bb9fbb6ac5f8830ffa42103dd704406049be77483a5b198627be38e3ad0b29
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javaw.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
              • Size 34.7MB
              • SHA256 faa0396b3bd7cbdea567b181ed6f99e2af6849142418b6c5f5a9ab139cc4982d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javaws.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
              • Size 31.8MB
              • SHA256 13e9f918406604c5ff4d28e7b163520b1eae03c2727074f3657d493a5589d632
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jcmd.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
              • Size 31.1MB
              • SHA256 178be8062dd73b557e1a7607a2749cb1384767086cc710e49939c541448d6601
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jconsole.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
              • Size 30.7MB
              • SHA256 a63befc34205c3670ef716fb39cf0c785c240f928ddff0b91712dd9579ba377f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jdb.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
              • Size 28.9MB
              • SHA256 f2f9812c84c5756e2ebf048c2f9af9dfd87aec6e364bb2f4556ca49af571c0e8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jdeps.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
              • Size 28.3MB
              • SHA256 40496cc44fd63b5da412ec90aad8171df855841760ea81e2a39b3e782d71ab20
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jhat.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
              • Size 28.0MB
              • SHA256 34dd63bb780d08a6d186426c5f261cf642fe77bfe7c2d211b9d23df64690fc0b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jjs.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
              • Size 27.1MB
              • SHA256 f08e141dfcdbee95a46efe57659921f31bdb4bb706a8e651696a1fc689669ce9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jstack.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
              • Size 25.6MB
              • SHA256 a35468398328d71018d4042b6e454ba27ea600a478dc9af4925cc897770ed633
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jstat.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
              • Size 64KB
              • SHA256 79a0b1f3b0958e830806c9254c2ba2af079ac99713004febcc3610200c9f504e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dotnet.exe
              • Path C:\Program Files\dotnet\dotnet.exe
              • Size 40.5MB
              • SHA256 7017564b3f446e3b1b62de102581ada528aa2f611f8ab9bafb7476d73b74e204
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              createdump.exe
              • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
              • Size 80.7MB
              • SHA256 a7041a938698fe1ef5af2fc38988d9669a0f7addf7b1b6b54631a93279117388
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              createdump.exe
              • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
              • Size 80.7MB
              • SHA256 79fa32005caba967a9b575f6970e1bb6a60a4f3833f568be737a9fdf08250aec
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              createdump.exe
              • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
              • Size 80.7MB
              • SHA256 004d9e9108280aa4d64745b6092744cbe12e2ab540b38ac1d1cf766358b43beb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              prep_Activatable Class_Hermes_perf.cache
              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
              • Size 595B
              • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              memory/4072-187-0x000001EA94380000-0x000001EA943A0000-memory.dmp
              Download

              memory/4072-141-0x000001EA801E0000-0x000001EA802E0000-memory.dmp
              Download

              memory/4072-172-0x000001EA84000000-0x000001EA84100000-memory.dmp
              Download

              memory/4072-173-0x000001EA81DB0000-0x000001EA81DD0000-memory.dmp
              Download

              memory/4072-171-0x000001EA81C70000-0x000001EA81C90000-memory.dmp
              Download