Overview

overview

8

Static

static

3

2026-07-01...ij.exe

windows10-2004-x64

8

2026-07-01...ij.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    23s
  • max time network
    125s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/07/2026, 00:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-01_0b9facbb23e37560850f2e700ea4e957_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe
  • Size 25.1MB
  • Sample260702-asjxfaav3s
  • SHA256 93c6b4e618184d7b4432699f886485c4834aaf71b1af7e37e7ce47fcef2f6ca3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-01_0b9facbb23e37560850f2e700ea4e957_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-01_0b9facbb23e37560850f2e700ea4e957_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4588
  • C:\Users\Admin\AppData\Local\Temp\2026-07-01_0b9facbb23e37560850f2e700ea4e957_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-01_0b9facbb23e37560850f2e700ea4e957_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2916
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:6028
      • C:\Windows\explorer.exe
        explorer.exe /LOADSAVEDWINDOWS
        2⤵
          PID:2776
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:4740
        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
          1⤵
            PID:3292

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                AppVShNotify.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
                • Size 25.3MB
                • SHA256 489616cc08a695189c92559d08bb2ef1185bcf12f0b11e0f9faea3031894d056
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                InspectorOfficeGadget.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
                • Size 50.1MB
                • SHA256 ffa9c586cca31bf00e9a00a6b0f2a0f4a43ba348d258f42c529614a3014c28d1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                IntegratedOffice.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
                • Size 54.2MB
                • SHA256 431119fac1d2351787dc9942bdffe9505cf9dfc71885f0c9c325b54e94c8826f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MavInject32.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
                • Size 50.5MB
                • SHA256 ca0d699123f24ad789f649c9e366ea27a1d950a0c4ab10567b244d72520937a3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                OfficeC2RClient.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
                • Size 51.7MB
                • SHA256 409009110fed4261b8c3ab041e65b86417e39a7b094e5b90379542ace00a92bb
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                appvcleaner.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
                • Size 27.2MB
                • SHA256 936e0a7ffa3c98e95fa4b3f9bde21c497aa87a73f76c30eb15648c87a860fecf
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                VSTOInstaller.exe
                • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
                • Size 50.2MB
                • SHA256 ae3ebc1c399e346c8e37afe02dc44b936c847bdcbc312db98055a95e173d06a3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrmstp.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
                • Size 50.6MB
                • SHA256 6c558ff48834cca1e01de7137f00e322a9b320d739f0acc0cd43a3fbd3c2e558
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                setup.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
                • Size 51.6MB
                • SHA256 1314c8d95450eaead2087933ae25600d6d46f061daa5383430bec14ee92cc981
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrome_pwa_launcher.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
                • Size 49.4MB
                • SHA256 a3cb665228b2f3ecd652c8fdd31c44e43a8320faa8d906f6e09043376c0e8aab
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                elevated_tracing_service.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
                • Size 50.4MB
                • SHA256 1c0fdef7de5c8cde1b66cc5dd695241182e47c89b3df53af377cdf0c59bf4deb
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                elevation_service.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                • Size 48.4MB
                • SHA256 583dc87c48e702571cc907caa23842ab76067f2f7642cd32888250e940961647
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                notification_helper.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
                • Size 46.2MB
                • SHA256 470bd10a3e8ab1b1f996b3e0a135eddd1b4e25a8504e5dcf2ae1526423cb8665
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                os_update_handler.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
                • Size 128KB
                • SHA256 e52488a8a3c5c15a2f928eb2127c84d20ca0143b2598bd3c627a271a6a7a3d72
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrome_proxy.exe
                • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
                • Size 49.0MB
                • SHA256 43f1a489e8e1458aa6d90142b47bc8e69a63448ea4f3499b5959a511c942c316
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                appletviewer.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
                • Size 49.1MB
                • SHA256 5a846cc0bdb1daaaa7cc9f5d4cb0a05ad43d0f379037bce777726c5dad04e46b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                extcheck.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
                • Size 49.4MB
                • SHA256 b855a5648d9daca7f26a1a75c06c3e2dd244f3ca1b538fcd535e518ee3e5d646
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                idlj.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
                • Size 48.6MB
                • SHA256 cca52ff6eb6d56529b3d8f6376fc157311348d43ec212a60f9057d935ede3ba3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jabswitch.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
                • Size 48.2MB
                • SHA256 d8bba8819468b7dc530b850a7d404c3ba86489dddf90507461edd7b0991d8715
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jar.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
                • Size 48.8MB
                • SHA256 cf3bd07cec482eba7321afc7198a60b20adc31b2efc5b025d1e3e0d9248ea999
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jarsigner.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
                • Size 42.4MB
                • SHA256 ad59ef6776004bb21d823e98d6558d9bb6f9b83f1926b2ad988cf896535698f4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                java-rmi.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
                • Size 47.4MB
                • SHA256 5e40318e6bae372a29d1bf2af6722edb0be87565cd38a8ac02f90cc57c4912ff
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                java.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
                • Size 39.8MB
                • SHA256 3b3a31ec87522dce1a42359561cce2ae09c8a6fc49719213a6af0fe5048a9f80
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javac.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
                • Size 46.4MB
                • SHA256 322ab904e5d2c36fca5979131f1451b2c5208ef2061d07bcc6cc64d174d79c48
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javadoc.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
                • Size 39.1MB
                • SHA256 ce62d69cdb2319b567f845dc15be9e9f310220a68a3ab28e5879875c0c0228c4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javafxpackager.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
                • Size 47.5MB
                • SHA256 f51fa549b97cb5eb9387ea7afbd465a9647021a9350a08536f8f953c71248559
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javah.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
                • Size 43.5MB
                • SHA256 509e5c9eb6b75e810da6601f2aadc2d087c58239765dcc51aca6ede12cf49d96
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javap.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
                • Size 39.1MB
                • SHA256 a0933396f2fc881f6a62483ddec851e5e8b1030c70670879c3083202c3bb784f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javapackager.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
                • Size 37.9MB
                • SHA256 9308939f525b6668fe85a106faf016c727b82f0e819f3f6b0cf7814195c2ef28
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javaw.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
                • Size 32.3MB
                • SHA256 be6b4bbc14299a924390b70eceec0d198fa763ffaf82e07e962f6a2653476088
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javaws.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
                • Size 35.6MB
                • SHA256 43bc02468b6a5060ad5b6be636f5d498095888ce27590ad6006e7e11ea38c5a2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jcmd.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
                • Size 35.2MB
                • SHA256 4f223f47d7bf611f16a62ecadc3c722c68dfb97cdca2471e8512a972cecdb09f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jdb.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
                • Size 34.9MB
                • SHA256 fa2def7cc8de1c1d7e070692110b6e1637f2866b316b315cf1a70bbf3530a689
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jdeps.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
                • Size 30.6MB
                • SHA256 866aeca668d581ddadab0d17ee964d677aae90615952082a13d9ec12539d03ad
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jhat.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
                • Size 37.4MB
                • SHA256 196c7dcea2dfb150eb46c7386055566436ca392d212dcda0889f6f39b23a4506
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jinfo.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
                • Size 34.5MB
                • SHA256 cc81b52d1899db663cd7bdfac75f81e60d8888aa1f405d73e79ea3d732605766
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jjs.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
                • Size 30.2MB
                • SHA256 6d1d5d4fba8e305289f632231275d5d8bf406be1940a8bc1094ca3b83b540e82
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jmap.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
                • Size 32.5MB
                • SHA256 282a022c5f4e802bd6d7d257abc356f29be8c40f1524ab57fabd1a6613e0a8c6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jps.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
                • Size 34.3MB
                • SHA256 8130ae16023720c343bbd93d25851b22a2c1a1a57c835acd6215cc4af3b81616
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jsadebugd.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
                • Size 36.4MB
                • SHA256 70049a23f2ab5659bb7a512366762266c67485c23bd3eda3004ff4447cebbd81
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jstack.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
                • Size 33.9MB
                • SHA256 bf715b7f129bfdad0b68613a38adcb2ccc8e0698ed06f2ec4ff324f3aa0193b8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jstat.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
                • Size 29.6MB
                • SHA256 b6bcf521d06b29e6f329d466b815e5405e89240b0f15f81881bdfecb97f6ae8d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                klist.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
                • Size 37.7MB
                • SHA256 4cf94cb2318f467a4ce49c4ca010d3b8aa147311e9a8af03affe121d8a45f7ce
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                native2ascii.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
                • Size 35.8MB
                • SHA256 1686467663cdad8773230f4705810a3dc8beaf59fb258d4281496a82ce6b6e11
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                rmid.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
                • Size 29.0MB
                • SHA256 c70681c797dfa70412024c9282ef14a5c611f0b872d551615eed4660302ec0be
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                rmiregistry.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
                • Size 33.1MB
                • SHA256 cee5248c368d70234c044ccbaeffb5c6f547259720d593094f0ffdf438540adc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                schemagen.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
                • Size 28.4MB
                • SHA256 b049123fb61fe9acd7bc48ea049716ef06a894b2c486a802a4bca54f10ac8cf9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                serialver.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
                • Size 28.0MB
                • SHA256 e9283c8d88ceebff800800629c6d1210cf89de162fbbf97f2facc040d7dcd47c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                servertool.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
                • Size 32.0MB
                • SHA256 5616190f14005b707b4963b18fdf66e5cc9a85c596ae2888bb4a5c184da18e85
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                tnameserv.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
                • Size 27.8MB
                • SHA256 34161f8bde6e032f2763a66c15fae65c6b70e97d70b99650d263a8827a619ed1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                dotnet.exe
                • Path C:\Program Files\dotnet\dotnet.exe
                • Size 50.2MB
                • SHA256 08a0fd3dfe2b11a647194ee64c9294b36df2891c1899fd7d2b0bd6a1dfca4ff4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                createdump.exe
                • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
                • Size 48.9MB
                • SHA256 53e644d21222dccfb9cbcd271c49df17e801d5371eb0d426ce7c780e4e017772
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                createdump.exe
                • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
                • Size 50.2MB
                • SHA256 2e3058c350af9a5934840271ce94b267bb98a73d303108dbd339721f7afb0336
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                createdump.exe
                • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
                • Size 50.2MB
                • SHA256 81f40d96e32325a2592a75b8c393cd4c22e635de7ef2727cefa53ba27432dff9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                prep_Activatable Class_Hermes_perf.cache
                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                • Size 595B
                • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                memory/3292-335-0x0000024F001E0000-0x0000024F002E0000-memory.dmp
                Download

                memory/3292-381-0x0000024F141F0000-0x0000024F14210000-memory.dmp
                Download

                memory/3292-366-0x0000024F01E30000-0x0000024F01F30000-memory.dmp
                Download

                memory/3292-367-0x0000024F01C70000-0x0000024F01C90000-memory.dmp
                Download

                memory/3292-365-0x0000024F01A10000-0x0000024F01A30000-memory.dmp
                Download

                memory/4740-307-0x00000223C8520000-0x00000223C8696000-memory.dmp
                Download

                memory/4740-501-0x00000223C8520000-0x00000223C8696000-memory.dmp
                Download