Overview

overview

8

Static

static

3

2026-07-05...r_.exe

windows10-2004-x64

8

2026-07-05...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    20s
  • max time network
    116s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/07/2026, 03:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-05_c1f9e89dd1e046ea2f1463b0532d6271_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 18.5MB
  • Sample260705-d2td1sg12s
  • SHA256 095b0813433b44d55f57a65064f698e4e7432f23f2fff7ae280b0ad4e06ecd77
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-05_c1f9e89dd1e046ea2f1463b0532d6271_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-05_c1f9e89dd1e046ea2f1463b0532d6271_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4652
  • C:\Users\Admin\AppData\Local\Temp\2026-07-05_c1f9e89dd1e046ea2f1463b0532d6271_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-05_c1f9e89dd1e046ea2f1463b0532d6271_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1736

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 19.0MB
        • SHA256 7b4bcbe2a5bbe6876e1618341268e7daddfde003445c31de0d32742f0d149f96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 18.5MB
        • SHA256 095b0813433b44d55f57a65064f698e4e7432f23f2fff7ae280b0ad4e06ecd77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 37.7MB
        • SHA256 5a9e0b7a1d98fdee1818f01c46ebf35c352dd72751db84e5664ecf25e2f1e23e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 37.0MB
        • SHA256 87f751c1442404a909abc3e12a3157c7df84bf3f9166a701a2e67440342834d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 37.3MB
        • SHA256 045dcb970c8e9a34fe788d2a64cc44b9d374c1c2784af36b4ed4f774d6c0716b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 37.0MB
        • SHA256 9dc82935c6078d03dc9927163678322b1532393f812c9691606211cfba4cec6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 41.1MB
        • SHA256 fc9905f111b5b45cdcbee7e424aebdfcd52b4f163bd8a6412e8c3546917a425d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 37.3MB
        • SHA256 d12310e12b36169dbf465e919e3e1a81df8b5bb34e3833b6048fcdcaf801425b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 51.6MB
        • SHA256 0c61145ada2dd07e7e83c7a3a6a2e99550a2039da0fb778d27eeadb8ac3d05fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 39.1MB
        • SHA256 afc07dec8a596a025fb195aac093065c71cb388c342f6c3c4dedb945027d4b19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 37.1MB
        • SHA256 ff1dd2f4f9c70c2aa5436f849e3fb9a4ffb0c3ba943025a58cd455f44d2d642e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 43.0MB
        • SHA256 edf5d249f776a449a6c882ae9e7e675f1325075559ffad5a9c9eeba2e845f19c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 40.4MB
        • SHA256 1a00624f3a72653f0c2bedcd000c7787f0b0cda867bc4838e2cb4560ad65b9ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 38.7MB
        • SHA256 d98c04683fcdc9ad568cefebb98023f8476e7135152e507e34501f7e6cd59074
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 39.3MB
        • SHA256 47f483c680cbca65c161b574d57c3dc0d20538d2eb9320c2b6c80c6653c0f43e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 38.6MB
        • SHA256 ecf0b777c6777e6c3dde8c7f75c938a67d701e704ccb3e82595db51c34b23166
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 38.8MB
        • SHA256 6476334c7e5eb2bf079a44e3e5b880e93575df56ad92e82c6a097800662127ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 40.1MB
        • SHA256 d0478905f0c065331bd522b2b51352c05cda0f9d3c62a0d79369256086058ff8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 36.0MB
        • SHA256 aac47ae08dcecc45844d32dfd06fff5bc0764c2358c93fc8d5903d088641ef59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 35.9MB
        • SHA256 279613e57668228176b1f72c8c42edb122cc64680584eb5d6054fb139434569b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 37.0MB
        • SHA256 a7cd980949646baf9af93a7e686858e8641998cd42c843467f67aa9cfc12f170
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 37.0MB
        • SHA256 4f78b79ab69957c89073868c1088d5082bea845a372050592b7f498093b16a6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 37.0MB
        • SHA256 7d7d6c84e3c61ce79b38b28e68aa1856b3556a7288fe42a8a3ebd99806252b9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 31.3MB
        • SHA256 fec2c14918bcff88cdb46bc6fd458a2a95c66c4d2fab1e9de877106d68551bc1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 35.2MB
        • SHA256 99463c7a4ce22e3b9fbb30b5daf5a63777ef8ec35ad1573da41506e4ee3aade3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 37.3MB
        • SHA256 d74e5231028e216b91b0cdcd0b10face12f6dee7b1e02edf66ad13fdae2b9242
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 37.0MB
        • SHA256 85ae994c6b2f24ed7ec0e4309e86f1dd05b5f9776568dce51efa81783905b91c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 37.0MB
        • SHA256 14563d19d94a941621ef331ab17cb1d4947da025ae2e0f986e1ec618ea946e81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 37.1MB
        • SHA256 350b0c7b17f2a11e5ef4aa4a4b8e94efb6c1241dec84ed93d413852bdbd57825
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 37.0MB
        • SHA256 5222ddded278b77f89c0b0566d1cb89211048796692b6b20d0bfb9662ed0aa97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 37.0MB
        • SHA256 7e9fc15d7c8f533add6851aa10e16c2856bd51569059ad968ea818083b9e8627
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 37.1MB
        • SHA256 f3a6875c086b5411dd91e84cd1fce4a113017fa491054987d89a485a1cd3cbaa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 37.3MB
        • SHA256 73cb4661f2e5974d0432fb585550f4b07937cb0ec6bb0dd506488c8032504654
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 37.4MB
        • SHA256 b7c793cc79cc6bcbbe725e311190a315d723d9e3a55cfc5b302f68738c08f4ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 34.6MB
        • SHA256 5f41b1313f0f9a95498589bd7cf62d74cc349e443873c0d89a946e9006c36d05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 34.8MB
        • SHA256 032dcd754d14567b97e07da14fe6229fa5a1a5a9eb6c582897919c06f3700a2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 37.0MB
        • SHA256 c700b518e842e9acd42ca7ef006a1ec772cd65290edfec443d57ff4f6057fc18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 37.0MB
        • SHA256 84abd9e92901ddcb8b8f73a226d44843161b224abed400eed74fffd42650d57c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 37.0MB
        • SHA256 e670c9f8881ed936dbf97649ce20cb0f5b5e88ab70a41f76cc6a3e9439adfc71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 37.0MB
        • SHA256 9a7ad7609b0207167acdb59db82f5e1f5c1547c543d11524ac4b4c0a91e09068
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 34.0MB
        • SHA256 829133c24bbb38b88d450f9313635616bf5ce8cc4ed2c81946a36bad0ee51183
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 37.0MB
        • SHA256 a350ac99bdddec381abe2e215dbcfe7fecd5321cd6cf840ebb3c3c74ceeca84f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 33.9MB
        • SHA256 0dbc253dbc305eb8eecf357997e0f383348ec94e6c22e225dbdbb3278439f33f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 37.0MB
        • SHA256 a57d94544773ad0ad55b0d5e9a8f4bde12dde1ff68f9e5e5a816638398e8aa3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 37.0MB
        • SHA256 c7d777b79bf6f373285057ce27ac378a1f4baaf3f35168cfb093983d5c719127
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 37.0MB
        • SHA256 d1a16336803e3a68e35f3020f9bb6d8cd85e1ca7db9ad98c2c734b5cc9faac1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 33.8MB
        • SHA256 deaf9bbab3a4657dd9b21749e72e09e1c2e3945d8f902352267b5a8dbeec0cd2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 33.5MB
        • SHA256 d1a152efa529723c9320f0059f243d8b22b9e2d4909015a99be3abe2ce546c95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 33.4MB
        • SHA256 1adab83b9430a2d022c9efe0b150643d26695f971a48aeec825aa830e557a753
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 37.0MB
        • SHA256 3cf77f2cfbaaff771f2db09564236bc4c168d343201573722f29bf6da51e0b03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 37.0MB
        • SHA256 0e09e2bb9b0ea661fc2334b4f9baece0d614cb3fb647f2cc1492292a93600bb9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 37.0MB
        • SHA256 3965d2dbf339eb13a78c88f5bc6e828d4e5dee68fc33ef56ce67f1f3a402a4fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 37.0MB
        • SHA256 6c21fe26dbba6b0a24654f96703241f7d2f5ed858da9b9c0af9d3d4d8e92fcb8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 37.0MB
        • SHA256 1f053fab144f2ff8c8c3c88bb8eafc3f9e06e14bda859e7eac2d2b05b3cd7a5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 37.0MB
        • SHA256 312fa503f2601fcb74d36600e49900c1bd9cfd42486b36be3487d8ce9e631de9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 36.9MB
        • SHA256 3750f6d84bc391cf59d4d35482cf96b09e12900342697ab24f238faf8261dd74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 37.1MB
        • SHA256 3f8f736cbbc8ae2c7a07383cb3ba4e83c7f4a30a82a204b12d41c6e71b263f24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 37.0MB
        • SHA256 d6de92327de9016821f5cf15c855f0b344d80f30fceb70c453625fd473867682
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 37.0MB
        • SHA256 610271a3f8306898d5834c304dd1a7db50939084e1a8dbbb9112ae32e043eef4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 37.0MB
        • SHA256 de352e0b107b48bf6f43763aa4ceae283ce4239e2533c8f472c15e9a8665faec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1736-20-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4652-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4652-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download