Overview

overview

8

Static

static

3

2026-07-06...r_.exe

windows10-2004-x64

8

2026-07-06...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    26s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    06/07/2026, 21:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-06_53cb9f019a8d908f2a95536b1cbc1016_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 14.0MB
  • Sample260706-1ext9aby2w
  • SHA256 58a8ff4d7aa82165b32ef3f3156ae520d686ab9555625b1c876b65eae629adca
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 46 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-06_53cb9f019a8d908f2a95536b1cbc1016_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-06_53cb9f019a8d908f2a95536b1cbc1016_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2904
  • C:\Users\Admin\AppData\Local\Temp\2026-07-06_53cb9f019a8d908f2a95536b1cbc1016_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-06_53cb9f019a8d908f2a95536b1cbc1016_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3664

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 4.0MB
        • SHA256 774835b869e3706198dab74c7b1967733c87b57b51d7585aeb8e5229909c87b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 4.0MB
        • SHA256 5b7ef1d26751926919eb2d080dc4e158ecacb03190b5667613533369ee012aa0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 4.3MB
        • SHA256 263fdaf3b305f76a3d5ef503e45a44f0b09680dbce5b6c92b72f1bf0acfb1c51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 4.0MB
        • SHA256 7f4c530144727b3fdd3eb99c6753c6cd7672526e140fddf29cd080e120c80fdb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 3.6MB
        • SHA256 e81869760c66a2f4017a0c09d8ddf5521b8d2b59620d6b03a21292bb7a0b526f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 4.5MB
        • SHA256 fff1fd587890f2c32f5fdfcec158ee383e1fb522eac1e8fc5781f84aebc2f9bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 3.9MB
        • SHA256 32a2626cd015b4049d766aebee490551c0a0672a6360e4009f58d1d0efd9bd7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 3.6MB
        • SHA256 7ec99b231752a4dc003b4b2fcc66a519e9413208b8b6ea83766741951aad2299
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 4.2MB
        • SHA256 a3ab28a85bdc8f9ba443bec55332fddc2b383939a643636a1394ec8cab6e1dec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 4.2MB
        • SHA256 164748e1863ea0a0a93fee50c587da40434072b784fbdb03950a4aefffa55dd1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 4.2MB
        • SHA256 77453ac082549a6c278e0e6e2f38efce89d999d56e73b81a8fa76a9b782d75ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 3.8MB
        • SHA256 746e0037d0f103e238ec13260d5d3e95ff8e8f64842d3c1523b00252126b8988
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 4.0MB
        • SHA256 67496fa1a99cfa3ccd4f3fbceddc419e63dfc31e40de6062a09f2e9a795ac516
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 3.4MB
        • SHA256 a9684f142e82740b603258402050027f7ce6cfdf822b786ed4c29ae453ff25b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 3.5MB
        • SHA256 78a9d5888697592462aba4b17cee0a42c26f7d03d73dcd5e8f40d162fb31d4a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 3.7MB
        • SHA256 fedb227c68fefeb5e05d25040c52778feda5317cbbdace83ba482fa3258bb7e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 4.4MB
        • SHA256 a3f636aa98c149a564063aaf2bf79586aff71b60356fc8657fb58923469296e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 3.6MB
        • SHA256 05443c179d5f3b7193974b273490bdb44f34c0daa974adad306589d56baa9647
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
        • Size 3.7MB
        • SHA256 7b2cc3aa74f9a252bf4c6fe33b81279cb9a2519073b5c4b2dc4f9779448e555a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe
        • Size 3.8MB
        • SHA256 d3956618eca7b63c43b9543ca5ddfefe1ea49d4130d34330e3b03edb9f011458
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
        • Size 4.0MB
        • SHA256 24e0e9dff3f3323e1658aa63fce7b1a00635852034d308449ab17171ff1249ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe
        • Size 4.4MB
        • SHA256 b90dd860c80fc04d9a74b058c34d8804e0e03b3035c852371018385cfa0396d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe
        • Size 4.0MB
        • SHA256 00824c1200686a825057baca3b13a90c6a95a0d2e4e92a56ce27c5032a435cde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe
        • Size 3.4MB
        • SHA256 c9e3409a77a968dd5869230588ae45699a9abf37de32c347e7ce21bf69bf038f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fontconfig.properties.src
        • Path C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src
        • Size 3.7MB
        • SHA256 479767686bbe0c032bddd44cd23f055ff73cb543463f2e31a1c109f2e2523f51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jabswitch.exe
        • Size 3.8MB
        • SHA256 3adbfb83ee3e082e97222ed7c91567f2790e6056639d3335fcd0b16cf971c3f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jre-1.8\bin\java.exe
        • Size 4.4MB
        • SHA256 8c48b37c02ec50de1174a8acfdb0d6b582436035c66c771544e690f1d0cbebae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javacpl.exe
        • Size 3.5MB
        • SHA256 0c8bd6422154ad646c0b51a5b0e7c5c1a04f730823ec550183537dfb35729ddf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javaw.exe
        • Size 3.8MB
        • SHA256 770b8af3128a80722d6567623b116c276d22b3ab218bc7312c94f342581cfd53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jjs.exe
        • Size 4.3MB
        • SHA256 fe2708b28eacf35d843d70e5b9212983375f67687de86401d2a930d8f4605eda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
        • Size 3.5MB
        • SHA256 65d17260bb414ade7d9dfa977c81738f4b8638480073e9b44be754b40fa796a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jre-1.8\bin\klist.exe
        • Size 3.7MB
        • SHA256 6091cba52ad8df4410918539a9b80af7aa3fa6646a3355836e24d47f5b2ae076
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jre-1.8\bin\policytool.exe
        • Size 4.0MB
        • SHA256 275a7018b18b594734bcd133bbfc04ca1933d3a2c824e89f5651c2a5a1ee1527
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe
        • Size 64KB
        • SHA256 79a0b1f3b0958e830806c9254c2ba2af079ac99713004febcc3610200c9f504e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssvagent.exe
        • Path C:\Program Files\Java\jre-1.8\bin\ssvagent.exe
        • Size 3.6MB
        • SHA256 a228f3aee7eaf9ff1da6a0ba34c123355d5973f5fc66ba011dab5243a6c0f681
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fontconfig.properties.src
        • Path C:\Program Files\Java\jre-1.8\lib\fontconfig.properties.src
        • Size 3.2MB
        • SHA256 aeb1e2dbce284b37a4f0dbfafdaece6b3e4495ae52c26891129d815e7a5b04bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVDllSurrogate32.exe
        • Path C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe
        • Size 3.3MB
        • SHA256 661ad81fbdbdb300bb4ea3ee81c8ee904e23c428e7ae8e2e0c35e8c62e511ad9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVLP.exe
        • Path C:\Program Files\Microsoft Office\root\Client\AppVLP.exe
        • Size 4.0MB
        • SHA256 514ab63dd8c76439b2bf183c9b9d9b599d175f8bbad45c54a36d9de34c3fb51b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Integrator.exe
        • Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe
        • Size 3.9MB
        • SHA256 49c22b4ca57096a723712a841a95814cdd6d5203d3922ae8f4553da310e1f1ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Mashup.Container.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe
        • Size 3.4MB
        • SHA256 e20b144654ac068c225e3b30b283be7cbbf0622251191eb6494e310462cdc764
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 4.1MB
        • SHA256 667dd2e3bd9eb4031ac960ec3a271386e4aa25e52576a8ccc8260b99dfa2f9ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 3.9MB
        • SHA256 b383bbc8637c2e42f98544fdca15c421a60b4893b7f7487d39cd38931a5cbdff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 5.2MB
        • SHA256 a62595c81f8dbbb0aedfbc77223908f4850aeb978a0c60e4823808c176b21496
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download