Overview

overview

8

Static

static

3

2026-07-06...r_.exe

windows10-2004-x64

8

2026-07-06...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    45s
  • max time network
    89s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/07/2026, 01:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-06_ac0e025bcd9708e83136e0f81d230057_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 26.6MB
  • Sample260707-b23xcaft8z
  • SHA256 21e1afdabf351f21f0aadc96b3d15a13d03d1e8583bb7eb0744bbfaf9119fac5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-06_ac0e025bcd9708e83136e0f81d230057_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-06_ac0e025bcd9708e83136e0f81d230057_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:968
  • C:\Users\Admin\AppData\Local\Temp\2026-07-06_ac0e025bcd9708e83136e0f81d230057_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-06_ac0e025bcd9708e83136e0f81d230057_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3332
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:2052
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
        PID:780
    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
      1⤵
        PID:5516
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:3148

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              7zG.exe
              • Path C:\Program Files\7-Zip\7zG.exe
              • Size 27.3MB
              • SHA256 6684e1ffd76399d414c9050cb5d85b99e3b88fbb5654293f5daf210fda7a7521
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Uninstall.exe
              • Path C:\Program Files\7-Zip\Uninstall.exe
              • Size 26.6MB
              • SHA256 21e1afdabf351f21f0aadc96b3d15a13d03d1e8583bb7eb0744bbfaf9119fac5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppVShNotify.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
              • Size 53.5MB
              • SHA256 2bc275d4d0f6e24990d9634dbf9b69f1659a1f21134092694b5e5329a9c641d5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              InspectorOfficeGadget.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
              • Size 53.3MB
              • SHA256 758e894bdf1deb1b5803b4d5f1b31b0414612c03a7dbb7b9828dbb1a17d2d25d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              IntegratedOffice.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
              • Size 57.4MB
              • SHA256 fa387efcdbcd0831c6fa209da3dc4f1c5e63574e28ddfde846ce3c8f65056b3a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MavInject32.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
              • Size 53.6MB
              • SHA256 4387a55e730d5ad88e27d1a10268f852906c74c6de062d5b424455e08532ef80
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              appvcleaner.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
              • Size 55.4MB
              • SHA256 027ac15ad17371c66e153e115d4a57c1163f32ad8d001eca4139a4286c7add6b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VSTOInstaller.exe
              • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
              • Size 53.4MB
              • SHA256 535af61a9c493e775171bc8a9a30f8acc31cc940b467b3c1c320bfa6643b2cd0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrmstp.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
              • Size 59.3MB
              • SHA256 f279e7111db46bf2fb63fb87b1601bcaf1b4cc448213a3c317646c21e1787e27
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrome_pwa_launcher.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
              • Size 55.0MB
              • SHA256 80f5f022315e841898d5bd3d8b51215d382d26d7b7fa492f4708c8cea46ba861
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevated_tracing_service.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
              • Size 56.7MB
              • SHA256 9bc7782a4bda9f0b93dcf10aa6f63ed2ace89ccdb85ba040ce66e0e6bde8d0e5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevation_service.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
              • Size 55.5MB
              • SHA256 941f9049048d57cf5e1590811f937d91df1fe10c55a5b3b733418f54a664475a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              notification_helper.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
              • Size 54.9MB
              • SHA256 e2067bcfe4ad23a64e7a3ec6d16db8843c0a5f6e85e765cfe3e09fa28f972ccc
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              os_update_handler.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
              • Size 55.1MB
              • SHA256 98496d617d38cf405301b922449094938c9c8b5bf6158bc98ce10b9215e38df7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrome.exe
              • Path C:\Program Files\Google\Chrome\Application\chrome.exe
              • Size 56.3MB
              • SHA256 6ebddc9157c992190bf26ae42f12bee2dfe075bdf82a9b641056d7f997f33b7d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrome_proxy.exe
              • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
              • Size 54.7MB
              • SHA256 0436a855e3b6986d6ed34594008151138a410844981033415eee81f11e901f40
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              appletviewer.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
              • Size 53.3MB
              • SHA256 2a756590b6f55001df599e33d0f085bdee4f887e4b717b15ff84950b55106498
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              extcheck.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
              • Size 51.7MB
              • SHA256 5c12902a5d0d6ab87f7ade5fcc40098c22042a636c77af4744de4e0ba5caebe3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              idlj.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
              • Size 50.0MB
              • SHA256 e69618748e2f1661174b81ba623c08c762b29ed77d7e62b765d8b08600b9b7a2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jabswitch.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
              • Size 49.9MB
              • SHA256 893c6cddce6774fe8e695a0fdbbd0f21fdf76d5f9668517024c90be28602c55b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              java.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
              • Size 48.2MB
              • SHA256 650e6debc4dfba74560ae344a6caab122aca43fc8d12d2f5c9e0f632b58f2f7c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javap.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
              • Size 47.9MB
              • SHA256 5fbbb2567b7ec653d8e08bf96b620fd08e90d6bd74455b4957d88261e3b767db
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javapackager.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
              • Size 47.6MB
              • SHA256 1ec9d8ead1cd2a84d9cf1d1835e7c12464533f47e68f50f68fe8c8dbb9b77533
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javaw.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
              • Size 46.9MB
              • SHA256 2860ec9d833f334eeeaf7bd9e21832739d2387278c4f91c9444616da76306e7c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javaws.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
              • Size 45.5MB
              • SHA256 a5e47bc9cdc7f6d7946df5b467eb8224916cd6282d846eedfe24266b1f854906
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jcmd.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
              • Size 256KB
              • SHA256 6adff2403606f3fae51ba272308ce91c8124c63f116c3d886a5a38b4ccbce497
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jconsole.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
              • Size 43.0MB
              • SHA256 35a59fda00b2f31914878bde424efdbbf6d87836910dcf10d88b88678e78249e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jdb.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
              • Size 41.6MB
              • SHA256 dd49dc007956df76dd11eca0bfc4792a038fc5b1110ce850be4cff986ab923a1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jdeps.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
              • Size 41.5MB
              • SHA256 8ee462b668b0788791bf98e75c7c6ebca9e632e0d4296c918593836a11af2cc0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jhat.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
              • Size 41.3MB
              • SHA256 4004af8a5a20eaeda0e0479a0e9e8a1f0788e4d74ef80056cb821e2e55ccb3a0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jjs.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
              • Size 39.3MB
              • SHA256 47b82de78dd4bb66e6c6d4820000ac2d3ee9334d664da278f43e1c84dc5f4466
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jmap.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
              • Size 41.0MB
              • SHA256 52ca353f305c0d80fbbc5ded05953ad57e3eef7147fa74556048caa0004a6a0a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jps.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
              • Size 40.7MB
              • SHA256 19f74dc4895cca18bc9ff705ce5b3fd186af37183779023d49c1d610a8002972
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jsadebugd.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
              • Size 40.6MB
              • SHA256 9cfcac35662dbd223f8e3b42efaab7393ba6113d7d98a5d27e1cee0552616c38
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jstack.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
              • Size 40.5MB
              • SHA256 d420132b6b6a8849745a836477c91e479389cb1db541172b5524b2efe4209a71
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jstatd.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
              • Size 40.2MB
              • SHA256 9421581f6aa2c69631d037b9d87de2d40dde2689882943756f0efc13247dac74
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              keytool.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
              • Size 39.8MB
              • SHA256 a78e0e4b04913bd6e5c9558bd9d8955da66372d9e7f31a61161de3d487fd16a6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              kinit.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
              • Size 38.9MB
              • SHA256 3ed5a9989a6da138f183ff1e6fab56f4320b5406b339ca3a23d5c0009971fa80
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              klist.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
              • Size 38.2MB
              • SHA256 a22d3b5b0a8e398a4c7443676d8b74e5fcb0547a53903e5b5463b295c278b9f5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ktab.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
              • Size 38.1MB
              • SHA256 1577d4a3c9288f1b499ebe85f5cd75d426f92e60e054f4d091dfb37577169cb2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              orbd.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
              • Size 37.6MB
              • SHA256 2de252cc812e2bb06ae9aafef97b3c8c583f042967d4dbbaaf6fd8528c369f39
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              policytool.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
              • Size 37.4MB
              • SHA256 c996dc6bc8fe0fe2937bd12242e1dc18f0962081df75e1c8226625e2b3af5f15
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              rmic.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
              • Size 37.2MB
              • SHA256 796381fa841b0163ea4fb94696b902e04895492134d789ba6790145e7001e4ec
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              rmiregistry.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
              • Size 36.9MB
              • SHA256 dcb864dd297aa4ab37a68b8d33675357fdfefa1e6c102e9f6030a2a976ceb6f5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              schemagen.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
              • Size 36.9MB
              • SHA256 a6da21d1b38de21e4c06b118cac289592cba896d18b4190b0e84ee5631929499
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dotnet.exe
              • Path C:\Program Files\dotnet\dotnet.exe
              • Size 53.4MB
              • SHA256 cb0aeacb195a637f3cff8d678116f9e98b7e49704d62e3b2c4f24aeea51fd551
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              createdump.exe
              • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
              • Size 53.3MB
              • SHA256 85fa20f39b24670cabb615475c3b8df48cc758d1b6a0b7af07fcd73ba124fd89
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              createdump.exe
              • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
              • Size 53.3MB
              • SHA256 177f9d14acc38248e1e061a79738e6514b304acaa5811a8661169caeded7ec84
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              prep_Activatable Class_Hermes_perf.cache
              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
              • Size 599B
              • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              memory/780-332-0x000000000E110000-0x000000000E98B000-memory.dmp
              Download

              memory/5516-128-0x0000018D801E0000-0x0000018D802E0000-memory.dmp
              Download

              memory/5516-158-0x0000018D93E00000-0x0000018D93F00000-memory.dmp
              Download

              memory/5516-186-0x0000018D94210000-0x0000018D94230000-memory.dmp
              Download

              memory/5516-172-0x0000018D83D80000-0x0000018D83DA0000-memory.dmp
              Download

              memory/5516-157-0x0000018D83BE0000-0x0000018D83C00000-memory.dmp
              Download