Overview

overview

8

Static

static

3

2026-07-06...r_.exe

windows10-2004-x64

8

2026-07-06...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    07/07/2026, 03:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-06_6c540693f5584f7739e271481bc58a91_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 28.0MB
  • Sample260707-dpbcnsdy2n
  • SHA256 19836aa42e10f5ba903500546988c197e791417df97b998dafc328135fd87518
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-06_6c540693f5584f7739e271481bc58a91_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-06_6c540693f5584f7739e271481bc58a91_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4076
  • C:\Users\Admin\AppData\Local\Temp\2026-07-06_6c540693f5584f7739e271481bc58a91_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-06_6c540693f5584f7739e271481bc58a91_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4880

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 28.7MB
        • SHA256 1355b324a07a85dad8de02bf065fa79b8de99406b4d8e1c8875106581d9592c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 28.1MB
        • SHA256 9f2508407f19b4b8dbd96f139fb50fa3255bc6bed31ee517ae5f039bdfc8b841
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 32.1MB
        • SHA256 e247ee35ab082d46105db9641711bda454236fd5d9ad45b64fdc1505d8830fb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 51.5MB
        • SHA256 efc6d34b6bf3af0090cd62d93e323ff0c432be3a42aaffa0684df8803838b9b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 56.1MB
        • SHA256 e683a51a5079d3447b31ac5d5455c28f78f89c61604c7d546977601b7aa0a81d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 62.1MB
        • SHA256 717b391e0220167d59971a8278608ea1e7944f8e5eeeda49f7dc4eebbfcd4e6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 57.8MB
        • SHA256 da0d666cefe5e1553f773d5ba4ca879a53b65cd06dd4b80d4def50f05d365bac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 59.5MB
        • SHA256 a3430f31e54e58f78e180242e6deafeffff495af9ca77987e1fe3f44afb10f73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 58.3MB
        • SHA256 eaaa50e524c6499a55bb675763c9b1fedb2b036dcb38b5fa7a130a537d503dbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 57.7MB
        • SHA256 f5666410679e2d0ccd9e09a8e10a87e05ee9e109456e80d57fada18950e89a07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 57.5MB
        • SHA256 ab4d9aa0ee75728be54714a6ceb2d363550a267c9c62d25a2ec1ff81097babb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 56.1MB
        • SHA256 e0d465173b07be5c08794a41f1ee7b2eb7be1605265e71267be7c5db9449988e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 56.1MB
        • SHA256 0f8d2c19fbfbf83c75cb32f5914cd0dcd711cc7300a94da6b08d8d43cad5a082
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 56.1MB
        • SHA256 e073b6ce7519e1a054e4fd6f1970a7badc7723ba111f30183da4212e20913069
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 28.0MB
        • SHA256 565ff4e61a40302a1b4ecccae8f7fb4e3fca56c99cd2dd56843452f9202f6a0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 56.1MB
        • SHA256 17074ede8f397777c5e6fc3b0bbd06763b3eb870de7d772a5185bc37a2f51a18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 56.1MB
        • SHA256 c0c3e043ce85e2b05dbbd81189fe0f73d7ac8870ba09c9664234e5bbaf7c5413
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 28.3MB
        • SHA256 194c9391bd9623f713b577d98ec9f820e4ca093237974e402c9945f94548cfa8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 1.8MB
        • SHA256 f8ec70ee99037cd77352335de133767e98a043bf0f41de3877525d068626cdf9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 56.1MB
        • SHA256 a367e9aacf7aaa7fb1333fc56eeebaf07ec53e37014fcc8cd094045ef8cb0ba7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 56.2MB
        • SHA256 b53823eb9824c4fac0f7f6ded074e24ed37cf0d73fab93f4d13c48894841bc5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 56.1MB
        • SHA256 0586bc35cd2d4206b741f889668615934b5abc2e37585cf9cc1ae1c4b61be95f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 56.2MB
        • SHA256 f510182cf3094dbd7ca7babcd3415590ffabbfb5df0f49741ebcc889b9bba6f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 56.3MB
        • SHA256 37636a8e396b7689d1510f405ca59d2ad3f7193ea927aed9edbc988dcc74e622
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 56.5MB
        • SHA256 b73b8d96eb245dd06f477e522fb104fab9ab1b287b2d307fa614b0e8ab976fb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 56.1MB
        • SHA256 65834771cba8485348bbd4b6ae1d96b4363eecfeaa4baa170dba7f28b74740d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 56.1MB
        • SHA256 943b7a4ecd405d989a2eeb6c73cf7df92864b9db2048abbec1e4a1fd2278ceac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 56.1MB
        • SHA256 c03eabb0c7f42e2d5f9f68dbf0771597a6c5955dd2f756f9be6556b153a4280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 56.1MB
        • SHA256 5c8e1fc95af0665ef5a71d79af31dd8dd0937406d886770deb74af202d039a9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 28.0MB
        • SHA256 e254c6a307b69004231e1bf6fc2e52d1db72a56ca97e130e76a60de071e95438
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 56.1MB
        • SHA256 a88e13c56b8f37aced4af56eee7d0706a687d35009dfd7c5061d7af712ea1932
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 56.1MB
        • SHA256 d1edc6b8954e2fdc4c1a5ba2c90d40b3eee104b91de2c71dbff54b0767822b4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 56.1MB
        • SHA256 0caead49d7595ca73cfee859587c01449dca084b6f206bbb5826649e8c01116e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 56.1MB
        • SHA256 09b2434a273aa56c2c87cb3cdcb742dc1d0765204e86bcf890ddf282098baa89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 56.1MB
        • SHA256 cd3dc8664c76912c4530ba4b5fe8b447597b83ed0d4daefd3cd44896c77e5c42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 56.1MB
        • SHA256 e7c7e9e4092d920c341434b274fb7f9892b7cd7ffdf2557c958b451340308f50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 36.0MB
        • SHA256 de2f7cb2c2c5c7c0fe9d57433ab8acee3e90f391ba6f2353459df1bfa252db03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 4.7MB
        • SHA256 f4024e86554cdc9e92def63a64353ea1d731b95f654f25ec291de74e911bf9bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 3.1MB
        • SHA256 a06ee2a93448ca383da6e6296fcc2b79aa8286b945a2b28d100738f3890194de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 28.2MB
        • SHA256 b261c06acb3c5258c1ff7e8e6ff1ec2473c8e278ff3598afd0999c8007af616b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 56.1MB
        • SHA256 649d2334fdedf6138bf81981454b91ed97ac94bb04a72b2c963abf62e20d9621
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 56.1MB
        • SHA256 1de7928b0962c4aff0c242d441784ad7775eb55e2c04cac46687e147e45cfb69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 56.1MB
        • SHA256 8d3f648c7159698470cc45c0e674f5d04dcb2d0148354f092791f508eff12794
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 28.0MB
        • SHA256 19836aa42e10f5ba903500546988c197e791417df97b998dafc328135fd87518
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download