Overview

overview

8

Static

static

3

2026-07-08...r_.exe

windows10-2004-x64

8

2026-07-08...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    40s
  • max time network
    71s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/07/2026, 04:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-08_ede0512f5dda9828b75187709f71b90f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 44.3MB
  • Sample260708-emt8faa19k
  • SHA256 8a06db2c5e251b22b9dc715a4e110f1e20b2d9264d88af1046c58168ae4b79db
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-08_ede0512f5dda9828b75187709f71b90f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-08_ede0512f5dda9828b75187709f71b90f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2668
  • C:\Users\Admin\AppData\Local\Temp\2026-07-08_ede0512f5dda9828b75187709f71b90f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-08_ede0512f5dda9828b75187709f71b90f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4468
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:6080
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
        PID:1056
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
        PID:2076
      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
        1⤵
          PID:5992
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k GPSvcGroup
          1⤵
            PID:3324

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                AppVShNotify.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
                • Size 44.6MB
                • SHA256 814de2ef0e23b7618b2377dfa8270276439e599359ffc30171e31dd96c2f900c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                InspectorOfficeGadget.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
                • Size 88.7MB
                • SHA256 a8aacb891b7f18b2bfaad2c1b7709367e1606d19cbcef599ef8b66ddcb66fe91
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                IntegratedOffice.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
                • Size 92.7MB
                • SHA256 125ce665ca3a2e66c3e4de2034258e2a1d4d9aa4f6361662da6654a1dd7235a6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MavInject32.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
                • Size 89.0MB
                • SHA256 94a59916dcb017e9291c19cafd59eea194345cec79469f8e04605b667c24925c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                appvcleaner.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
                • Size 46.4MB
                • SHA256 0930dd20289231d91c88e4197e7297c1feb1496e750cea0ff736849e39983a97
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                VSTOInstaller.exe
                • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
                • Size 87.2MB
                • SHA256 ee5a6a870873ed99c3d291247a27aeef5fa20efa8c1ba880624d3b65271e4211
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrome_pwa_launcher.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
                • Size 79.8MB
                • SHA256 a10b93e1485feaa7424c7073449207d8a748f8a30e6739f473d535c6898b6fae
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                elevated_tracing_service.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
                • Size 78.2MB
                • SHA256 66c5af5eaf00613aec3d8a60cbf90c4ece4903824d443ee4c435e066fa6d8c74
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                elevation_service.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                • Size 76.2MB
                • SHA256 f3181273784a9b621433b6ff638c40677d8c3828e02e5942dcb2305c6b991785
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                notification_helper.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
                • Size 73.1MB
                • SHA256 3a438b78d03c5d20152aedd51b27b563216ec8fb8f8724c77a774e591a7c3278
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                os_update_handler.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
                • Size 75.5MB
                • SHA256 44d9eeda265cfc7af5a7f604ed1cb2b289bef5fafc73ecf653c5c616559ca1e6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrome.exe
                • Path C:\Program Files\Google\Chrome\Application\chrome.exe
                • Size 68.0MB
                • SHA256 7d405149087078afef8572e5ae44700b198d727f237799ea14600d4aa29c67cb
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrome_proxy.exe
                • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
                • Size 68.1MB
                • SHA256 f0302dc6e4ec79475c26efc090660a1108caf829c781d36ce1280b2dbe62cdb0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                appletviewer.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
                • Size 67.4MB
                • SHA256 ac77f8289b709c33dfd35e1101cc6a3a9219e9ff98e22affa26c06084e2d573e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                extcheck.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
                • Size 69.3MB
                • SHA256 e56b03788db0917b08ed7b01bf9b7c18bb9cfd7c7f4ebeac1d563714dd4008a0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                idlj.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
                • Size 64.7MB
                • SHA256 278c2d6107e4978a3dc5856cdc8565a9ed30ed1a48991e881a01e3a509bf3606
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jabswitch.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
                • Size 64.2MB
                • SHA256 41571a1a9214c533791f0a36e739c8e94ccfb910e2f98d5744cf873d4c212531
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jar.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
                • Size 63.9MB
                • SHA256 eb7d72d34c332263e2a259309af699832afb4867b49578d9e18a60308f001b91
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                java.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
                • Size 58.8MB
                • SHA256 abbd87392d77c322f5636e0a8f26c6512f2641b7db112e2b4b1da04355b04f93
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javac.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
                • Size 55.3MB
                • SHA256 fb34d43eed66478ff5f2920f19ef1478d4989671ceefd4521d71e1fb1613439c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javadoc.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
                • Size 52.4MB
                • SHA256 9ff32e716a8d29eabad68f0c11f4fb607839ac0e27523f8759c651d98f521c59
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javafxpackager.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
                • Size 49.8MB
                • SHA256 4bcc75122f3063ee248dc8b9bd517f386cda6e8d7e45009bcc27b0ce039948dc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javah.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
                • Size 47.4MB
                • SHA256 f59a2b1999cace7bc6f4012e3b9a694b26f231007b6a51de7fc8e875994f914f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javap.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
                • Size 45.2MB
                • SHA256 a4ef3b287f015e8108ff75f67606409a2d3a9a16f29bb00284ad928cce4916ce
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javapackager.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
                • Size 42.8MB
                • SHA256 fa67152954a943532181f58c48aea51a25ff17ed850385d16315d9786b23874a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javaw.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
                • Size 42.3MB
                • SHA256 398e0035de6ea7a349f041c297880f01571f3315a9bc05ba4fbc8d47c0f9d44b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javaws.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
                • Size 41.8MB
                • SHA256 70b5b84510a794166f7f5bb035cccb95ede9aa7cec1d6f144dc66d8d1bd960bb
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jcmd.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
                • Size 40.8MB
                • SHA256 fab6bfb652dc4b90316864fd5ba721101fc3ec0c23b90a3fa07ba50d62ff5159
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jdeps.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
                • Size 39.8MB
                • SHA256 c62b934eeb41c29e91f1c1994e06f3283d3a117ab2787b033ec2f6dc1b287f48
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                dotnet.exe
                • Path C:\Program Files\dotnet\dotnet.exe
                • Size 83.3MB
                • SHA256 05c8322d1e4b0de21091dee9f9e171c7bf0d9b238ad37a4af488cba6cb57e556
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                createdump.exe
                • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
                • Size 87.9MB
                • SHA256 f1d091df2a0ab444adb9de27ec051b34ec3096f6f01cf87af3a7d10266b7249e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                createdump.exe
                • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
                • Size 84.0MB
                • SHA256 c2f25913de1c97a47651a6a03357f07ca212e0bce1244bef67c6c0cac9890e5f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                createdump.exe
                • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
                • Size 81.4MB
                • SHA256 a7ba640d34b535840e921fec58a45c594daf4f10f5899fafff923de8bad894b1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                prep_Activatable Class_Hermes_perf.cache
                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                • Size 595B
                • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                memory/2668-0-0x0000000000400000-0x00000000004E4000-memory.dmp
                Download

                memory/2668-1-0x0000000000400000-0x00000000004E4000-memory.dmp
                Download

                memory/4468-15-0x0000000000400000-0x00000000004E4000-memory.dmp
                Download

                memory/5992-241-0x000001EC03FF0000-0x000001EC040F0000-memory.dmp
                Download

                memory/5992-240-0x000001EC03BF0000-0x000001EC03C10000-memory.dmp
                Download

                memory/5992-258-0x000001EC14490000-0x000001EC144B0000-memory.dmp
                Download

                memory/5992-210-0x000001EC001E0000-0x000001EC002E0000-memory.dmp
                Download

                memory/5992-242-0x000001EC14590000-0x000001EC145B0000-memory.dmp
                Download