Overview

overview

8

Static

static

3

2026-07-10...r_.exe

windows10-2004-x64

8

2026-07-10...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    36s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/07/2026, 11:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-10_c8e685fe8a7a9474d3fa13deedd50f04_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 31.3MB
  • Sample260710-nl2essav6k
  • SHA256 25d415fa853c609f55ea0d93e91fff307268c4280746e24f8aae6eebf43b7693
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-10_c8e685fe8a7a9474d3fa13deedd50f04_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-10_c8e685fe8a7a9474d3fa13deedd50f04_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2024
  • C:\Users\Admin\AppData\Local\Temp\2026-07-10_c8e685fe8a7a9474d3fa13deedd50f04_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-10_c8e685fe8a7a9474d3fa13deedd50f04_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5068

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 31.3MB
        • SHA256 04fdd8dbb877480c19f4778ee6c41e4ab20fe264d29958dde13fc2291a954d26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 33.4MB
        • SHA256 ec04f512ff2defb830a40e2a8c7d775acf1a435f7985f40a00fe1acd5516d231
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 31.3MB
        • SHA256 25d415fa853c609f55ea0d93e91fff307268c4280746e24f8aae6eebf43b7693
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 68.6MB
        • SHA256 f648a84c2c3c1c2e2eefecc4aee6a452531ed65300d05babdc920f6649022b87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 66.0MB
        • SHA256 f2a760e3661daf457faccf34e2f78f84d7209c85248506026575ca1712deeb63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 64.8MB
        • SHA256 1508cc83246bb5e466e6c405d9dfb76ef1e9d931ae66c3e856f69f833bd5096d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 64.2MB
        • SHA256 4da027a0a3803a6f738950b173c7adfe0058a6d69cad0bdc2a19d9517aa7c84f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 64.4MB
        • SHA256 6bcf727f04e5a9f6beed5e59e3cab59367dc769a394cce35da43dd37573d9e97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 64.5MB
        • SHA256 89e6d3fd69e7ff40597942856e6e1a473f05c4908583fc1562d6b8cb8b627bfa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 63.9MB
        • SHA256 30f9ee431dc02c34fb303b61304bac32bb076f02b47690573aca2d22c70f9026
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 61.9MB
        • SHA256 f448c09af904d2850ed35333d40d9c034aa454d8e9b25f93d9ee5c3428cb0431
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 60.2MB
        • SHA256 82ca11557a47b2f5853ee4f22beb472e3b2c3b81728aee4d6deed6fe058e511f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 59.4MB
        • SHA256 81989808913c73e18fec336e3fb2c7b37f0838b8e35ae7304a768d643d1b0178
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 58.0MB
        • SHA256 b1cd1a33f69e3ef9802c7da904deee243611097e6994540a5c00d79ad231ab88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 57.1MB
        • SHA256 25fbadc91c7f25c79c9116c7caa9a98dfd88ed475afbc1ac40e75fb089c41395
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 55.4MB
        • SHA256 614524bb34dd6b0d2e9a60e44c3721cbd17f7e8294fcb6c18a9a55dc2cd772d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 55.1MB
        • SHA256 9ae054b6c1959cf70cc9e90312a523b4dbeef91f7df7ef15d7562a75c55937c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 54.8MB
        • SHA256 f88453831416a4b60668522a5575a21e51fba8bfae7820cbac8f576c4a6be52e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 54.7MB
        • SHA256 4e56597265066a1732ee2cb489cbdf69b825f685b73f822612252b219b88e4b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 54.1MB
        • SHA256 b067a412e25138f251303f763ad232242882278999b0b0a31c3143a985b74ad1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 53.2MB
        • SHA256 25d2d02b3e4fcfc7f3f4db9837f61dffee6e6c35c65213781f6b318034e6d926
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 52.9MB
        • SHA256 d8dfc31bed32559aba598b08782a08b93dcbf4aa040f156b419e2138efe40e2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 52.5MB
        • SHA256 c9edea01a98b3703e706b39b138ccc8b900b5e886fb89549a966c7bcf528e2a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 52.4MB
        • SHA256 6befa5bc27d7805ccbf303984270bc4fcf2755351dd04a33a04c38a41340bdd3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 52.0MB
        • SHA256 4d2b6bd042d5f01bdc59b6f24e8310980f0474dff4de11c6b368d9d92bd79a09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 62.5MB
        • SHA256 b7bb39dcd66ebdc73cb4d3da1f43eed21bde4da0e9dbcce0df854d92762d00eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 62.5MB
        • SHA256 a0ea1ddfd1402a67b79b3ac3f9c41b24e43c44f589ee3dc74fc950bcce8526c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 62.5MB
        • SHA256 71e0d528055ea3769503cf1ba5b31761a44fb3d97e6767c90bd780b613c8229b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 62.5MB
        • SHA256 b37274f097a8d80340061036bda099cafd3b52489afe33c68b61846fb3e7ec72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 62.5MB
        • SHA256 da110f38db433094cca749fb5ac3f82f43e4aa08362afaf9f1999ddc85884c6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 62.5MB
        • SHA256 6829e2f4c1e9db5424407d89d4df8f39ebc4af747c12385d777ab487859422c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 62.5MB
        • SHA256 ffd3b02505408d889545cb439100f2530966a5f9df252550f1617e1362a7e035
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 62.5MB
        • SHA256 d5ca8b2deebf1f8cea426c2abdbe4f27ac09766b36016159d0f0b210149c508e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 62.5MB
        • SHA256 0096efef42351c591ed04eb7fbe1ade9ce83a0f1aa7e54a147b636329773e576
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 62.5MB
        • SHA256 ebef4174c1b2a03c7c7e02bbb28862f0514c2a138814761d505da1390ccbaed7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 31.3MB
        • SHA256 906fca46df068fbda7a86da6375414059b3a9d8c2091162cac7a6fbcbd54e7c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 4.5MB
        • SHA256 5dffb7604972e58d0873e5dd0aebf30d0df8f91df1aa1a721988122639a5e6e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 4.2MB
        • SHA256 ec7e22958b6bca885142b6a24a21cd57859fd890a160df335e90029cd0db1d60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 4.0MB
        • SHA256 7cfe0144c35c27708d5d5bbe9ee22de86f0f4fc18ce8e758018ea4b79031d8f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 3.6MB
        • SHA256 9176b005b382c9e0ca31f4f0f8b8f14922c3918bd25f5bad63b6957b0275dfbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 3.3MB
        • SHA256 eec1721c899067ba43e848aaa9eb6ef0747d725d700de7b9a1bc0c38064fe57a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 3.1MB
        • SHA256 f4f1838f60f2babba21e57514fd01d79e7bd4ee8ab4f80e044570dc9b9467a40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 2.4MB
        • SHA256 48f49e1d2300a3a32d13b6ca9920a3fb4466e32d03d32b6c732288ae339714a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 1.9MB
        • SHA256 57209fc0705768484aed59cd14284319a1713c40be1e1be28e83b333e3acac98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 1.2MB
        • SHA256 0a13f80796f258f7d84701db250c5131e43116aedea86f0fd377e9157810fe5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 384KB
        • SHA256 144c4713f378ec54938375c9433afb979bcdaf05350d70c3d422e883e7e60d15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 31.3MB
        • SHA256 dfb01e92aca47e40c2ad1ed582c7d22c73937d47817c77882ffa3cf61ed7cd73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 62.6MB
        • SHA256 b3703eae4a917661f9743020f083065279afb98c036bcce097024e39672079ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 62.6MB
        • SHA256 2113ec7c58482c6bcce79089f221498ec7f7d24aa757c093857526fface91b1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2024-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2024-10-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5068-28-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download