Overview

overview

8

Static

static

3

2026-07-13...r_.exe

windows10-2004-x64

8

2026-07-13...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    20s
  • max time network
    117s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    14/07/2026, 00:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-13_d4448df5de39fda573d8d17bf146c5cd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 21.1MB
  • Sample260714-aw2awsbv2q
  • SHA256 ecda9a6031bbddab1ff2b53092774ef697e410107468c50961e12be39b320364
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-13_d4448df5de39fda573d8d17bf146c5cd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-13_d4448df5de39fda573d8d17bf146c5cd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5660
  • C:\Users\Admin\AppData\Local\Temp\2026-07-13_d4448df5de39fda573d8d17bf146c5cd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-13_d4448df5de39fda573d8d17bf146c5cd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4544

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 21.4MB
        • SHA256 88001fe16eac01575e0264335c13881ad0363c9109fe182cc0f3375a40874824
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 23.3MB
        • SHA256 721631fa88c975d6e331909480b491ed1021b48133dc80c92439046c44233475
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 48.3MB
        • SHA256 cd56cb395a85f4260f5405c978e5e2c098bbfc1c32757fc417af537e0227c228
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 44.0MB
        • SHA256 7f31a745b5eb680c251917ea4f4cf0167a57e68d84b7f8cd5a481ed9ebd03344
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 45.7MB
        • SHA256 6fb59ee1cd6cd915184ed3fc2b2b2d1e97d65daacbacb4ed227f17c480814f7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 44.5MB
        • SHA256 ee79a7f7ed6444bb2d1d22efd38020f23a69f53b3a25cd9cf2b4b141dab35c56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 43.9MB
        • SHA256 0ebad595e344da980460dd670ec0853c219971bd07dd0c452d9823dcbb27543d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 44.1MB
        • SHA256 663bf02eb234df035ddecbf48a4624778a79216075716d63e7dfb608c894520f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 45.3MB
        • SHA256 bfc93031e4daab846357a8261922cbb263641842f8e070b6ca7013ad90248605
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 41.1MB
        • SHA256 9253d10a307fd19f37e3d3bda406a2b5226fa4c4e04cd43735aed9f7278e8fc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 42.3MB
        • SHA256 0b792befff936f393c09ae823c601373e080f15cbabb7b70f077651d2b489443
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 42.3MB
        • SHA256 b0fc9ed55aa1b5fc842abba1c23924aa0de8102258145f535eb40b46d5cefc00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 42.3MB
        • SHA256 aa0aa2b107d5e9f13d7be79ad3e6bd8a7b980a6db1343d13b9e39cdd1e18c414
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 42.3MB
        • SHA256 1607439627eaf5fe8e8c1d7d2f8c94395c6b3ca853039a5c79609c7252e8ac61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 41.7MB
        • SHA256 3b5fa7913428a63c735d5b1fe9ba82ed9f8e2ea5e43b7efd404d800494ed74f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 41.6MB
        • SHA256 6d95617c1733f7225554e2e47d15cda1ab24a7d0e61bafd66126f36cb92a0153
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 40.8MB
        • SHA256 a7e27d0ba257c4a5b0cb122576e29acaae0fd4d789cf1d7a6df4ba4cdc07f381
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 40.1MB
        • SHA256 b753df1d8f90b63a1829f2a250902dcbd385271c490117cf11111ae744e708b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 35.8MB
        • SHA256 f3e1624a592fb72b5a30370500f33cfc01d8063eb5ee42f89710771b5094d944
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 39.4MB
        • SHA256 8412ac326f69f617fb89a069fc5d8891e42511bfd5f56d59653a3d8b5903ff06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 39.4MB
        • SHA256 b65ed1e654b0210eb6df79bd88fa55416760fe26496933ebf0bf3b37b383e7fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 39.2MB
        • SHA256 faa9e299b4df07386db79ffa85703d6e7b1e234f5f2f8173406927924589bd86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 38.9MB
        • SHA256 7d4b986fe024003330dadf099fd44e85129a9700681aa790c9ba052791c63c68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 34.8MB
        • SHA256 bd16f68b83b24cec06c81182052a5be13d1a0b54e89da5ef65878a3a7d248f0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 34.5MB
        • SHA256 1a91865cb82cdedf79255e44eed20543551f36a91a371ed77aa89d628975fc61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 38.1MB
        • SHA256 3189200728e79244980184558b86cf983cff897d243f4278db26c551bbe278ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 38.0MB
        • SHA256 d331bfd8dae8ea9380e8d8db1757904d095fe23b2e6d6fd69aa918697903e29a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 37.9MB
        • SHA256 a96a259d65d48200dab521278a2b7b36744088837ebf669270afe305e70f934b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 37.8MB
        • SHA256 a726bd681c9bdca1d330b46da17aa020c9d6428c83c4e2f188151ee3d602a663
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 37.7MB
        • SHA256 3e34ff5eb2165db6c227130e349928eb001872c5d86ff52f7ef595c63ebf8718
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 37.6MB
        • SHA256 03f72efb14b5f54db9cf76f9bb9d00a23d8f05d66c4a272c873fc7360d7a8e86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 33.6MB
        • SHA256 300524fc04a656e1c9716764dd604adbcab8a5fdd86b4d0e482b9180cc252641
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 33.5MB
        • SHA256 e349014d44c8d2198eb5facc93d8e01fc66089c1ce90343fac22c2e0a77c3917
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 33.4MB
        • SHA256 a1e9c7318dbd695fcf9146be503a57dc40c9469510ca2141965d3d5489f63450
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 33.1MB
        • SHA256 ea7d367a4ca4fc6a6d7b762ac68a8e7330ecb2a52b4a74d6bf01b9201613136a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 37.3MB
        • SHA256 c5d8486355117e339b311f8146500dde183c02e8c28a767c596638cd60862da1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 33.3MB
        • SHA256 c40bc3a8ff2ef40ae876c2e4ba7d752b1c5e02bf5798ea8c7cd07b01ca020771
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 37.2MB
        • SHA256 249c2de8f2618b7a75dead994329d5a4717f731649b5ef9dc59ddec3b2e19180
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 33.2MB
        • SHA256 a1acd73f9b23dfd6b6e4abdf9e277b1e14d6b85b4adddcabaf3b1cf20700c6c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 37.0MB
        • SHA256 0eee23df7f0401a997df41cf1b9da912ed9db9addc5da05193f261d596c40231
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 32.9MB
        • SHA256 5b096290713e305ad720e4870aa79dae4d1688bd786689e5ea82a8caf2cd70e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 31.4MB
        • SHA256 23b0a4b329173b70842902ec2759f595f97e2e69d039d183c090a317f7923fcc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 36.6MB
        • SHA256 87e58b98b77b3e558fdb97a31d7c90976d98438b61110fa9569cbee81450ad3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 36.4MB
        • SHA256 22f74023d6385df41b2f05770abbf9d23a10ae6c30376c467183b20374a96240
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 36.5MB
        • SHA256 bcbea8f0fa3935a2f0d523fbca5867661b393591d9565e22287110b1bda0a311
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 36.3MB
        • SHA256 5fafb59d3c01b1203329a03cfaeb5d5ea8e4c8e25bbafc4967a2f395199e1a0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 36.2MB
        • SHA256 bac860a93b2b3a215b3b4445e2c48b111d86fb54a40fc133591667217c54717a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 36.1MB
        • SHA256 3567e3334930ecde4ca506909c19e9eccab5f189064018a45967010231342046
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 36.1MB
        • SHA256 4c4bd6a5c5d5ff0654f183f195184df7c77b231d490674c7e6a84a1385991260
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 36.0MB
        • SHA256 6f871b4472912dcb0c751e9f5a548ffb4bbacc8d2057fbf7ee24b19ff7a202e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 36.2MB
        • SHA256 46eefdb9d79dded4c02aa8e89a3623f6fbe88f38deb2e3c81c4b99001f530d19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 35.1MB
        • SHA256 ea106e866b2e66aaa969ccf3afaf4104ecc9f6fbb6c85d462d78a18abd2eb21f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 35.6MB
        • SHA256 5638d741dc23a85bfd790c47e9fc9e6cf6cd82ae3a6b1d1887bf52d677546986
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 21.2MB
        • SHA256 ca76300575e2b984d03ace60a910ed8857e96a9b8d558256296dcf0123963c91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download