Overview

overview

8

Static

static

3

2026-07-15...r_.exe

windows10-2004-x64

8

2026-07-15...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    52s
  • max time network
    112s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    15/07/2026, 23:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-15_b32297edea67abedb2b4daa6e632b047_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 44.3MB
  • Sample260715-3fefeafz3m
  • SHA256 17cd3190bf7c8aa3851254fa10a3c1b7fd85f4fe871cd00f5e8fe5970ed1821a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-15_b32297edea67abedb2b4daa6e632b047_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-15_b32297edea67abedb2b4daa6e632b047_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1316
  • C:\Users\Admin\AppData\Local\Temp\2026-07-15_b32297edea67abedb2b4daa6e632b047_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-15_b32297edea67abedb2b4daa6e632b047_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4288

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 44.6MB
        • SHA256 8fce3cf9381847871fe8254ebe44d6c175ab92adb28a402a03a3f3db59e289dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 70.8MB
        • SHA256 3dd12aa6477c5ff432870b6f8bb438e569cc9e5630f0e7385b92486b697f5bdf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 72.8MB
        • SHA256 3983a2cddb6c081eafcea4879ddd0370c2a9c66a3930b9cec8c4f1026c3055dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 69.5MB
        • SHA256 782ef7fbf7d17f23e493fd6bfe4d6561d4ef47b9e859f044721ab6d5ffaa2a95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 46.5MB
        • SHA256 cd2ceae2f6d87d85fced4e260052d3617a7037056475e5b68d2bde7422566d2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 44.4MB
        • SHA256 e04da5ef7f34d041855cb68fbb95325024da3fdd1458ce1fe756e8eed2f12f9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 50.4MB
        • SHA256 c3d5354d7601bc0ce3e85eb4e47d3f6c5094da7ab6e287b60f3749aea0a92075
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 57.5MB
        • SHA256 e900b9195530f019efba996c1072f0b83a39fb210cc96151075d46ff4ac5e242
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 55.8MB
        • SHA256 3af1030835cc6479bc4e0db80baf8af11e533eedcf275281bdc72335386c5a93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 44.3MB
        • SHA256 17cd3190bf7c8aa3851254fa10a3c1b7fd85f4fe871cd00f5e8fe5970ed1821a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 49.6MB
        • SHA256 4c86bd55698dab7dee3904fb7adc158105705d7b51425e8173864d051c433da0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 51.2MB
        • SHA256 ad2cbf092dc4c87c0c05ad4c7cf10378f7bc2a0358d0088715d364e66da18317
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 50.6MB
        • SHA256 a43c3df562289d1a911166d0938b53e55eea5347bf002cef524f13722c6a185e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 52.5MB
        • SHA256 9b18c567267f0264128a498ecab027c94dbe1bed1b8297e34bfd7b3c45c9566e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 47.4MB
        • SHA256 3c014a2c129fde1af5441aca5129d59d12f86b682924963257874d067cda3ee8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 45.0MB
        • SHA256 bddfc3f4eff9c5ef781b017a569ad151be5d274ed6b4ce122076345df990c005
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 42.7MB
        • SHA256 bd49267e248e43532054a12f1b1f4f6a7c4d50d5413b59abddbbdee97eb9f7ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 44.2MB
        • SHA256 a36140f922090f869bc781879f83fa2981a4607190c30a7655fddafcdfff460a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 41.4MB
        • SHA256 721b060e21072a818c4ec0fe95c287c4e2a4f7f03f0cadda324788c59d67175a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 39.4MB
        • SHA256 5ce02011d8a29b64415bbf9ed43628485c2b77c0010cff6165d5cbbed3d53abb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 37.9MB
        • SHA256 036f66987b6e7f727fea5198caed4d3acf2c3ceca54e6e1cccef5d49a8f88d42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 37.3MB
        • SHA256 a6d897d37ab27a5bb729d2c86ec9a136d567b4659abd881e20dd0ec881f4c1a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 36.0MB
        • SHA256 710ab459b9849b2ee214828da704780a85038562afed1f603220a2dbb87da849
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 39.2MB
        • SHA256 4f9fd49b6f59987b6a8913f68e45148f4839a33a8fe3d686481554656e346dc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 32.4MB
        • SHA256 125dff1d5066d9601af2b9273469b0c824897bc7cfa034f9231634bb3cef8e4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 39.6MB
        • SHA256 d4be2324203cf8f933d1fa3e29120ed13893da23706e6a59b418b32191332844
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 36.1MB
        • SHA256 43e2ddba21053aadc32435419ad8103c421007e27b6e0179929c0e48aa10f0dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 36.5MB
        • SHA256 055e98e8fe6aabf8a74f69867efac19bc6e6e897ec64db34b878cb9746d49560
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 32.7MB
        • SHA256 fd21c01e905738200b270d87b056098ce69cc1561fa36c6e6cac1e2b682bd9e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 34.2MB
        • SHA256 6a0925ed60f4f1ed34b856bbf66fb4ab997a242f1729900d48e74a971cc636a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 31.2MB
        • SHA256 222196a99c595684e4ff8ad53d3e4815bd1a8999f763ec09c838a5c431b51a9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 29.3MB
        • SHA256 31ea9bebc15fd1571beeb96cbbb27e47c3728c5502d6392b140dd24807640835
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 33.3MB
        • SHA256 5c0069522fb41575e3015205e9b18f54a10fb77ec86830458106ea0d21920c5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 34.6MB
        • SHA256 80682325b566332913691bc51d61cccb934e8de6769d285a3916e3af136bfc2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 30.4MB
        • SHA256 557ec42121eac5a9bf0676c3a6517570f2494b9ff8ccd359f8daa519165cc5d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 28.9MB
        • SHA256 caf243eff8a843ccf72b74c043c1c3e48ae520448af2551a4749d74fa8944532
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 29.6MB
        • SHA256 c1047fbc4eab29960e8e5aea75097a7bf4411d88cb6be5f37f63a9e61ef99540
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 36.1MB
        • SHA256 2f314150ec41482fa39d8b73402771f83ceaf004e0ed29301628a20985b7d329
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 34.1MB
        • SHA256 ee4f32e185453011664a9e26d3b16faa1713785d45b0984bc24956231ea9dcae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 34.6MB
        • SHA256 ae65a6aec9178bedb705b67891e84f91b8814abc8d0b2b025c18f2c2d3f4988a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 33.5MB
        • SHA256 646cedb119bc3e0035169f4c13c0be56c9c094c532039fc4177a8095d6c93c95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 28.8MB
        • SHA256 346c9fc7d0d164299748c847695e10b4592e6b8d550735c4761e77d3ce2bee14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 32.8MB
        • SHA256 1c152b24d293ebb85ee277979777aaed2d78b9b5d812115befb2edac64f05c47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 31.4MB
        • SHA256 906e60fce8eacca3c114c5047d422d9553087e7ad49fc21921bf4d8ca77ca12f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 32.1MB
        • SHA256 ebeaa0eaa686131bcfc68717744e6ca838c2ccf4cb86351069c7bfea5faf3343
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 32.0MB
        • SHA256 514668f54dc8a2e40db4c9f312e01acda4f2ee9835c1b645cd0a20767bb5c482
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 31.0MB
        • SHA256 d00b885d351d53ca9125aaf43dbe7ab8268eebe34f3a25f2836b602e61b976c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 28.9MB
        • SHA256 c0423002e22e376edf8d73fac4079c63723b20b35ecf6ff5b048273e30cd00bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 27.1MB
        • SHA256 a86c647c7f29d15331ecc4a878fcf751e4c8b301da2b553d6ba09d8e771e70d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 28.0MB
        • SHA256 98f3655d6f3fc8e28a54c7f1f5914154e74a3c1feddf3d2f51cc35efeed4cb3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 22.0MB
        • SHA256 26613759ade63ba77422241bba35855c9d8cf4460361e360455287cea42a4922
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 63.0MB
        • SHA256 486eb94dd19c1da489487853e29b9d3fe10f2e7095e91c7853a867090326d4ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 59.0MB
        • SHA256 a16518eb2976855f48112c1f8300f37bedf51a40fa25067f505256255af90863
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 53.8MB
        • SHA256 79d4e96117cea3771c4ad994f896357c46d996029b9cb2dbb732e7d632e84f19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 59.1MB
        • SHA256 df1fdf2122ce3b67b4c9bacab97bc9ca88ad658a6eb964b23cc0079182ea43a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download