Overview

overview

8

Static

static

3

2026-07-15...r_.exe

windows10-2004-x64

8

2026-07-15...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    48s
  • max time network
    130s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    15/07/2026, 10:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-15_61a0a5b4afa4fbe131fbdcf7d3267300_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 25.8MB
  • Sample260715-l168gscy21
  • SHA256 90a5193a0f0a5ce8ca3352163f11025bcb4821695a32aa0a1bc98f4c18a00344
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-15_61a0a5b4afa4fbe131fbdcf7d3267300_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-15_61a0a5b4afa4fbe131fbdcf7d3267300_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4340
  • C:\Users\Admin\AppData\Local\Temp\2026-07-15_61a0a5b4afa4fbe131fbdcf7d3267300_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-15_61a0a5b4afa4fbe131fbdcf7d3267300_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:980

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 26.8MB
        • SHA256 469e4c48567ea9c1cb97c254f9873adc87d6461824524604a7163ee72ad12168
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 51.7MB
        • SHA256 a89dbb1c5fcfe9a476d97f173e97a402e6db5bd3be1025e7e0b6c6b0952847f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 52.0MB
        • SHA256 7177a43b35eece8a2700fc3487bb7076ae5825055cdb339fd7b9177981aa9d4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 25.9MB
        • SHA256 6a2fbc507ef08db1949790678de7d4db312ad0cc09cb4bf70981cfca93408e77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 55.8MB
        • SHA256 e2500701002d64a1e9250781bc780a7aa057f0dd0d5d3b31a142d8d35b0c03db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 52.0MB
        • SHA256 f7f2d3c519a3a1c06124ea646916ae2d3e8bca269e8e8d82ff12ae0f4856494b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 71.5MB
        • SHA256 fb9ca7082aa2436bf5981ed144598313f6ab58803c0eeb7435f067543ceba94c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 53.8MB
        • SHA256 bb1a47dd3e7c84ecaf23188b8a1f9657aa11f31bee61d0eae46c3f745d0e308a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 51.8MB
        • SHA256 33b514b1cec3ddf4caf138d835ec13bd46046a9f9f97845c3722cee0969b94e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 57.7MB
        • SHA256 22753873223fb71f276c4ee7d43ab283b6755bb79f803a57dfff6e726e4f436b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 53.4MB
        • SHA256 85243929df56c059dbb16bf79fa3c328091caf4bee9b4f620434f93130d36774
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 55.1MB
        • SHA256 74b846863176bb242761b8f0f5b85ed87b9f5bf51256f9207a10482d01bdba18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 53.5MB
        • SHA256 0c960f9a2183fbd0a55545391619ff2499c8b1f5ca7d6cb213ba1d543e899273
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 54.7MB
        • SHA256 e7b1db8c5bb549e4edfa741cc982d6eb60d196e1d52ef0fa7e0bfb1815e0f31e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 832KB
        • SHA256 fa8b9cb29a86f59d8f273b148ff27cdaf09d33b15bbfa2790ba1fd0a9b50a372
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 51.7MB
        • SHA256 ba53d3220ec38822a0fc0f4839608f9719c6d81db82edfb8e842c735bc1a8201
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 51.7MB
        • SHA256 63afc9814581930e40a0ca4f1dc9ecb4216546d510cecbf8956dc342fd6f05ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 52.0MB
        • SHA256 d0c3fd7d2623faa177bce8c6d067158a909c0515ab043661285da536e052960d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 51.7MB
        • SHA256 650643302f036f34b2d6526a2e7d8801cc1dffb16a412697e67b334e37592e73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 51.7MB
        • SHA256 3c254e040acefbd8e50eee960409a6856d6c4f5c3dbafe8b6b474b19197b5fc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 49.4MB
        • SHA256 9617c24a67c9ff6d44ebd10f723096c66bb7d85eee652e926154537fc020778f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 51.3MB
        • SHA256 59f463d8d28d59e4a92f19edc0145f5608977e4945db6edc3f6ba56d9e645a88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 50.9MB
        • SHA256 83fa880e2202b60e9636d25dca1273d1da64ff518f90dafdd2a65a782db3f296
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 50.2MB
        • SHA256 18ff2f9efc4317c6e4641209a7ac3e144fffc083d9aadec1efc7c5bf79961b0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 50.7MB
        • SHA256 a9571fe665aa1ffff2680172dec1c4eeb59a0e51c95acf6e461be245324a046c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 51.7MB
        • SHA256 b8418777799979eacab5eee5201b09539acd8121427eed0fb2a771df4a7b4077
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 49.8MB
        • SHA256 7c9484b4067fc151d7c5d8d226d45c6ec5c41b58f3a34d36b8244f4eecba9e79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 50.6MB
        • SHA256 834b735e879ab0e57d7af9aa673a93ac7e5d94f94976cfd52f42111241a25a88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 49.6MB
        • SHA256 5e2208b18e1d5b7d5c0a07680608baffa10631c9314d321364e839b331934111
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 49.9MB
        • SHA256 ebf6e1706036732cf9ae73c945201999c348d64df8c603cda7891daec4de69ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 51.0MB
        • SHA256 9f71676348a60fd82129b164e937e10d64fa98e72b1ed437039b6ad90ae5941c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 48.5MB
        • SHA256 a544baaec1bf4f253d3c4f9a6c68646fa06e732f912cca381291ecbfaa2f4849
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 48.1MB
        • SHA256 2013778b1da75002f772b384945d4ad4bc6397c4a6ddaa6f2e46d9324d26baf3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 46.9MB
        • SHA256 a2a703c79c4b3fc79fb83d96304517b832b290e0c724f62ed1466059e1b1b840
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 48.2MB
        • SHA256 7d12e01ac7b1c746d3e3b5a76c51fb88b3c47af039ec41629489c7a33c6edca2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 46.7MB
        • SHA256 3b58c2b6519465aa1edcbde232f0f273e19fa95fbb2146ab688f87ef7733bc25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 14.8MB
        • SHA256 d2805105ee978654751eb6061ff707b6c9267cac7ab79a266c8a434e3758c995
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 14.3MB
        • SHA256 6a19f604e2e752eb1af459597a93d52071aefaab7a2166477cbe918c26eca569
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 14.3MB
        • SHA256 10bc25f975893c8a4b47df8abb2796086b9f7de9b54cba1997d40323a9234cf9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 12.4MB
        • SHA256 56bfa7170c5019fb8b0a7d10d00e2acb29a7bc60b928b6fe1d4b8965beadcb75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 14.0MB
        • SHA256 06eb20d911f2b51412430a6ff5c22679d8f2fb154d2f9704e97d034ad34d3184
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 13.8MB
        • SHA256 1bf86670ba7746c5a1833a31e6976d428e745b714ff2456fb9644792b51b7214
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 12.7MB
        • SHA256 9d06a0c347caf057b74804891d3817f4f498fe06f4d934e72deabbbbe018c525
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 14.4MB
        • SHA256 97ddda86f5700aa3427818707596ff83800b808b968b7d828b65bee78bc74588
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 12.9MB
        • SHA256 381ffcf569cd675fa465154b7f60997cfe88afb1111f80507d1e57e501129405
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 12.2MB
        • SHA256 e24657e7c1a8e2c592fa7ab980236b2ecc6d2f9f6070e54644afa95f142f0f72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 51.8MB
        • SHA256 15261097e41a16e18bfe0b07422cdc39bdcbde87c52537faa5eaf18244986af1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 51.7MB
        • SHA256 6cb7a89daf5ea6d3838a3dbf8740c5a0e89c5708d41c011cadcf0504cc4343c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 51.7MB
        • SHA256 c2c5ab45d3e30a8ce8132805282388a6955ffec4795cfa64d58aecfc4e5c4d1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download