Overview

overview

8

Static

static

3

2026-07-18...r_.exe

windows10-2004-x64

8

2026-07-18...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    79s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    18/07/2026, 08:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-18_1a0a6107c1498dbe070ed920f27f8bed_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 41.1MB
  • Sample260718-kmclaaes6n
  • SHA256 870c7df32364767dedbbfa87095fa4494f7ed071a7d1e188ad10f7f8dc810a5f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-18_1a0a6107c1498dbe070ed920f27f8bed_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-18_1a0a6107c1498dbe070ed920f27f8bed_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3284
  • C:\Users\Admin\AppData\Local\Temp\2026-07-18_1a0a6107c1498dbe070ed920f27f8bed_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-18_1a0a6107c1498dbe070ed920f27f8bed_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4880

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        BlockLimit.asp
        • Path C:\Program Files\BlockLimit.asp
        • Size 41.8MB
        • SHA256 7a56ef9aa7f4f6f7f0665e6d93bb48a79005212290b5f27a5b008d2d8220a2ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 82.6MB
        • SHA256 5dc617c4738ea8e3dd3c9845a27ed81beca4813dd6c4cf249734011fd98d95ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 82.3MB
        • SHA256 bd4c1615a9603b0ca75ab8a73c2b7d86c9bb545d141a72264986c099ce67e90b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 86.4MB
        • SHA256 59443cd05611db26fae4afffa948fdb9df82b71c223301c1ccd95bb9df5c1cdd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 82.6MB
        • SHA256 b12f5154c5e8cc9d0deed495f66aba77f0d9e57e8755ec02f4a32068d20c24f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 41.1MB
        • SHA256 870c7df32364767dedbbfa87095fa4494f7ed071a7d1e188ad10f7f8dc810a5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 82.4MB
        • SHA256 4acf1b5ef32049366f3eaecc1d32bba63d9fedb7288272b1359983ea77a7e65f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 74.8MB
        • SHA256 d0f44366c7d09b8c4b1c1af7636eaaca44cf1193b87033c083f57de17cb68178
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 74.4MB
        • SHA256 fe154ab2e18593037b969e91b43a9ed122d165bf13889789f5cb38bdea9dcec1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 84.0MB
        • SHA256 e69f5ecd7c5c510d248a9a98749450158a6511349256603f8e8d82bdb90d1db8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 44.6MB
        • SHA256 4c7e1275028d15f399e4fafd2b4d97cbff28b6002a22d33efc5023a282931727
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 75.9MB
        • SHA256 ec2a1998580e6acdf3a440d075e22ff7d1d56dcf9a2a63a538e5c8fa34d71db5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 73.0MB
        • SHA256 6a3e2dd2452f2fb547de8d76716a98e2de917397d43aea801c9e954170ff4c21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 72.1MB
        • SHA256 670f2beda5c5c414c0bc74b1d008d0ad0115f3436840468d29569314bd338dbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 71.8MB
        • SHA256 7edd1a0991a70b3161eace63af5f0e4a714688fd3e57a593cddd6c434dd66631
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 69.4MB
        • SHA256 6a68ea41639ccb428ed0de47753c9d6742ade2831c4e32c7b27de2e01b6f5c14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 67.2MB
        • SHA256 e91312a0305f68a9cff6c833756d5ed038897d80c751e69eac92bc8118d7e137
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 65.6MB
        • SHA256 aab31625e4373a4259598742d0b85b3a1e8106a89c4b53c19dac3a3fddc0a9b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 64.7MB
        • SHA256 1afd1d6143690a45f3fa71291c77137f9486fa2186ff80a75b81a827e869f8e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 64.4MB
        • SHA256 4eb6a880612234daa5e8d272cec028712d5e96f36957a27474f7e3ebe83b12fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 63.9MB
        • SHA256 1cbc912ecb1a2d15c34358a319728e13f3430af2bcc652dbea9b061f10982b90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 63.6MB
        • SHA256 63f0357c767efcec63e6675cf5640a00d7b0d72410ac2c99d6461aa78977fcd5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 61.8MB
        • SHA256 a09702a5e5ff6521b7525ce7d5c5b7582d668b4bf18aed2ccf6218f196850900
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 60.9MB
        • SHA256 ba012d9e2b095d30550b0bb3f4128773167033fdb2f6596b517186516315d358
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 60.7MB
        • SHA256 c984811b45efc886024d4a38a5d9fe5e9d9607ae3ad2674c290ef31eb42849a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 60.2MB
        • SHA256 00bbb95b29e3b67906fbbafef9f3729de3756b82ddb4312be2b141c77a01fe91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 60.1MB
        • SHA256 156798815297727c61a8b087dd85498f57e723e4b7ad9fa40b87b289c060eb7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 82.4MB
        • SHA256 ed0554384bbafe88a77cedf662f3c35df326b702025635118298dd48f079ae81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 82.3MB
        • SHA256 5e824c8f1800d2e644b8cb5d3d572ffa4b964cf03130ea91acb938b9d0e8806a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 82.3MB
        • SHA256 7c921abcf8deaad6472d351d96a7e8559c5b6d440127321a50177662aeedc0bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 82.3MB
        • SHA256 419505f0dc9618695178c20b3b4cda6418b86003423d0ccad192acc173569b0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3284-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3284-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4880-14-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download