Overview

overview

8

Static

static

3

2026-07-20...r_.exe

windows10-2004-x64

8

2026-07-20...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    38s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/07/2026, 08:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-20_e9ea28cd9b3a3b27d225433f2f29f8dd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 38.9MB
  • Sample260720-kdg5ead19t
  • SHA256 ad37e4e6222bb2f63426fbbad6e21b85212df07f7606f5fac086a075663f9d93
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-20_e9ea28cd9b3a3b27d225433f2f29f8dd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-20_e9ea28cd9b3a3b27d225433f2f29f8dd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3240
  • C:\Users\Admin\AppData\Local\Temp\2026-07-20_e9ea28cd9b3a3b27d225433f2f29f8dd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-20_e9ea28cd9b3a3b27d225433f2f29f8dd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:6048

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 38.9MB
        • SHA256 ad37e4e6222bb2f63426fbbad6e21b85212df07f7606f5fac086a075663f9d93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 38.9MB
        • SHA256 15b010bf1d35ce5d0556004ad89f6debc1082bb205fe9cb1de944b366e2d8880
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 43.0MB
        • SHA256 2612886702ed9fa7fe9d53325dfe6b5aed6393b3efdd887135688f0a0729af41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 62.4MB
        • SHA256 b5ac6c1490bf154b496904931dd1ca7fdb4da2e48faa8d368e0c0652df0171c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 41.0MB
        • SHA256 56b00f0fa79d0ad68c67348565b7a63e1250c72e6bc9e65af75ce02a75ace353
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 74.9MB
        • SHA256 df60f8f3bf3096cf1aa71d90f7c82b7c66d1302b7a90cbdc0761b44973ae04b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 66.2MB
        • SHA256 15a6ff5e7a011b851871ccc8dc1045acc60534b148b6efe0e3b6db8e10cfa835
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 64.6MB
        • SHA256 d61c5c24a14b530f6e4c0ce4606b537bac98bbc97785641f9be5b2fc3d822065
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 69.5MB
        • SHA256 a7352b96b212c4127940d0f7084162f1b3ed94bdc29b9abac4b3b2b168fe5374
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 67.8MB
        • SHA256 069016a722a6412850573bbb83d888f7e81460fc78a1d4ccc4833c6b862d1076
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 66.9MB
        • SHA256 8d7752653d89421a6d5e7f5b7a8781f5c6454601f06bd16b3cb2108931a3523e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 62.9MB
        • SHA256 41a02d4da6ea60bfa416cbbb0c7c1279d8b59c8ad2cdc59a86125049b074aaf0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 61.7MB
        • SHA256 35d684cde2eae87d833600b68614f8d5ca11f5de4566c502208e731e34a3e9ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 57.2MB
        • SHA256 5c22f62728e2a23d2043a38ef61971a6ea7a9e739ac0025aa95e907d59c1f0eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 57.0MB
        • SHA256 caa1094cc63235c948fb36f6074cc5c736c05d6bcea77745c9ec0ca811606d4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 55.9MB
        • SHA256 d1cd2c82e65fa384970741691a06671dda99a6ea01400a26514916dde634d87f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 55.3MB
        • SHA256 d7b3dd5e4abc22d9b946b5a92e49e44f2b59d40a82e4267cc02e31f18a2fb1f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 54.5MB
        • SHA256 085cc609ce676f32fee8b260fdb7e3d2a9cf84ebd924e70fe2d235ad0e7629ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 54.0MB
        • SHA256 8e4550f672b0811365c7719180a4880b0b0a5a8dee68bef8c31c9e40783e17ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 52.9MB
        • SHA256 cc731a326fff8755fd3ac9d9408b3923f79a1b8cd007e68df14f540f506a780e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 50.9MB
        • SHA256 38b6ba793c9fa896ed2aa69f82d56cf52df6c8456208eb248a694749e3d29333
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 49.2MB
        • SHA256 bbe354b64b169f867f48d825dcd8d9d776c1fbfd261cd4dd7ce3f31929af2f0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 49.0MB
        • SHA256 b33f260e4fd3a796c7adde3eee741a7d1acc92d2391b7713f25c430279882058
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 48.6MB
        • SHA256 136d39914c02631a0d2124e819e828c1279b4bd9bf63de81a28b4379ee34bbbd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 48.2MB
        • SHA256 cd07aab9645314c519310939cc3aca28f35256d80635d0c7490f94dc1855e1cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 47.9MB
        • SHA256 171745cad75f4a04736b837412401da7f40b5a6dcdeb28b13d86b89df404f262
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 47.5MB
        • SHA256 a19f3da10a71b33aa4de869b2af3009d8b368530f3495ee4ad449767cf9b1a75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 47.4MB
        • SHA256 e0bb4be2e7a675886ad0e19f8d44f0b59f2141b147f90c0e354f2d3391d4fd31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 46.9MB
        • SHA256 ca3c589e459d253c6d67bb051bb453b646569d48dd39ef7c8e1a9ef0c9188ce6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 45.6MB
        • SHA256 816c94b8f5ee5befc3edfd8be0ea5602fc471ab65046940872d44c3d63db3cf6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 45.3MB
        • SHA256 8ce5bdab541b46ea5a3746652de1f12018c61408ff7c8dbcdf358755526bf612
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 45.1MB
        • SHA256 1f236b8d6c7889d91516b270dea64affef773525b02fc90836c5b41434c77d36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 44.4MB
        • SHA256 ff30a9e71296b3406d8b1c4de708370f4306b6a4edb05c982a73e01727c63aba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 44.2MB
        • SHA256 ce87c1ccf8330e5d228d7abcfae027ff4f7f3b5d0629a39ff1390e71b75c8401
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 43.0MB
        • SHA256 91d47d35ecbcc310ec01f02a9d3dd7b39ee7efe7f73f00214be6e551a634dc8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 42.9MB
        • SHA256 3fade6fe667e483bf9913c77285d15086e6a91cb8e7a9ffa8272dcf3e369baf9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 40.8MB
        • SHA256 5e5104326648a73e4bf773bf3abecae831d5c042be5585c2f407fe399e1b1c1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 38.7MB
        • SHA256 ac8d74257ba7b99b55bb8cdc112eb27dcd09231ea11a17ddd06854a61c8a7a65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 38.4MB
        • SHA256 cb87ab6f6e51f5cbecd500c51257fec758340cd27d3123c3d12fc95fe490fa8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 74.3MB
        • SHA256 2ecdda612aea5e99293f454af3d95f21784093f76b72a62e574224c60b239aee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 70.6MB
        • SHA256 8a451b7669aec71b0753960f7deea9d4dc5b8f9e852a0e0ea5ee34f28093046c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 70.0MB
        • SHA256 15fabdd39f5f923c61829bb6276aa0d7533a88211c2bbada989be3083efc6e5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 69.1MB
        • SHA256 e009c9d2eacb363e4bd9cdcad34fa2f1b4ae11ec39d5fd522cc20731ac24a001
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download