Overview

overview

8

Static

static

3

2026-07-20...r_.exe

windows10-2004-x64

8

2026-07-20...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    49s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/07/2026, 08:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-20_e3cbb356e87bf7f6a6edde0c485f6aa6_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 41.7MB
  • Sample260720-kflklsbw7l
  • SHA256 fc1c88eb743f764a6ca499dbde6ed92091730bcd8c57c5a5d0e11cf07cd01452
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-20_e3cbb356e87bf7f6a6edde0c485f6aa6_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-20_e3cbb356e87bf7f6a6edde0c485f6aa6_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3328
  • C:\Users\Admin\AppData\Local\Temp\2026-07-20_e3cbb356e87bf7f6a6edde0c485f6aa6_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-20_e3cbb356e87bf7f6a6edde0c485f6aa6_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4104

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 42.0MB
        • SHA256 5c5fa8d98be788d121192a960eedb1eab5173df34bb25f9334b37348c6e2d14c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 83.5MB
        • SHA256 33d33fd422eec790441beb897bc97adbedf07c3e00b3de04238245b14e251cb9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 87.6MB
        • SHA256 2d7b7e84c1eb754ea65c5d0badb164b943793e6c4a8355d3908e2f7e7bddfeca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 83.8MB
        • SHA256 d11b78f32a20a139338d5e4d2a4376e263b29b45036a8b831a9cc9dff34889cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 43.9MB
        • SHA256 110c98182ab7bf57a5dd172fe704541ea9e8a635d8d8d87797d9436fa4a496d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 83.6MB
        • SHA256 4e3594cafb103a15f4e27b483501a10b7dfcc7b3b370a42c36b5d39fa271e54a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 79.7MB
        • SHA256 d127bfca5e67a67a517d603d100a56a4aae9feac470da688f27113b3fef04abb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 72.8MB
        • SHA256 ee6656aa87495ae5e5cfb715de93efa6d9b2b0c4453239d5c26082bbeda01829
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 81.4MB
        • SHA256 43a47a27049d2e9fc2f1d5ba9de9e3ae82debff62eeebe18ab1c92075d677e8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 82.0MB
        • SHA256 b5ca40e3c058772394d589fc11b8014765274aaead19de1c2041fec5f178c05f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 79.1MB
        • SHA256 388250e27a943d1c4154ab6f45467a9d52b742914110b65f5f7c44fad4d1bb2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 71.4MB
        • SHA256 97506fba229012fafd6caecb557ae6b054f4c9f428177cd71f0efa14fac5d634
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 70.0MB
        • SHA256 324b3cb36f2caac9e91be172aac84033c6a0077beebd2766df3f7f717d9b8341
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 69.9MB
        • SHA256 b6d8ec7b5e558d84b553743998ab39d99a62648c51d3000188f11a3472e45cfa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 68.8MB
        • SHA256 7f2256a3bf5291a3cebb1d61fd068993f1dd1af63c5b801b514801ad7915e507
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 66.8MB
        • SHA256 18065c1f499e5022fdc616a961c1cc010f49538ffe02d1ebe1f6aeae2b76c444
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 64.6MB
        • SHA256 3a5505d5434b16144e237691fc3784df5f81c6aebd6ffd51081d35312a213aa8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 63.2MB
        • SHA256 4486d8b28d59860950db94e4186b86eb96e4c645ab56fd375ae9bfdf490dac1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 61.6MB
        • SHA256 c158374f1a1f7c18c3a84f1895a3f07ddfdc213b956e99f97b128102cc808bb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 58.9MB
        • SHA256 eaa8c34ee6189c1bb2e4efeef29f532f1c60fce0e96009aca3dccef3520424a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 56.8MB
        • SHA256 d921183fe295f39d6491cf0dc382f8a30298aa5d6139727f7bc4741a535e1d5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 55.6MB
        • SHA256 9b056a8f57e01864a62af642ad9aec5565fbe9aaa460fa88ab5600983a66df72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 54.4MB
        • SHA256 f2aec7873381836cc9a3c949e16436033c0d8727839c2f836049d80325649eeb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 53.8MB
        • SHA256 91ae6d847866742bd41f003c2c42c4c8b92ce58b81f358ff246d696a2ecb7f5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 53.2MB
        • SHA256 a4f67be2c3021bcc20097a03aab9ac859be290296443576aef60f16aaf1755f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 52.4MB
        • SHA256 c7109c512749be3cd7dcb881fcd3fa399ab124f4a82b0f6658ca0b47bdae82c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 51.3MB
        • SHA256 2d2c04d3050407b2505d651ffe1dda7bf109e6a9adc4c7c162cfec1fe8ce2a77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 50.5MB
        • SHA256 4a10c1d213cde20997685472231113c2ae5b445ad01aa60177bc1c272176db84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 1.4MB
        • SHA256 740203a1d339af853dd5bbf1cf044f4fbc3ae3663fefdc734b3e4f3b6b071dc1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 1.1MB
        • SHA256 6fbccd1c35daafe27229b2003f221bc373eb1f43c195b35fbf8c4ab6e1011635
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 64KB
        • SHA256 79a0b1f3b0958e830806c9254c2ba2af079ac99713004febcc3610200c9f504e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 83.6MB
        • SHA256 35eb14188dcf3472db06a69ebf83d5af2ef0c232cf8f8c8676f26316e891489d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 83.5MB
        • SHA256 a78e8600862950f39a03b6f40dd152255e5117fc480cddd97bbc77b1eb48b98d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 83.5MB
        • SHA256 2830a07191c6a17b214dbe16d0783eb9fa891e1e364e93b308715c65aba88ac2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 83.5MB
        • SHA256 124ce6123626ccb0596a59bd5196aa09dd351708b3ccd1a60052052d587eb366
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download