Overview

overview

8

Static

static

3

2026-07-20...r_.exe

windows10-2004-x64

8

2026-07-20...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    102s
  • max time network
    116s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/07/2026, 09:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-20_8f0b58501ce5c0d492f2b169640bc9bf_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 33.8MB
  • Sample260720-lam2xsfv81
  • SHA256 d7d46912278a063e708eaa596b869b5db974f69ce1834d9004e2b45bb5b6c9db
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-20_8f0b58501ce5c0d492f2b169640bc9bf_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-20_8f0b58501ce5c0d492f2b169640bc9bf_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4076
  • C:\Users\Admin\AppData\Local\Temp\2026-07-20_8f0b58501ce5c0d492f2b169640bc9bf_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-20_8f0b58501ce5c0d492f2b169640bc9bf_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2676

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 33.8MB
        • SHA256 d7d46912278a063e708eaa596b869b5db974f69ce1834d9004e2b45bb5b6c9db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 67.6MB
        • SHA256 ce44150ec9715228bbb00187a97499e1289da2b8929cac63e24faf0a44ef4a64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 67.9MB
        • SHA256 e861aa9d5017567464596433ab4b53457b321fbf4a23267f592d4467d5f3cf49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 68.0MB
        • SHA256 90231db9797f1187933748e429312102dce95d783daca14cdad4a4e24591f7d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 69.7MB
        • SHA256 1099d37776deb1dd76aa98d38ddf3750b5662e0a439a89f88abc63876aacac16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 67.7MB
        • SHA256 52aab083deb66d1c3346951d2bd08312799cee232d99a49a321873f68eb6ae7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 73.7MB
        • SHA256 b33e49f445d304b9cc3337c7e58b9c0faa92f5d905cec6c415ce5a08fccadec3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 69.3MB
        • SHA256 4f82038b6608db863999cf436890175921da8b2a99713a5397f7e05e8ef547ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 71.1MB
        • SHA256 c1aa4c92f289ebdf2c809af669c2effb73db665b437ec240afc7f92bc5f3b475
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 69.9MB
        • SHA256 8d3d15bb7990803f6c0b6bff5512a0d647070ca8288526d11aa1b6c776aef43b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 70.7MB
        • SHA256 52dbcb1d852aa51d2c9123c9181d8d4c56b0d9ef91ba72ccd0c2fc0b7c56897f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GrantUnpublish.exe
        • Path C:\Program Files\GrantUnpublish.exe
        • Size 68.4MB
        • SHA256 42e52212388ab9ec27998b74d81de21b22f3c890940939f9600f4d3683a3cd06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 67.6MB
        • SHA256 25bdb258858cf186e2e7623bd1955337225da5615a10ed2e69fbc48c5842996a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 62.4MB
        • SHA256 bbe2c947b7f2130593c0c623d2644451a2f94e04f83ba02cd41f9e6b971aab05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 60.4MB
        • SHA256 83c1fa4bf08f66c8b67610b8d9b4f669fa615819fb61720632587a1214db8dac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 60.6MB
        • SHA256 d179228293cc109a33bffda873a435c86b3e6a1b54cb8d3aa565cf88cfe01e58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 57.7MB
        • SHA256 b66d6c767f1367cef3218901ed65b23b96256411055a20b10fd885263e2163d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 56.2MB
        • SHA256 bc2c3710cf500b7473c5d98f7be4a504d66112a2e4f67d66b559641e79789b61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 55.4MB
        • SHA256 efb454517fbef56be0e0a5f5fc0941aed763d9f74ea03552f39a265eeb9f3857
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 54.7MB
        • SHA256 337651e0f45d87454782665b456a999cec1a4e8db3e0cfd469108158d33a5b32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 54.2MB
        • SHA256 f9427ef22bbdf95580efcbf8aea15f7905097dfeb3c5999f819086e23bc8c949
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 53.8MB
        • SHA256 7bb8a5ec8c195971d7657371ca7cfbaac3c0690953de0683c9bf5ab9acf9ed86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 52.3MB
        • SHA256 0801a46a654f192846eea7e087b4f4b8321fe58ba3d81856f8d3f2f5ce492cf9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 51.1MB
        • SHA256 188dcd475272ae9987de5b14c464c62c8f9d8cc8b30233b701d590c62dcb327b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 33.8MB
        • SHA256 2458a93063d5c1d316e0eaf36d4ff044b57cbb6febcd95e1f7c76dd576c22d50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 45.9MB
        • SHA256 205eac924fd019c00a2f72257a7e3f9af6564fbcd7af15dc6768808b3042a0f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 45.2MB
        • SHA256 280f5a982a51d0e34946286732c9989a5ade1981ef59ba8b8c2467bdc1a771d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 44.7MB
        • SHA256 d9e1744d4114c3b9608852673cec17da89c3611d5f6f89b5c3f07307aa42c461
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 43.4MB
        • SHA256 29931f9979e37de70cd73f0ff636209e1377967544884c3b1f2dd67fae70d9eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 43.0MB
        • SHA256 8b31399d936d13ba1ecfb8253186831356cb076fe79f5fa0ed262b785e01e54c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 40.2MB
        • SHA256 bf31e774e5eb8f8c984355aeb6885d50654c3b41b581b3dfa19c13f8bd273798
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 39.9MB
        • SHA256 23358ddc58aeb4e9f93e2c60b49d5083027aa40ce628aa69b98781c8928a5e77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 39.6MB
        • SHA256 0d9a0f1b78d838a7e77727296300ca7302764d486caea6c6ec0449b86a422ace
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 67.7MB
        • SHA256 4766073022186992a5c3b3e5bcb6652666ca65bd83ed4d0b7e0819a5ef3e1b7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 67.7MB
        • SHA256 97ccf466820a810bb4acc3b13cbd214a0fa33481d1af7999b0f5668e247246d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 67.7MB
        • SHA256 e0ffa48a5a80ac2b266eda6fe9de4e764b6fd433d683a8c2d6f867082802eea2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 67.7MB
        • SHA256 723bdcd093062dae0ecad2b7cc0d7887744f63184d3521f9c509d493eff27b86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download