Overview

overview

8

Static

static

3

2026-07-20...r_.exe

windows10-2004-x64

8

2026-07-20...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    42s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/07/2026, 19:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-20_a9cab1a263a36f6b04978cae5c0198c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 32.2MB
  • Sample260720-xpmv9act9q
  • SHA256 57899e5b8daf18a871a7179cae9e1382620f186556616c5055e2aa65987d8872
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-20_a9cab1a263a36f6b04978cae5c0198c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-20_a9cab1a263a36f6b04978cae5c0198c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4888
  • C:\Users\Admin\AppData\Local\Temp\2026-07-20_a9cab1a263a36f6b04978cae5c0198c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-20_a9cab1a263a36f6b04978cae5c0198c1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3340

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 32.5MB
        • SHA256 452072a349d598acb9b6dab8c5e1c8532f002bfaad5ac97ef30ee5c52766a2e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 64.4MB
        • SHA256 520759394162a2992136e898ad840f4878b45bf838b65e1b9a65f044db0052ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 68.5MB
        • SHA256 a618a7ed68641c9df7dea7f0f7d923c4c555915754b9dc9688dc23d6587c9991
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 64.7MB
        • SHA256 ce09a2a36791645844af6d0950c4af634fabdd6a09077203379f79e806b17210
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 34.3MB
        • SHA256 a07fc77e90653ac6195fe0d2d223000171cd031f087a40558f1e92a78d1671ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 63.8MB
        • SHA256 2f3f70fa5217085afc415b995350d2c9985b777a500df0c02ccb1fe40ecd37f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 56.9MB
        • SHA256 5b1abb6b246d57e684596f831c051f976e6cb1de10d36bcdd8f22080e9901536
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 51.0MB
        • SHA256 aaf444844c7f030950273aab1f6ed581674abbf72eca952adc6f0cccc2792535
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 57.1MB
        • SHA256 48a6ff4bacddda65e7e92c9c38a15dc89734a0ba0b833f97c4d641a9a4714338
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 56.2MB
        • SHA256 bd3caac089d6843973055b7cc48fdda83a326066e94d182a562b80317bfb0cf7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 54.0MB
        • SHA256 ab250139abcc6513bb4aceb6bd260c22721ba7098f9acacfec612043a53a10a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 54.4MB
        • SHA256 497ba695c8520b82c85912730e6b4bfe04680e09732dc9b08411ea0d698569b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 53.8MB
        • SHA256 e294a9f349e3601d9404400233e3fd624e6318f486dd0cf7aa03c1c50e56419b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 54.6MB
        • SHA256 a06fc48314fe041ae3fd0d7f538c0c793820b7621d5476b58bc5cb70d51ef3f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 54.8MB
        • SHA256 d962ef805e450ef2bd17dbf7d73ed453e5e52f3e7bd5fc1afd45b6d295ebefed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 51.5MB
        • SHA256 d8c3295964ac8ebd2967e3caf67efacd9c8563ef4eee48f19f79a3283ecf1c6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 52.4MB
        • SHA256 c400e2f8dd87afb76c9ec7b45be01bbfb3770cb1aa9fdad78faa09ec06e47815
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 51.2MB
        • SHA256 3aa935e79d87aba5b553992de2e967cc8638f0faa8f4d44c557ebc213e5a85f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 50.3MB
        • SHA256 db7bc842cbdd255851b4e1d1d2fb94f85784a45b63afac357f9925c00bff43fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 47.4MB
        • SHA256 4b34c9fc0e2b98b62db7262d27cd4134fb1e96c469fdc1a9a0454eb0d6ae6878
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 50.2MB
        • SHA256 dc5062882b0445aefbaaaefd21b6729ba51b8f75bae6d0bb6ee4ea8af1daab04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 46.8MB
        • SHA256 600ce46751737a5c9b4ccb20ede3550e4428a96e38ca76d89ee93825f1891a7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 49.2MB
        • SHA256 74e09bf21b01b6524bc2fb04f2c91901b7b53ec971fad57a35a338b10e230cdd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 49.8MB
        • SHA256 28f1a5a697590a4e23167083e119cf2f80f1491b6a70d2dd9ca27d3022e04e7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 49.7MB
        • SHA256 84f85977bd58574bdd99f0591045f3f641268a117e9aa73e75d506568dd91abc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 49.6MB
        • SHA256 bb0758e9eec379d86c37ff94f2554e18fb24373243c09a697e2f1e6647f582bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 45.8MB
        • SHA256 9ac47bc704e9c3cfbfec6f23e5aac481fa7fc7fc8202a3a5666c2a7894b3c921
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 47.1MB
        • SHA256 6d9d44ba55defda85e6faff495fd9264b57a72dc3e517c02dd552e18bd9a7b03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 45.0MB
        • SHA256 e1e4cc0d7f3be70b92c2d5b5d9638ade5a1c623f993f147bfaf7f99214cac1be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 44.8MB
        • SHA256 b808f2d38fb4bf69c023769918fd256a617db16ca5a23035d95bba685ab85d1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 44.2MB
        • SHA256 913899e5a40a5bbd898f17dbd1a52fbbb5b437762060ed18a8bb1b437b5451aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 44.4MB
        • SHA256 aea9a8446cff9fa6536abf84cb2df376ad12ad1cb8e5ec0118cabfe17d41192e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 41.5MB
        • SHA256 c37dd1dc58793505862b550ae17369e25ca701389182ddbb848c049eaed98b08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 45.2MB
        • SHA256 e9abf12e949e3430de9e2c707f372a03fdcbecd9fcd9a5616e6b089fab4b2998
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 41.2MB
        • SHA256 57358a6315f1457187ebf02790db38053906ad959451a91fe9b81a9b154afbcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 39.7MB
        • SHA256 538e5b9c238e48c933158901416024f63789dd6eac549123e00ad562dcf8c26e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 41.0MB
        • SHA256 ab951c95371462e3e87346d5a895f387d2856524d3216c126128170a4f71e3ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 40.8MB
        • SHA256 99e2e9319c008b694de5192546b5e61a755ec2e46931d44a8c9c0a2509c544fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 38.2MB
        • SHA256 d814ee9446907ce4d0c94b4fb885888b860b15955793363de20020251b678d03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 42.8MB
        • SHA256 e2578b7d0b31ac68fb7e7ba41b3c59799d47d82f128426b47da175c5cb8de17e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 38.1MB
        • SHA256 b5ddc04d36ec3104193f0cb588222b3718aaa3396e6b0df71433a07604839393
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 39.2MB
        • SHA256 c9de5b3b4c4402cf33471bb46a59d432b424591b41f6c03aa3be69f6448a0a89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 40.2MB
        • SHA256 eaa875eb50645e1800911a9b612569fd9dfbf5b8230a2e799356fc4501526b71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 38.5MB
        • SHA256 d793dd52f7be1b8ece00d38f565cf037b6c0869b9eaa55bf105fefa081d60806
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 37.3MB
        • SHA256 fed108958936d64fea165665fc68819a5a240c742924e5d2ee704372229b8cc1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 39.1MB
        • SHA256 580cd223e6f87846ce20daea9ee5276466d77974e07742d6a008a3ebb7ce136d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 35.6MB
        • SHA256 bb466c5b03dd78c754c8200887b09093c19fda8e7a5de7507466806757863806
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 38.8MB
        • SHA256 d7f9cc68d642728199f71cb7b3fb6c622a08e021ff052310910b79292706d090
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 35.4MB
        • SHA256 5e89ae87a97fc34d6cc0d6c73ea70f4cc44cd2b37ba9468f4d5562cb2abb07d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 36.6MB
        • SHA256 8d66994727ae16bd54d14af5f7f12eaa1386f60444ac61946be1adef99eb620c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 37.0MB
        • SHA256 ca3837c45751b49973e3e4ebc5365c368fbb7c386bada3feb09c47c3c2a47627
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 35.0MB
        • SHA256 9f5bac2f7f3724c29b46241506d689b3178a1464dca09e11ad49ece01063c349
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 34.2MB
        • SHA256 afaf6e9a5aa99d9fd3876d4a090a32b30a8a29d80184090a2200630a2247adf4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 35.3MB
        • SHA256 dce265f7349768a50f887972b9296a137d72ba9c9e6f41e5519df0c968996f48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 33.2MB
        • SHA256 8cd02275e4a17b44900a3fed4f77e13b961cda367344efcc84b9dc38bfa2c5e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 63.9MB
        • SHA256 eea5a1c0b4472f0eb826094e79e7b87ead2ab952c165d9171e1622bfd7d0e6d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 60.9MB
        • SHA256 0d679a8ef27d596800bd111d49669b38d6108ad3ee0ed81bbe93d6a89a4e12a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 58.3MB
        • SHA256 562fe26c2da5c430977de76b622a92af51b66d7820eb57db5f121cc30fb1610c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 59.1MB
        • SHA256 8f7642dce90fa386a0f4be4c0530a99c3cfb70b0cbbfdb8ff5ab771e6163c598
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download