Overview

overview

8

Static

static

3

2026-07-27...r_.exe

windows10-2004-x64

8

2026-07-27...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    33s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    27/07/2026, 14:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-27_0c8473f600a66257cce68037f50747e4_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 15.0MB
  • Sample260727-sb456avfre
  • SHA256 a37e4c8e22b3fec984d7d2d7b354eeb02594ce63d48b5e2996a6d42af5957df5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-27_0c8473f600a66257cce68037f50747e4_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-27_0c8473f600a66257cce68037f50747e4_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4216
  • C:\Users\Admin\AppData\Local\Temp\2026-07-27_0c8473f600a66257cce68037f50747e4_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-27_0c8473f600a66257cce68037f50747e4_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3820

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 15.7MB
        • SHA256 b734a8ae1892c0e228f9207253dcc4b7a17a3402b599c8fa4c4e1457af8ecc1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 17.1MB
        • SHA256 3fd58d6930a7da948557ef1e3104f477869b2d4292f033d1c64309d1970936f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 15.4MB
        • SHA256 a851e4017a10d7526475a5e63421d10c788bdbab588060ef997901e982208826
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 15.1MB
        • SHA256 9b5910bedb92130be149517c74374d31b9e4ef0f456a196c5131614e786f5cd1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 15.1MB
        • SHA256 845b11e657ccfaa33ba4b112a48faf81ebb9ee40d3f57b2dcf3f9d51be7df43e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 15.1MB
        • SHA256 13ea06013a1f73d88166846a480c1dfae06e24bd535e03e811b7cec91c7d5a17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 18.8MB
        • SHA256 eba4ea2ee53c0f418a4332cab9dee885071ddb32e2eefc67a937b830dccb9c66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 19.1MB
        • SHA256 da9f2b3ca9c82fa52a56db7e585ad818349feede334e4536f28ed4ec5cb6e54c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 17.1MB
        • SHA256 27e988dd4ddc4b10ee10b189e18b5b263a8f3117e7a0088f4e9af71216972184
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 16.8MB
        • SHA256 fe5c7c6276a5262d5a43644eeb7ebd902102deb558969080c7a410935bdfd141
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 17.9MB
        • SHA256 202073ad35f1f61e0a6d0ac6630b017a1f25fac0502922e77dde23c1b398dc2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 18.1MB
        • SHA256 f3b13292166da8aa96fecd81d7ac94d32158ac38d03b2cd54358fc844f961172
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 18.6MB
        • SHA256 5221019db7de0a8fdec3acd774f8cb426c2e8c96b29cc3423a05454ecf2b3033
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 19.4MB
        • SHA256 48151ca82cdeb5f56551e3f3d03e62764627e7d9523ede4801a5ad8d6768740c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 18.2MB
        • SHA256 666df4241152469d2f9e48ec1b0daf7b93a1f6920b09241baf6868d2ba80db38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 17.6MB
        • SHA256 89b4ebed241740a808e52f749aaa5fea921e755a59e77854e5dc14e1e9209340
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 17.8MB
        • SHA256 2b77c5b0e1b34eeb99cbe3e36cad0021672a1b3d03f26be46247fe5105bef1c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 16.4MB
        • SHA256 824b34982421fe0a48c9348703129995503708f67ffce9e4054d7750095b7c10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 15.7MB
        • SHA256 eecb37eed025e4276ff16ae55ae7cd12535182556e74ac120cf97e41555fe766
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 16.7MB
        • SHA256 5323ca38625a4504d7b097cb04a78febaf0c0f44e9b6634afcb209c5e0ae48c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 17.2MB
        • SHA256 e8e25c5cb96860516649d0bb980fc8aa15d18febe37a12656b56aa59b9050313
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 17.6MB
        • SHA256 df956cf5bd59b0376b96a86f6cfc9407bfae02562058fde41bf880a4f2743499
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 15.8MB
        • SHA256 f38758c61f13b9eee389dfe1ee3755ef992fb15d83d9aae49804354a389b7f07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 19.2MB
        • SHA256 4df3275cc64a301f33de7d8b49cdb791ffcf967d053b6856d12709055f934444
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 16.9MB
        • SHA256 de62874217aad853cff9e7b12c6881d9ac41e1988b419baa563245c48d5bb929
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 18.4MB
        • SHA256 d7b464a832d706ea914f2d0626766e43643cfb14ab5b0403146efa4f9d86c66f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 17.1MB
        • SHA256 60d3affd4887c399707b5fb08fa05e77bcd27149e9d42f8b7789e11e701eebee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 18.7MB
        • SHA256 498172c2ca9888b50afde8e8d857dfa328f2127b3d5e4b2ddaa16d6f2bd426d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 16.6MB
        • SHA256 3e507cb41cfb82bc6d14ee9ab8d6762854b32e3704001dbc9b730d5da3b71868
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 16.6MB
        • SHA256 6c420ce42c8886f95aa0070af903398281b39d60a8a90082803d716a77d49a46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 16.2MB
        • SHA256 9c059545278c0aeeeceeeb694e8102c139ac1d850ca95292c68b85371f8e78e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 18.3MB
        • SHA256 6ece934b5697fbea4a4822fb7f06594d3e6bdad6ad9929caaf7e4168295d1dd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 19.0MB
        • SHA256 261d1d988321e1c8deb87516e79936a61d4728e8aa35cd413d59a5782b173d55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 18.6MB
        • SHA256 a6a1e519087b79be802c5ecfb6e7e1b27fe8baad681bc8558e65b14eac626735
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 16.5MB
        • SHA256 38d0e5920c776b6478e4b300347ee54c949daf4b16a6dcd08a1b3cc76cbb7f02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 17.5MB
        • SHA256 0ea5f0cf9b893a636431efeb1ee8a8f5185afca71ccb11a34e413e5fc061b33e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
        • Size 17.4MB
        • SHA256 8174624f3d127ef8862d1615a3399dae7b5ca836036d61cd67ef57def777d8ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
        • Size 15.2MB
        • SHA256 035d5f6e1b93aee50cee5c6952f9b213d677864e22a6a93d282d4ae21570cd0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
        • Size 16.4MB
        • SHA256 8353fe873edddc35755b329f511dda6d4ee18becd1747f075973cecf1eab6970
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
        • Size 18.0MB
        • SHA256 39198d6e83b96fa5c1e30dcba016d32581a327808414e207044036da193be71e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
        • Size 2.6MB
        • SHA256 b0ef4723669d48c7ca6cc5d8be249fed04a0ed80e43fa80ef93c9b0fe3cf5fd5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
        • Size 18.1MB
        • SHA256 521a6515a6a41b075658b493ec92bd5bf50f6dc968f5dbf35bff976d5b9853c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 15.0MB
        • SHA256 a37e4c8e22b3fec984d7d2d7b354eeb02594ce63d48b5e2996a6d42af5957df5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3820-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4216-4-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4216-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download