Overview

overview

8

Static

static

3

2026-07-27...r_.exe

windows10-2004-x64

8

2026-07-27...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    27/07/2026, 17:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-27_d4fcbce27cd0503e942f0f6c219be56c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 44.7MB
  • Sample260727-vxkdzsysgs
  • SHA256 3ef2dc20aab8050f1a49cd4e86cd819cb9253766053aad92393f3b18bb6d1a90
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-27_d4fcbce27cd0503e942f0f6c219be56c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-27_d4fcbce27cd0503e942f0f6c219be56c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1608
  • C:\Users\Admin\AppData\Local\Temp\2026-07-27_d4fcbce27cd0503e942f0f6c219be56c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-27_d4fcbce27cd0503e942f0f6c219be56c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:560

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 45.4MB
        • SHA256 1098596ddc7f24904e804871af6b14cafe388a569c4e6c74905d9603cf9a4171
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 46.1MB
        • SHA256 494da213430efee8db5f411d94dee9c7d8fafb36a441f86abac3084cc7208d6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 44.7MB
        • SHA256 33609ca54556fdf1a999103b9574ff375505ad6d821038c5647f3bbb6be224a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 89.4MB
        • SHA256 4c7187f7eac7200196eee5e389d95ed5ed263ea27d9f1041203a36fc1b25dbb9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 89.4MB
        • SHA256 52e48502b892880e7ed827fe4a554ec7ee50f7588132a63377975c8f7d490f49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 89.5MB
        • SHA256 d07079cebd1c4d66cdaed37f408ddbe7a7e90fc5ad8660dfe3551d898aa7be5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 89.4MB
        • SHA256 226f52084808fdd87de9a5c2d4f2c41f09e753628c5e8ebed847d6d5b1a1ad36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 89.4MB
        • SHA256 34c0865f9ca1e730a293b107e87444ad34b6c40328f50c5657fc3b883501b4fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 89.5MB
        • SHA256 90b3781e3972a90438356eb3d56f72a436c5bc173aaca884340e498aaefdf1b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 45.0MB
        • SHA256 90755c153a60719d3e7061d7462ecfe08bee611697a0e5680bf884a992811a55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 89.8MB
        • SHA256 4a6145ef4ac95adb9d2a3035152aca29823a55dd0eceb59681bfde968f4db0ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 89.4MB
        • SHA256 b4417f16080b3ff5189c84c3adc48fb650a8736732075c54ee78e4a1dca0e81e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 89.4MB
        • SHA256 546eaecedaf16a0a72bc3a0f62b48fc26b6a396431105140ddc298a8664d9141
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 89.4MB
        • SHA256 460b51b54ccaf915d8a09b954a94f015ba140d3a0526651af44376b1576da5d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 89.4MB
        • SHA256 a28fdd245f1980b253b9cb62c65054349e7bbd169d3a92066089a19a65ad5e05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 89.4MB
        • SHA256 ecff71c9cc117eeb5877a6a3cc9dc41ef9292a0463c108de812640e64bbcfa8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 89.4MB
        • SHA256 edb94fb4891dabc19ae5a28a6ed5f049ac00bea4ab45b13483fb50d16c9308a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 89.4MB
        • SHA256 547d9c922cc167b02b4407e2685aad8ab216e05fb1ccd158fafb8cf9eaec3572
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 89.4MB
        • SHA256 ef2dc3d04e7e666fc9bf81353298cf68740c587714a5615de36e27a00d0a6f23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 35.1MB
        • SHA256 000f7f82d4566a8165210069a4c2a0a68d1911113b8592df41be50989cd8fbf0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 34.9MB
        • SHA256 a58e0e0948cb5afbd6b06d5498053b2c5cda4e837e3545be60e3cb3757e3ad76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 28.5MB
        • SHA256 791c2bc72b016d900ebe9ecdbebe8fa9f4dc8369a5dcfe6a2934db552f9b5bed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 32.4MB
        • SHA256 0d7a35c2c8bdc7004310f4c32ef54f6ceb77f6fc43c5368c591782d74cb9af59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 31.7MB
        • SHA256 c9f3c45b91aadc19944b6f46f1379ac0cc615eec3d2ab05bbea4164995feb3a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 31.4MB
        • SHA256 ff7eeb707734fabf98c708520b17e8247d51a67e81399a0bb10beac9bef26aa5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 29.5MB
        • SHA256 9222273f3444e16521056cc70de5a5a42be2c4781f1ba01c478fa91c41f0ab1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 29.2MB
        • SHA256 4ab5c44a0a1210953e3cdb3c97e8f551f62fa5b17174d2846b2412134604cd71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
        • Size 526KB
        • SHA256 e8085484374a274b066c5a0e9ea5e57624e54549e890685a7f7b079952eefe23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 44.7MB
        • SHA256 3ef2dc20aab8050f1a49cd4e86cd819cb9253766053aad92393f3b18bb6d1a90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/560-6-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/560-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/1608-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/1608-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download