Overview

overview

8

Static

static

3

2026-07-27...r_.exe

windows10-2004-x64

8

2026-07-27...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    49s
  • max time network
    157s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/07/2026, 17:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-27_d4fcbce27cd0503e942f0f6c219be56c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 44.7MB
  • Sample260727-vxkdzsysgs
  • SHA256 3ef2dc20aab8050f1a49cd4e86cd819cb9253766053aad92393f3b18bb6d1a90
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-27_d4fcbce27cd0503e942f0f6c219be56c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-27_d4fcbce27cd0503e942f0f6c219be56c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4812
  • C:\Users\Admin\AppData\Local\Temp\2026-07-27_d4fcbce27cd0503e942f0f6c219be56c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-27_d4fcbce27cd0503e942f0f6c219be56c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:860

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 45.0MB
        • SHA256 781750b952597b1ac3dfd508dde6d90d259fa519ea9edd8e3004808e50c3e594
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 44.7MB
        • SHA256 3ef2dc20aab8050f1a49cd4e86cd819cb9253766053aad92393f3b18bb6d1a90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 93.5MB
        • SHA256 7dff90b3867d0a8013073fa78334046e7ec28cae38f4d14204cdb4fd4a4b2ce9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 89.7MB
        • SHA256 5e863b253865e05a84fc11b2f5e22bf160537fd965602bb6672fed9c3bfc9e54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 46.8MB
        • SHA256 d8e8b79004671cb92bd7ee5d94acf6b7a71a6007f6a2107aeb1b5fa13417709b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 84.4MB
        • SHA256 4141422169d2e5b1d729f138755ce233d950960f34ecf8c1c61c3543844c7519
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 76.4MB
        • SHA256 58d89cbae8bd73ccd32d288334d41f9ec67db2c58a02eebd71d3463cf630dba4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 74.8MB
        • SHA256 ce8e9ccacf6b8d9fff32b7f4f1937eaef38d52b2347edd45c6397b1cfd418d80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 73.0MB
        • SHA256 dd6b371e18b7f051ddddb77f7d20923592553b6ca40f40b77cd38a33f528f86e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 66.4MB
        • SHA256 d67689fe0cb5fe3b3cd4123e4e9a93d8664bdacfc6d8399ddc2c0daa1ce297d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 65.8MB
        • SHA256 be5a4229651ee88199db143ba826f0195aeaafad3df8e766631c06abfbd48f42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 61.7MB
        • SHA256 ec58ef59974f4f1d44e30e303157b7c11940d682b08157ea0cbf23c9e302846f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 59.4MB
        • SHA256 171343bcafddfeaff63f60b877a71ffbe5f0c56ea7690e56127ebc7184c95592
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 56.4MB
        • SHA256 ca12f2fd37af4f23ff944ec9ee3d528d6c31a3183700912d982bb45778d61cdf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 56.2MB
        • SHA256 cb880f8b52f4ab371edcaedf414ebf2e8f9b7fde0af65a5fe6d799e80bc519e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 55.9MB
        • SHA256 0e13a3cc72a23a4f75f28bb18e2dc9d47c0cd6f706d5b98d8f323be382bce7dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 55.7MB
        • SHA256 c9873da3b0fa70af7bd263a684fd67df47a2eb4d16c6317732e150637a8d616f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 54.8MB
        • SHA256 4eacc3b83b1299e7105088dd037dc647b1f595767ed70aa280f11de5236709c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 53.8MB
        • SHA256 b94f1c09adf17d6492cc89265b8ac5c172f1e5c44f95b5ce878fd71d1fa27c74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 53.4MB
        • SHA256 94f3c078e813d4620d06c5b2e08c7fb2723794a41842d0d0ff793da61dee56dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 52.6MB
        • SHA256 b98c2e323c1944dac90b8fdd9b2346808bbc0bc5166c1301d911be1dbae16118
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 51.4MB
        • SHA256 3bf2d6a3a65697d771723c2a4b5ee15bf007bf92a87de39f1c64f13f544401c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 50.2MB
        • SHA256 e371aecd29fd7554ada995ed4cb33f770dbfd95d9645411d03a5245c60c4b4ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 48.7MB
        • SHA256 f1e7d7dee5306b5672b4ba7e16d2aa5ebe13521d634988a6e29723f4ac52a7af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 48.0MB
        • SHA256 767929805e702c2f4b6d336355aa2563c4dcf08b0135e384388bd84423263646
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 46.6MB
        • SHA256 fddbd48ff3bc1b8764f8f41314a2939a1db5f21d037226bf5f962ff044fb695b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 44.8MB
        • SHA256 96c0e1aad1c3734de43feecfdddc038e78cc385f9e820232e5e3b6270c55a969
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 42.6MB
        • SHA256 f7f2a72f0cc6d1742cae8cdae2a72ff1f25a8c089290cf0a2a97f68c1c41058f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 41.7MB
        • SHA256 67fac1b8f377cb42d4c7ae733f11ae2bd6a97103462f3291c1b3f1835422b31c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 41.5MB
        • SHA256 860ebb6f5af5b1b4168eae842a4b718124c5844dae60470005a26bf17fd09ae8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 1.1MB
        • SHA256 4d55eaecc9b647df02ffbe87df111e652dd903b3f91f95623ddc9c6902d4a896
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 716KB
        • SHA256 1dabe98bec4704a67a34272faf2158a49283b351b9b4e0f8aa54c6c839dfc08f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 448KB
        • SHA256 30fda89260062596f8473df15f576de632ea44d623bd575d46ec46d32766b91b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 223KB
        • SHA256 9786363b69baaaa0e0992b9a805309fc07347d36eb3e7e4f2744e07113c44336
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 98KB
        • SHA256 9e2d66f8c5cb0412d440997a5951c36b1824280ceae6ffd18fab7c37c2513820
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 81.9MB
        • SHA256 ae0c04c20617f54ba8627233c7dc75a80d73c43492afd84451f7139276eef502
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 81.3MB
        • SHA256 f1576229e8ad20d93b51676716916e6fb30b9c6d9ce7c45dc07df13b1f28138f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 79.3MB
        • SHA256 9c5db14d83385eada721dec232aa01ef291b74877f4f2edc8b25441c4ab4268b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 77.0MB
        • SHA256 ccebd92631252b3dbdb3a1586517a0c81a31f4d56a094d11132f16a9085536b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/860-12-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4812-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4812-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download