Overview

overview

8

Static

static

3

2026-07-30...r_.exe

windows10-2004-x64

8

2026-07-30...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/07/2026, 01:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-30_c1d2bd057973c6a4fc62608bf035c3cc_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 24.6MB
  • Sample260730-bk9cssaq7y
  • SHA256 9d07f9fdd2a400e4a49fbe6fe147121654830778843a1268218c0cb990ccb6a0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_c1d2bd057973c6a4fc62608bf035c3cc_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-30_c1d2bd057973c6a4fc62608bf035c3cc_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4112
  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_c1d2bd057973c6a4fc62608bf035c3cc_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-30_c1d2bd057973c6a4fc62608bf035c3cc_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1268

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 25.3MB
        • SHA256 95bcb1ae0a92062f6ce2703676e5c7caa33216339737616c4edc0f5ed2bef0fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 49.2MB
        • SHA256 aab942aeeeb5948ed8a5669fd38de30ffdfacb81aebc13631b14b84bd60f8f2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 24.7MB
        • SHA256 01dc71704e0d335447cedd8c42876f94cd8183fb5771d6909d896764e64a7474
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 53.3MB
        • SHA256 f1423bf1643e2b1fbe06ab8f35d26509b193e2eb55b0ab6bd2c4c0e9582d30e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 49.6MB
        • SHA256 e98d2aa80642744411501452ff429a633467cfc5d79da2b97ba2034fbfb3cafc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 72.7MB
        • SHA256 38d03394c2faab79659c3b08e4e3e5d42d6f509cfeff2aff877dc4c3d694897f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 51.3MB
        • SHA256 b9b52e1acd5a453b6d7dc4719046f76f65a0e899f2b85ab0ffaca3db84cf7e3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 49.3MB
        • SHA256 ea24b74638b3fb6654c4ada9e48e916372d0e53d121f621b4085a6a715e82908
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 55.3MB
        • SHA256 754dd06e0cadbd3ef161f3375ce2fd56b8157732da4df5031263f3fbc864256a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 50.9MB
        • SHA256 13097c7471dd8db0082f7d8eb6a87d1fe461051efa0f27af47b4b3320c1a4b7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 52.7MB
        • SHA256 3a3a923663bbb669af9b21467ee1ff7d4acb8400d9a303df55029e966e0de57c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 51.5MB
        • SHA256 2fa85835f0751ec88c9edf256f3d3285c6fab13ab0b2756997ebecdba4921a92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 50.8MB
        • SHA256 a35189e115fed3677de8e445f67a22453dfa75b182b4dd2d1737f483c5923db2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 50.6MB
        • SHA256 56103fe374cb889ad65103c801d72256a663bdb1827301656a05b493ec46c251
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 49.2MB
        • SHA256 46cac7b9021298cce27d691d8cf8b9fc3bfdd317ec494f1fe1abecb21512807d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 49.2MB
        • SHA256 7b2bc43e9a481be412521ea05dd912e2a7c8d06bb1e7ad30e5d62930d1bb87c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 49.2MB
        • SHA256 5450d2972f66bdc1200eee8c952d6fffd3a24040092f9c1635a57d422ab606da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 49.2MB
        • SHA256 af7441fd2f194a37ca1bb7242f87abc2a0649bfa381ee3eda84551ea860f434b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 49.4MB
        • SHA256 6874f7db718ad33e8fb4d2d61847ea5cebdee8338aafcc4299b5e64a240fa4ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 49.5MB
        • SHA256 8b81734e6048aff0697b5e1ab61d64ca6146c3bcf73ed2b9649af6ad1ea81156
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 49.2MB
        • SHA256 b19ece3079b1a3df53a49f5b6ea2821489e5306aa7ee6384ab317120c46bac25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 49.2MB
        • SHA256 0503389d49b3e0578812d9c4df0fd9162f25a3ef2362f9721c8c6388adb2108c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 49.2MB
        • SHA256 bbd7c99e295b1028157c3839bad8e562af9f0b93f94571232a7c23c943847a13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 49.2MB
        • SHA256 9cadd218365c34504aa2d7eb3c73d651549696920d0a355edddcf66c0a2e7039
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 49.2MB
        • SHA256 4d52044153d1e9e6cde70a2401f9b2be23b0644aaea13292657f426cf89fcad6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 48.9MB
        • SHA256 7c2b1fe4b596c2e495d4ca1fb0dd8f95af03f41aa44f7eeee63ecbdde46c0149
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 47.1MB
        • SHA256 a0470f295ae56ef51432d277958e38817c4ebbf73ce664881c4e60ecb0b2d931
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 46.2MB
        • SHA256 32119f8c1556d9c736603c806c0d7a4d967252621dd425689d3ef2cca70292ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 37.6MB
        • SHA256 23f2184d1018ffd2bcee145e0fca6e224a8af0b7225ba157a238eb636495d250
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 33.1MB
        • SHA256 2495c68e38e02ede9dfce3e90d52578d6f5d8c0dcc816b833e05265cc02e0e66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 21.6MB
        • SHA256 b7e2583ca4b4f18404f3d9b4c54b3414075acd73418a66b3539aec1be1b252d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 3.1MB
        • SHA256 57bf6ed75212758db71883b6e23bad622a681111c0e304cfd6d34903c431372f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 49.4MB
        • SHA256 6c12c5856877f13497395fa0fed704843d821fb2b4368b3b9d0db0706ed6bde5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 49.3MB
        • SHA256 a0784e980e0e3f1e34fcda464268bbd64ed9c727a3c8552156b3bb6772f6bc79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 49.3MB
        • SHA256 fc8cd4d98b26f09880ce6d2a37761ec82f48424563bdb1105d5a09dda65689fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 49.3MB
        • SHA256 d6c342eceb288422f2fc42189c4cfd6001ca03d0daecd745743a6b6125803a78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 24.6MB
        • SHA256 9d07f9fdd2a400e4a49fbe6fe147121654830778843a1268218c0cb990ccb6a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1268-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4112-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4112-4-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download