Overview

overview

8

Static

static

3

2026-07-30...r_.exe

windows10-2004-x64

8

2026-07-30...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    38s
  • max time network
    155s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/07/2026, 01:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-30_c1d2bd057973c6a4fc62608bf035c3cc_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 24.6MB
  • Sample260730-bk9cssaq7y
  • SHA256 9d07f9fdd2a400e4a49fbe6fe147121654830778843a1268218c0cb990ccb6a0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_c1d2bd057973c6a4fc62608bf035c3cc_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-30_c1d2bd057973c6a4fc62608bf035c3cc_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1444
  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_c1d2bd057973c6a4fc62608bf035c3cc_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-30_c1d2bd057973c6a4fc62608bf035c3cc_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1324

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 24.7MB
        • SHA256 01dc71704e0d335447cedd8c42876f94cd8183fb5771d6909d896764e64a7474
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 28.7MB
        • SHA256 8a670593b4002ee5a3ee7dcd04d844fb3d7c7c98532d9e4ce05d377c85e9f5c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 25.0MB
        • SHA256 7eebf539eb9833aeabc05b73dd63d49886e4e94b9d78c3bd8fad0c1a8509a055
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 64.2MB
        • SHA256 9641774694870c715c4f3589ea570ea1feab08307f581972fce790d3e35e4831
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 26.7MB
        • SHA256 e10bb7ea200d0577f9a6f566e53fdb5e982c4cc69ecb109dbea4acbb2d2af1a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 49.3MB
        • SHA256 ea24b74638b3fb6654c4ada9e48e916372d0e53d121f621b4085a6a715e82908
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 53.7MB
        • SHA256 33c5e45c9fcb1f02406a8b7bbf9729374176e2be8947aaded565b4d0e5c07374
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 53.1MB
        • SHA256 a14838ec474c86608f75f171e127af041c9046753b340348e1b3744506eca8ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 50.9MB
        • SHA256 13097c7471dd8db0082f7d8eb6a87d1fe461051efa0f27af47b4b3320c1a4b7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 52.7MB
        • SHA256 3a3a923663bbb669af9b21467ee1ff7d4acb8400d9a303df55029e966e0de57c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 51.5MB
        • SHA256 2fa85835f0751ec88c9edf256f3d3285c6fab13ab0b2756997ebecdba4921a92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 50.8MB
        • SHA256 a35189e115fed3677de8e445f67a22453dfa75b182b4dd2d1737f483c5923db2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 51.1MB
        • SHA256 17f12445cfd7296346a86cd970d8a62bd5fab3e6165f8dd1b834984082c3ca1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 52.3MB
        • SHA256 399f9ad3a7a80c3abe6b669c9677451f17d10a20a591d7cdbf993dcd521db2e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 50.6MB
        • SHA256 56103fe374cb889ad65103c801d72256a663bdb1827301656a05b493ec46c251
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 49.2MB
        • SHA256 46cac7b9021298cce27d691d8cf8b9fc3bfdd317ec494f1fe1abecb21512807d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 49.2MB
        • SHA256 e1c5ca93eaee4b0d9b08d990cd1434e8c116bb57852c67ab4d1e8f965da0eddc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 49.2MB
        • SHA256 482865833ccaf3cf60251be1b3c7dec8d5ecd19c02dcc3a6bec8d05648738d72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 48.2MB
        • SHA256 140b2f4c07c9e01b33e5db660f325dfabfb73fa3bc0395c367b272994515f827
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 49.2MB
        • SHA256 ee3ab2bc7a6722152dad3789c9cbb1040ac987b1f2b88048b6132dabc65171d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 49.2MB
        • SHA256 7b2bc43e9a481be412521ea05dd912e2a7c8d06bb1e7ad30e5d62930d1bb87c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 46.3MB
        • SHA256 94fbffb0e4d57bd8c4793051941d4b99a3abad3d00cb10ecf9f6f1b1ed620e21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 46.9MB
        • SHA256 00cc1ae204eb4aabbad9faa47ef4a477e71043a08b1a21351cba240feec2728e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 45.4MB
        • SHA256 378f710cdde665c1a2e6f9432067ae4f9d9f53f5e2efe7f871cff6742315acf4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 45.1MB
        • SHA256 528dda3f26366497fca500366c33ea6449ff0b5d86a207791a22759bbfd19d33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 44.3MB
        • SHA256 617bf0a073064691f1512378467c1dbdb712d46c91a86a6b73ce1bfc90a9ec30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 44.2MB
        • SHA256 1a35e5200d753fda63f9e05476c826f97deb668231aa815ac4d855da9365370f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 39.6MB
        • SHA256 3c6d19a16fb6a19799059df2b0f71d9c6d4c1122c23bb75b3efff3e15c19b417
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 40.1MB
        • SHA256 17464cc9da6486410781550ae94012e5db719f268ed5c0cf649e6de8736598a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 39.9MB
        • SHA256 35ec37f95bd334bbd2f264f5beb698e864b928541c912b25374966faf1126715
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 39.0MB
        • SHA256 269b31c3e3ecf035653c1135b8d0dc011d7b492dc84f7af9586a71d71fccf3d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 37.9MB
        • SHA256 18225d660da31b512270fbeb10184163a075c0b4dbc38dc6edf6244f086251f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 38.9MB
        • SHA256 6ec4d6f47b756f3ea63d1866d9f7b16a384688ab1d1c7dda3b901c84966d4f40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 38.5MB
        • SHA256 93bcdc61b7d5f4b89193dd6832f42b4f099852802fb5e6af331c6836f989bcbe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 37.9MB
        • SHA256 1c1113cf2eae4e6ee03e96b4b74ac0646e7749765d9f2031e4c2cab3fcf23608
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 39.1MB
        • SHA256 77b4d5d57de1d8f0033798ee2cf9b390a6cf996ffafece767f00c646d2e963bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 37.4MB
        • SHA256 a3df03cd5883f8076244e09b85bdd8870cf218915fd993a2cb6c62b3e46de3db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 36.9MB
        • SHA256 df1faa6a8e57ac1b92b85f238af5ce27f6b9d2cea4f884e0370f72e31ef5a532
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 35.4MB
        • SHA256 1eaec3250d013e0251e0cdba57bb3a87a4e5580207bd1032beeafe943ba2d31e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 34.2MB
        • SHA256 4a06c2d083dd7ed98b925783117399565a704b2746c096fa296394aed54e50d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 34.0MB
        • SHA256 cd200f57b31116daa45a73375bd75dba73b19e29d3dceee52e2330c5ff8c5598
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 33.9MB
        • SHA256 4488b3f83b683031d55da7ddff1e8304b40fa7364c6c8394825c1394af2cc3e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 33.8MB
        • SHA256 cfb47308bd1f3703cb7811f8cf6a8a6713b82a51b2887b64a84a2bf59bc242db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 33.7MB
        • SHA256 359c43442895731fa45e41d3ca3affe3c34f96dc5a7d00da5bb62e5b05b1f759
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 33.4MB
        • SHA256 9cdda67d9576fc1cd1a354bec67e97a0bf355ab296f09748483f3221be8e64bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 33.5MB
        • SHA256 ee4ceaeeb383f1992cc56589641509ad0de176b5daf524231d4eacb4ca5b65ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 33.2MB
        • SHA256 831f10d02481d6eb7ab352a1d7af256f33f10b6c29054d86ffb4ffb6f04aa21e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 33.1MB
        • SHA256 2495c68e38e02ede9dfce3e90d52578d6f5d8c0dcc816b833e05265cc02e0e66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 32.8MB
        • SHA256 e086010c72963673357b99046964663f5fcc7faa15a8cf7b08580311c9bb3a00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 33.0MB
        • SHA256 51241703db158bf895cb98caf9930c93b589d858556263c80a682cc8915e3ca8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 32.8MB
        • SHA256 14acc88a852bdb23c66f0f5f5b4baff47284e9286bc8a34c68c6a9dbd7caf1ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 32.6MB
        • SHA256 a2ca29db0e439b1a10bb3d66fd983b20e65459cb2d95a08aacea3dacede2c562
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 32.4MB
        • SHA256 0bd58708080e7949e7227221ac61740adfecffc60d60f69299ed5a84ed2a0f3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 32.3MB
        • SHA256 8324dd09706a9e145f5f83a5ed79ce125dced041982c8d1cd811776645ad128d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 49.4MB
        • SHA256 6c12c5856877f13497395fa0fed704843d821fb2b4368b3b9d0db0706ed6bde5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 49.3MB
        • SHA256 a0784e980e0e3f1e34fcda464268bbd64ed9c727a3c8552156b3bb6772f6bc79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 49.3MB
        • SHA256 fc8cd4d98b26f09880ce6d2a37761ec82f48424563bdb1105d5a09dda65689fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 49.3MB
        • SHA256 d6c342eceb288422f2fc42189c4cfd6001ca03d0daecd745743a6b6125803a78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1324-24-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/1444-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/1444-4-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download