Overview

overview

8

Static

static

3

2026-07-30...r_.exe

windows10-2004-x64

8

2026-07-30...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    32s
  • max time network
    133s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/07/2026, 03:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-30_22dbae8d99c5451f4ab983eb349e49b8_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 29.0MB
  • Sample260730-edpllayfrc
  • SHA256 4c7e240c7f562856701c78a4fa009f4f3e2e9e45e5008febabe5f6c9c1d15a14
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_22dbae8d99c5451f4ab983eb349e49b8_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-30_22dbae8d99c5451f4ab983eb349e49b8_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1172
  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_22dbae8d99c5451f4ab983eb349e49b8_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-30_22dbae8d99c5451f4ab983eb349e49b8_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5100

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 29.0MB
        • SHA256 e576f302b0cd6f147eb464376c4357273585b19598aed3aabf90f4c2ba4da319
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 29.2MB
        • SHA256 559af158f7093e6990cda4ebcd5c949e23a40631fbc71e97aaad79790b448e06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 58.0MB
        • SHA256 81bad5fa560d064cbf4ab311622fe869fcefbb74850f2e5aec85a8d98305149a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 62.0MB
        • SHA256 27e7bd85a7615c710760b1ac180b9a621baebd51fb9802185b36fc0e6a1c5875
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 58.3MB
        • SHA256 ceda94412c9eba95e6c82803b71f334c8c43985c5a1ef4661102a42e1dbb784b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 58.0MB
        • SHA256 07f3886697c2c47b3b0f2f50e9f11cf68a16c9a030c6649c3f3a039ca1532c33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 51.9MB
        • SHA256 904049c2b65018333581c5c2a70ab70f65a58b37addfb33a52840a8e2a5fabf9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 50.2MB
        • SHA256 f418816534137c6fb29a49a524d5942eb53d0e63f8e46bc7f69f6720d5e49d2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 52.8MB
        • SHA256 2faa232fe650980544ba034fbbad3110c4ba368156694339d821b184398e50f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 54.4MB
        • SHA256 3ba3d4116e6f4cb70336323455dfd43645347fb333de3294dc707278b4cc1a7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 50.4MB
        • SHA256 5ba6d55e24e4c5a8351278596a74b21da7ebd63d25492c055326110c617a5eac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 48.3MB
        • SHA256 1e65f4b2eb16f7bdc82c947e059c832c88920451d3db6104bc1b70ec096c99d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 42.2MB
        • SHA256 c417267b918b3d6e65bfd780016108e5b44a07a8823dd33c56640309225e394b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 43.9MB
        • SHA256 4c048ce4f7c4fdd21864ac10313f9153c261eec56a61453bbeb64641fb0ab4fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 38.1MB
        • SHA256 cc4c26ede2621284701b87b45aff4c8ca31f82e9e6c9541d900c384f98d100e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 36.1MB
        • SHA256 c54323a26454ecd6c89da08622c4269b6871518f5b8bdb5f7a49fecf9c68550a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 37.6MB
        • SHA256 ad422f55603ebba42a365606171f43fe2dd21db71c0ae4c271b5cf0d93b1c011
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 36.5MB
        • SHA256 bd17583864d01bfc80edad041140d2aa68880ca0161034b3eebb8f5810a2595b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 35.3MB
        • SHA256 2f1ecfd1e1bf5549b8ff1ebcf5b60f67b5499b23e64cf6b23f49eeac9b9a0c8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 34.8MB
        • SHA256 a6eb04c053ff0826845b03525ec525f813dc6d8e7b552c3fb325c40588228e15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 34.5MB
        • SHA256 3f1b70466f193500b8a9b60efde53c7dcdb4a48673e7f20aece77ae041a9d078
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 33.2MB
        • SHA256 135c9909457d65b461be198a49f13dc9e419948ac0d00331a18cd45af7d363cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 32.9MB
        • SHA256 3e104630f38d97663563b75785c7e6e44162928172e820949ed4ff8f7bc92885
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 32.8MB
        • SHA256 667b12fc6393fdec5a588b94672216b4826d5c9cdbdaea76bdad7ce56b784342
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 32.7MB
        • SHA256 42aa909c441ba381fce0352f9bd454e3ece159098751c01d443082dd98c7a868
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 32.6MB
        • SHA256 dae47d3294c2c44ff0bbd9c64258b427f83c46b70d50b45a004babff9fe798b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 32.4MB
        • SHA256 0580a77feb3ad7c8524ddb4b8e90e0637ae0b3227ef11c6ec788832121035ecd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 32.3MB
        • SHA256 8fabdc3b916b0b4a297524e308b73e09da6ebceb4b0eb1610c0a6d83781f5d56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 32.2MB
        • SHA256 d0819fe1a6c348b8a47bd730d4916af128719082cca22d418660640899dcfe8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 32.2MB
        • SHA256 bb8a62283d4dd8b0e2707f280a0a61644cff2e138f167fe795023ceb6a31552e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 28.6MB
        • SHA256 a97d5fd67e4a010900eaefd9e70dbd0c2d126866bd3d3f6f770e4bc03042101f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 31.9MB
        • SHA256 1fe66c4402090c56ef65946e683bb4cef9e1b427d44441e9396272d77dc4e9f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 31.6MB
        • SHA256 94250af77552bc9266491cf8dcf422ed11d4fdbd648ab764ae8a3dbe61f972de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 31.2MB
        • SHA256 9a15d999edee2af771316d66074f373f26c527d8935442e339932e54046b3f32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 31.1MB
        • SHA256 f49a8c901df69a9c3ab03f43de200ec0dee56d5fb9106235f8a032e636a1a1a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 30.9MB
        • SHA256 46d6b0dd363cdaa60a6dfdf71efae8e99409f3faa917d328ae5f569d89242415
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 30.9MB
        • SHA256 ceb37266cd5f55010c7ef4629c74ab684b6b9fd5779189eb2ef1dc235f099fc2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 30.8MB
        • SHA256 e5303b454652cf994e90e82ad62dfc0e207839a71b95dab20d94960faa11be22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 30.6MB
        • SHA256 845be9b636d56947df34f507cf0719a162f2ec8a15945070f9b9dadcfbd29587
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 30.6MB
        • SHA256 99c09cec750965b0b9c6846acd066f5661a574f7661e62daa2f1a9a65a12b67a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 30.4MB
        • SHA256 77ba9651da65bc4776973d99c28ef2e4674d9007300c9690e50d8d91a8a49f42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 30.2MB
        • SHA256 6c3de6ad9e8eb1096ce3116549a818ba233909a477490f4cabbbb6aad4bf7276
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 30.1MB
        • SHA256 fbfff7d934070e8f310f9e08095d42e13b8b1fd678bec1c946c4a515261c0b4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 30.1MB
        • SHA256 9a34a8c812cd841640555cd428c099358299895cd776d8bd6226a30b82de47b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 29.9MB
        • SHA256 035de19e13d6c1443707d5275d15391347179ee3d70062e077ce5d7d432c4fb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 29.8MB
        • SHA256 fa9b0d1d297cde925c2f8edc922b329f1e0817d636e6821bbb2e594ecd17b774
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 58.1MB
        • SHA256 f0a899bee27a1bf3186deed9b169575d9142f050daea3932a42f4f0036d2c34f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 58.0MB
        • SHA256 f11734e42d6c4c0144cb3013f1bec8969168bbaa9928552db5df1e105c83c5ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 58.0MB
        • SHA256 cbf82dcddc038335de283f30c8cf7a50a3ff6ec2d62179461fc673c83213ed63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 58.0MB
        • SHA256 bd103cea3d5f29203840048b9b64ba99651269832502f412cf7d5dac944b2b57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download