Analysis

  • max time kernel
    148s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/07/2026, 17:49

General

  • Target
    2026-07-30_4272007ee77b4547e025713cb2c2feeb_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 7.1MB
  • Sample260730-wefthsdr2w
  • SHA256 da881e9d1e872e6af6af176013b54dd20e7ed463788bc4b7ebfe4ed5ee6b52f3
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Control Panel 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_4272007ee77b4547e025713cb2c2feeb_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-30_4272007ee77b4547e025713cb2c2feeb_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4304
  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_4272007ee77b4547e025713cb2c2feeb_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-30_4272007ee77b4547e025713cb2c2feeb_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1652

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe

        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 7.8MB
        • SHA256 f215dd611e4ba29b18662c1dd124b2ac26224671a9dff1a75d12ad96fd71f6c9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Uninstall.exe

        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 7.1MB
        • SHA256 2fb019a0a7a594676fbbfaed86b9c364aca709f682bbe8bae534352b13ffe0e4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppVShNotify.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 14.5MB
        • SHA256 f4cc888a7112d8b8afe559445a302d41cfc5331416d5297a041b405afec4f591
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InspectorOfficeGadget.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 14.3MB
        • SHA256 6ae5fe80f3d9f2b968f33a4810b568b1ff2b21fbcd35de9d64fb41f7f9c00de0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IntegratedOffice.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 18.3MB
        • SHA256 ac598c1ff2593279014f8dbb038f587fe1599f0833de8e0259385ce6a59206c0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MavInject32.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 14.6MB
        • SHA256 2791224b00ecfc362b0b2f35e55aaea256799bdb8e4044de01d393fdd5da2aff
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OfficeC2RClient.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 37.7MB
        • SHA256 fc5aea61e324fa29d7a34f1cce22f260bd22fde7abdfc61689ed7fd894c2d61e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appvcleaner.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 16.4MB
        • SHA256 3919ca18a36c9aba4691357f27d2eda34e1c142c560fe61ecb0d6e5adf91a0a1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VSTOInstaller.exe

        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 14.3MB
        • SHA256 c09183689df5ed5915bc68c9e1d8384f0a424dbbe2bdc3951cc0adf4ab5fd822
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrmstp.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 13.2MB
        • SHA256 ee585ba0f951c1c58f34d6bc26a267ac3f89857fb193129ece2aadd5016059e7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_pwa_launcher.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 15.9MB
        • SHA256 46e6bbaaf249313dddccc5dc27d74763e33a9b761e147e2bc6cd9a7653e51d16
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevated_tracing_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 17.7MB
        • SHA256 9e0d0578970dd35cd12e08e0459eb1228898bd0eaa10fe971dfcdb42e6c056b7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevation_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 16.5MB
        • SHA256 f3800567e061b88854111fc5b14087918d939639a5834ca51da50e195cbc0d37
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notification_helper.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 256KB
        • SHA256 6adff2403606f3fae51ba272308ce91c8124c63f116c3d886a5a38b4ccbce497
        • MD5 SHA1 SHA512 SSDEEP TLSH

        os_update_handler.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 16.1MB
        • SHA256 26e22b1917ffb81d44e3b2fc5561ab232f307f609a46d8aa33d9e4e60398433c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 17.3MB
        • SHA256 675902feeec9dc58c9853177b42784ca35723f67098d3b7f4e16e46d407d9625
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_proxy.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 15.6MB
        • SHA256 5ec67e0025bfffba9c33c8a93c524dcd8b75c4331f7daa6b0eb5da0bfaa0bbb1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appletviewer.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 14.2MB
        • SHA256 5f47975af42c5b66386073af86b20af22aa45ca694424fdb2ed8d4a7771ba9db
        • MD5 SHA1 SHA512 SSDEEP TLSH

        extcheck.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 14.2MB
        • SHA256 1f67e40ed6daf8ee28ca4e7e06d5407a640fcdbf9264191e8a0e641d20f5a70e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        idlj.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 14.2MB
        • SHA256 dc26c60a4aa7f3bc04d7e8f8b9eb2eb8d4dc34449444525488b4108bdd309bc9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jabswitch.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 14.3MB
        • SHA256 031957e4a0a709eba2239fb9ed0dc1dedcd3e28c564c4f7fe73ff4fa9d4baeac
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jar.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 14.2MB
        • SHA256 4f8c1607d83ab4700c83812b4d43a23181e270a2c51dbce79af1b03935c893a0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jarsigner.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 14.2MB
        • SHA256 fb35fc36d43124560cc943be13c7f3db951cac986895b2be0f02e62fd6a7d607
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java-rmi.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 14.2MB
        • SHA256 ad2b3b53b9d1c6e888a16103b1e5137c159e3626d4548fa8b8c597f2977297c6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 14.5MB
        • SHA256 41453cc66c49e51f2bb72ae976f0a1a9e74b4e90acb328b9f2b0a692b62ec721
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javac.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 14.2MB
        • SHA256 17ffa2ac20b96ec4ddc2851928bbee2c553642765efe9ac31efb194f85f6ddf6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javadoc.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 14.2MB
        • SHA256 8cf1868adb4c1a126ac1ea1440b97a35e9729e64e3afffcd2adef250d1a968df
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javafxpackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 14.4MB
        • SHA256 2b0eea52f45c292ecc08b5d8b59dbbbbe8f24811a3819e8a8b5fd384286410b2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javah.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 14.2MB
        • SHA256 8282fdbae1eb3412c59d40c063d3efb334c970a75cf404935110ff5fbc8fc510
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 14.2MB
        • SHA256 f0982d09aaf7ef2f8db4e97d920abeaa44973d5727b5247e70972984935d5600
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javapackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 14.4MB
        • SHA256 f9d3bfafa47ec97a1743b708e8c5ba19dce23c6d9b77c23597bc84ab749d0147
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaw.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 14.5MB
        • SHA256 7e68208155b7ebc7f9d3f209d484b46b0087ced04ab50430f075956824300ab1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaws.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 14.7MB
        • SHA256 69c104a042d65f9459b984d7936033fef0e6ad6332cb7e09f6a818442461e9ab
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jcmd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 14.2MB
        • SHA256 eae56c236af8bbe79b9a3303675d4354627805caee5d7584e5e8389df050d8b5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jconsole.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 14.2MB
        • SHA256 7b25859474a4abc0b490f8c99d20adbcecd0f1a7d6a03f45f5a8de49fcacd46a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdb.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 14.2MB
        • SHA256 79befef52e13206470b22c95532ba92d02f12323e03b4a7de7fab8610172d576
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdeps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 14.2MB
        • SHA256 dba77e958b49cd8eaf0ca4ad07eab8e9859fbc63d60747cbd60b232daf8c65c9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jhat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 14.2MB
        • SHA256 80823259c590d32c3d1223e7b302e66260d812f6dbee2c4d7c8403966455b1ef
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jinfo.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 14.2MB
        • SHA256 806be467d3d8d3fcc942cb822cf87ddbfa45d2e64ff9f16fcafe9ff0a1a14508
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jjs.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 14.2MB
        • SHA256 3f94d9dd06f30758edf7c3ba996270992412aa3d2fb20f4980adc8c24ea4b366
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jmap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 14.2MB
        • SHA256 0feade0d03105466dfc8ff873affdc7e8883d8c3667d6818d24facfeceacbb04
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 14.2MB
        • SHA256 d73c245ac6a2b7f989321e74fcfd6956a91bda6e7deebf14a7f667547f55413d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jrunscript.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 14.2MB
        • SHA256 60c78e648641717e7d9cc39bcd6dfd2c9e28551717bc964d4f7533c0d30c2a40
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jsadebugd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 14.2MB
        • SHA256 55a1809f1985cc3e3fcbae537c565747862b5c1127853591fda76d44f952f5d3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstack.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 14.2MB
        • SHA256 d4554e254d225fcc2a105bca3d23e10808fb3b886081f774fdf421119ff0b569
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 14.2MB
        • SHA256 726b5f9e393ee5352000a189de28905acc6590e2d3ada44b7e5031d8fd39da5c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstatd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 14.2MB
        • SHA256 53ab0801fa09108e70535b2712e3d25537c394ad2fc9b1954e187add6248bd87
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 14.2MB
        • SHA256 fe5eafe02e369a5ab653fa3781484b36756e8da9b7c91c35c2289dce04d994ac
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kinit.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 14.2MB
        • SHA256 dd59e5ad57833c22256cfb36eb962757abbd06e420bf3858d183e14250e11282
        • MD5 SHA1 SHA512 SSDEEP TLSH

        klist.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 14.2MB
        • SHA256 f329658b2b6f9b41869d5e65bf181c7e5d93fba0fc7780c0bcf32fa22fb75f96
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ktab.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 14.2MB
        • SHA256 9bf7d4702010225f11b5703756b85bb0861fe0268167611a5643380a573f57c6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        native2ascii.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 14.2MB
        • SHA256 b7c5193cdca09641118097296a9a3c4e81c034894cc197c55ee3407bfefe4244
        • MD5 SHA1 SHA512 SSDEEP TLSH

        orbd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 14.2MB
        • SHA256 19b346e6aa5ee6561cdd66cbffdb2a7532c877a445b58866aa6a9c82b1e86620
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pack200.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 14.2MB
        • SHA256 bab9f04d1d0097c9ced3997f65fcf060a556531cf5c6162e7431657b92852fcb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        policytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 14.2MB
        • SHA256 b92afb350156dde6648c2de52af101bd6650d5ea4dc51c59d22d52b545d41464
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmic.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 14.2MB
        • SHA256 031519f8475687a266839fb1f43b3b8289bce7bd5024aac19520b35294f002ff
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmid.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 14.2MB
        • SHA256 853b4a859f75ffb0ca5bae9f4f7c987206eec550b724179c5d512b3a7d6442a4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmiregistry.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 14.2MB
        • SHA256 a9beb4dbf7502e94d26f1fe183874380ee6c65465cbae261b896aea156075909
        • MD5 SHA1 SHA512 SSDEEP TLSH

        schemagen.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 14.2MB
        • SHA256 3e74792fdc1b3024329e275c278f2dc8a72a40b399bf62c8338dcf2ab6fa80fa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        serialver.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 14.2MB
        • SHA256 c0f1c80e9af61194a017a544cf35a3d99eb386edc68352b19a42772d38212bb3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dotnet.exe

        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 14.4MB
        • SHA256 c57c9e628f581aaf87507e8326326723b83acd6633952c17f9b58dd6fb341788
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 14.3MB
        • SHA256 1e10f85a8a76c659895ae89c227db5cd94b7ba73d24cac4d4562d64b3423dbb7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 14.3MB
        • SHA256 26b214f3531eb9c1cd9cfa2d40d70c73e78056bc91816c18f539f4dc169db15e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 14.3MB
        • SHA256 d4a3fa549efa4b8098492ce4c348041482680e12b48976d3ce5fcc4d8ab4c939
        • MD5 SHA1 SHA512 SSDEEP TLSH