Overview

overview

8

Static

static

3

2026-07-30...r_.exe

windows10-2004-x64

8

2026-07-30...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/07/2026, 19:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-30_11a8243e34658e95fad8a6eadb0b7816_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 30.2MB
  • Sample260730-ybkdmswdrc
  • SHA256 c325725ae8fa632f81fd37e46e734609ee1357baaea9599035a34eb6a3c3c5e9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_11a8243e34658e95fad8a6eadb0b7816_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-30_11a8243e34658e95fad8a6eadb0b7816_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4312
  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_11a8243e34658e95fad8a6eadb0b7816_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-30_11a8243e34658e95fad8a6eadb0b7816_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2824

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 30.5MB
        • SHA256 55a5a50f46dda8a8cb109712926ebc29c2e3e0a306cb478ff799314529f9dd48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 60.5MB
        • SHA256 a73db45da8009cddbd2cffc88916c7a937a548f96fd2b250e5e7dffb8005d753
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 64.5MB
        • SHA256 9eed9513a13dfb81945082602a8ed4529a8f0cde058e2392a0670c7335709538
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 60.8MB
        • SHA256 c5f3170b9f08b07679adad4431e6b477773712b07f8af5e63ad211c7ede1d8ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 32.3MB
        • SHA256 b1f7cded59d5354763e8a4820e22d2e9d549e69be91b8ad695b42b41891f91ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 30.3MB
        • SHA256 b3f0896db1d8bc953734cc28fe1095d2d472197df2e6e93f9bb68f000e4ec563
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 49.8MB
        • SHA256 28003e71b352f18ebe3d2d35147e30d03490c0df295ecc887ab3d898ab7c6276
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 48.9MB
        • SHA256 53dfd595fe841e7b343e518a6b3c6ce2e503ea65b8a08d21486a2a9b00ad1304
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 51.2MB
        • SHA256 4670d18fded34b18f3bc9d61f89d944fe96e534c5d5d1f745a6e3f5a62f53173
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 50.6MB
        • SHA256 bc6f6a8cc97db99cae410a9f629c0958c6a2f74dcdc43e97456d4e6079fccb33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 49.6MB
        • SHA256 adeee45cccf4cb66315a75ea1b4d5b70ab11d8b70046f3cd2331d74c6f1462d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 48.1MB
        • SHA256 c24ecc1d188ff50331012e98721a9e0452da6be704ce5626a3527065ba420c6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 43.5MB
        • SHA256 3d15476f5d353821c5e648ed674be93cabb6a67e0b2c61ca130ba3e8b71ae6cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 43.1MB
        • SHA256 f5d28e59914e0209c43ca6be55ffe7597eb3e7f81304d31dcf71c4636acd97bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 46.6MB
        • SHA256 b8c67d898bda80ff763070e4ab907c9543095175a786236005209b5659a9d275
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 46.9MB
        • SHA256 fec975143ac4051e272afa9043694bba031439bd75fb9571b2d7c6a13e6cc316
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 41.5MB
        • SHA256 196d069dd3881b2a924b14cf754375e23f0a25a37434155dee68d70c4640438b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 45.2MB
        • SHA256 ca1850516698c8d6baa7602b611b5f17721eb764b4104e6b3dca7a9e5037b9ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 40.6MB
        • SHA256 ac1a55617ca7eea07ee9dff6217cd9583bea9219581727e294178ee181686b93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 44.6MB
        • SHA256 4d30eb8b5fe9b6c977c92759a9171678501c8e8e023bffff9e56a52d289ec105
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 30.4MB
        • SHA256 959b027f806fcdb40475ac1cdaf3f70799695b08c5245000b61c9dd390d52804
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 44.1MB
        • SHA256 9de763bf3e3aed7420db0c6fc96267b666c2a05a79700f1ec66f3cc418d57623
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 43.8MB
        • SHA256 b64efc3515694bde93fcae40c78e5a345db119aa3794ec24e5531d8729484828
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 43.6MB
        • SHA256 dbac630406a3cbb5775f15fb9e9b0df68d963e42db8c6b6259ba1c52c03d8d22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 42.9MB
        • SHA256 1e6f9c3748b10a0977abdf7959a2fd638ee4a13b78d0e6dbe2742e3fd978ab64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 40.1MB
        • SHA256 423e5df7fc3f6d122518546f5e9e70dac6a01cde4f6aad064842caa1fe097770
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 42.9MB
        • SHA256 1206ca34f7ddcba8227c57a2a1ab3f222df817ab78bcff6d14bc001e3492c11f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 38.7MB
        • SHA256 c9f68ef287d8698306e15a34b35651f6ccd355407af205ee2c9808ad50a25e3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 30.2MB
        • SHA256 3adb19ddfd562c4087fef15f76444b79522749dd5e59b8392fa9b6ee194f75bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 40.6MB
        • SHA256 02c70962a3dec0aded69f96eb5ad7be6917cc7da183bb6cf7789748bbf1c3eed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 41.4MB
        • SHA256 4d6f460d9c10150e2cd969468bd1185a1431cb83f9c96cd619258c02d1ed29b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 39.8MB
        • SHA256 8179af72563316893e541c7b57ea8bae51c573bc4a5dd168f64168715d2ccad2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 39.4MB
        • SHA256 b01809c0e9e3c67b4f1e8ce255d0f368cf1f4c3320cce9faeead0469daeeb05d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 39.2MB
        • SHA256 c73d1e4e790181170d66b5698959a3bdb33e606df23dacbfd1f283ec412ac619
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 34.9MB
        • SHA256 977ff4af67f51a37e660c31c1924abf8a71963696b1b59695359cbbbb8f811dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 38.8MB
        • SHA256 c092132a815b188f6dec3ee851da3d22c50d96f45cca21593604fa9071a6501c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 36.4MB
        • SHA256 b1aa0931cb2a686d0437113b398862d8a085d8f34e7920a97957de84f51db93d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 38.5MB
        • SHA256 68441d8f97d83770b6c46dd3a8b3fc42a83d1777eb2eeeb889026f2d087862c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 38.3MB
        • SHA256 c80a701f1ad2040e4a598864a65deb04b1dea1a0280677e846c23390dd8a619a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 38.2MB
        • SHA256 3e6ffdfe033750687016bd3e95fd1baeef269a3707f5a41d67cfbc55afd3ba75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 38.1MB
        • SHA256 bc8d6d61aa4ae6b1af0416f88c0be67057327a3660af5fddcbe59bca29168f69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 38.0MB
        • SHA256 06f6fcc006fcaa7f0ea85ba90bca48a17de79f9d9b646ea94d1fa0e6ec0fb54f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 37.7MB
        • SHA256 74133c2be64630defc108b80219d039d444704d6b7b2f9e76edc5ef734903d4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 37.6MB
        • SHA256 e344815b49b49375bc6d078080e595a32bb29ecf9e4fcbdbfe1e3bb8565acabf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 37.4MB
        • SHA256 5185eb481011545d575e64fd1e75f081a9bbebd6c64786fa01eb4ceaad5681fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 37.3MB
        • SHA256 cdb035bebce7fb70050bbdb18283e8f49abf4f0f6375a6c7f64b636b4b4668cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 33.0MB
        • SHA256 8a440831380e6e3086038cdb52907909ad4a7a11f54f447b6de38dc5fec07c88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 36.9MB
        • SHA256 ad8ab5fc64a50109ef0be4b8d94c2cadbd1b1e5c4642d81fead1b6e0d5500912
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 53.6MB
        • SHA256 b485194a549896dc9572c741c0892df690495cc345584007ce865963bdb7a0b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 30.3MB
        • SHA256 d717729c7108865112ea696bcac271c4c0cfd46c75bddc353f3a945c525c53be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 51.5MB
        • SHA256 dfd5bbccb9ed461d62c43f7d99eee339d6662d81e2bbd7a33632b6214c6a6c2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download