Overview

overview

8

Static

static

3

2026-08-02...r_.exe

windows10-2004-x64

8

2026-08-02...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    38s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 23:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-02_d72a6c158a6e423b4d16da01fd63095c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 38.3MB
  • Sample260802-3lbayatemb
  • SHA256 0c1d67a00eea01dc31485e8b0e6254b97c40e4761ee516d37c7db859085a0819
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_d72a6c158a6e423b4d16da01fd63095c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-02_d72a6c158a6e423b4d16da01fd63095c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5996
  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_d72a6c158a6e423b4d16da01fd63095c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-02_d72a6c158a6e423b4d16da01fd63095c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3368

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 38.6MB
        • SHA256 278a7c210e995c30141142815dc8654fd4939e822182f404ea61f0cf302c8cce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 38.4MB
        • SHA256 6c518935d3b1bf474a5af6c24d1a8324d6d7ea701d9075f73ef82762c312c7ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 38.3MB
        • SHA256 0c1d67a00eea01dc31485e8b0e6254b97c40e4761ee516d37c7db859085a0819
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 76.8MB
        • SHA256 51726873dc263410e3658a1d120d227ac7031663d1cec5fc02c01d0d61863cd3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 40.5MB
        • SHA256 5a9b70e989ce83cbe3784b904e1277fcfb21c826e7608f06cd075d3f48c9317e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 71.9MB
        • SHA256 71bbc8fd62645d03caba182ee5c06309840b9693922b8bda37a532bf8b8f2746
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ExitResolve.asp
        • Path C:\Program Files\ExitResolve.asp
        • Size 65.4MB
        • SHA256 59a54bcd98314e228286161d9f15c453f34b943c637b3fc46b4c7e52b23a0f2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ExportRequest.exe
        • Path C:\Program Files\ExportRequest.exe
        • Size 63.4MB
        • SHA256 df5da986bd63d54a47d1ab0d5546a9456256bab6ab23ee2fadd7801918479f7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 60.8MB
        • SHA256 20c60ac2d3ec974c4b53e8cfce57e33d4d1fa10a27ca217ffc91d7e68bded663
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 58.6MB
        • SHA256 d3724dfc6ec9edb29c97cf6b1193f6320cef321b432e36da74b75d633ae31374
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 62.6MB
        • SHA256 2e9dace66dce9f5753f9b1e62ce63e6915a85e7c9f7677e17adb4b55f78393bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 59.8MB
        • SHA256 e3fee6957c171ed64b00b6ca52f6445c44a2b0ece626303c7fb1d7a5a8f1932e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 59.9MB
        • SHA256 7482b9ad8bce37738138171c2e19b45bd5812665f6e5d649a694c87675539148
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 58.1MB
        • SHA256 78fb1a2d2a087cf64fb25a93560f8df118725e8160d3a722aea8699461f9f502
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 55.1MB
        • SHA256 f011a716c52102ae83a82fed3247705831775e21fe9ead64b66f5eee85ab8c2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 54.3MB
        • SHA256 f81da4a31b587934144dc00084ca40bf2b9704776194bcc6c95be02c9a30857e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 54.6MB
        • SHA256 9843a6f6782bdb01ef07aa7acd65c5898351e4a1b6d914acc17bc0420939d512
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 53.9MB
        • SHA256 25a3833d9b3f7344afc10cb8d0c68a8592051066ccace37055fcd930c921b88e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 49.9MB
        • SHA256 230375cf470b0e10f95df5e0ffb6f9d2c898c4d0a75f1a072c998a62028a4da7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 49.2MB
        • SHA256 11154eeea0fc15c38df565271df7fded0f53e0aead8caf61306633e84c2f9152
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 47.0MB
        • SHA256 4b067d6c8f3de73a30a578a345fbc1febcb8fc7e34c7117c55ae79b54e4cb7ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 46.4MB
        • SHA256 5fdb28742539d34a29e1526e27d2673947cf2005b5da437edfb51a03e8a074e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 45.7MB
        • SHA256 79d87a1893c4fecf8ffd2a0f73dcf56c88ebeb946d9311cf052b421cb024482a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 44.9MB
        • SHA256 c988418e3ec33203a59903b448b8c9f7e65cb99771b09441327baaec9ca9d881
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 43.5MB
        • SHA256 ebb943709aedee0e8b5ec0319e6efb1cba263910539d59192631bb3178b0e130
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 42.6MB
        • SHA256 07c6b8deee1a62de94d4554c7e0478d17c72b462b2373730a004f9915236b011
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 40.5MB
        • SHA256 a2c3685668c9cacc98cae058cfd6f6bd795b39738c05d1f3c690c1fcc311a4ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 38.9MB
        • SHA256 7599f4f68b2446dfe8d96a4bb426a95a27307c3f8b2f0b70dc2a4f3e9956aaa3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 38.4MB
        • SHA256 90a90c43088979512a12021c64f7f78f101d99bf80804366146ed31f63eceea7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 38.1MB
        • SHA256 e6456f8e4f6522e0c7887dcda91178c27b4bd4d4484b30eb22aba9e72a4f80b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 35.7MB
        • SHA256 54a1ed39d3f777a7dc582b5ecbd4f74d2acd6518dfeffad9afc2abefa002fd39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 34.6MB
        • SHA256 f06a03343adae0cf58b9ebc55e6de9bd2d2b6131fca2b0e6318f4c80f3f52caf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 33.8MB
        • SHA256 46dc7e71e84507dd9ed8ff045b27516d8c460cd63a278d31d25b95eb7b56c8d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 33.4MB
        • SHA256 f474980fdec538634663bb65ba3267ff7418ca2eac64fb1c41b405b8b8f7a392
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 33.1MB
        • SHA256 54de0ce7e559c3ed834a163cbedf2bfe576f5877f75fee7277226cf337465045
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 32.2MB
        • SHA256 87923a7506a25b64159fabe580c36b03807f59d0f8073b320b5012730f922eba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 32.1MB
        • SHA256 d805b7bec7cdaaaedbe87e4ad6f2fb4ff674da380c034c275b2638df21aa7370
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 69.7MB
        • SHA256 6073e5c00510ab7ffe6760b7630b5d48eefd61116c213053a46b8d377b8765ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 69.3MB
        • SHA256 56c9c2bbc1dd08b88eb641fdca9839d9aa92ebbf1b8a813268832c2cb58a799c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 68.2MB
        • SHA256 4b9c3bc854b66eee211be0ff331bfc1ee2fd6c5e69f710876c34f7be3baa07cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 65.1MB
        • SHA256 a7c12ac01cda9acebd91b122f7c2b839ccc7ebc259ac2db46d5e7c929d0e7cf4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download