Overview

overview

8

Static

static

3

2026-08-01...r_.exe

windows10-2004-x64

8

2026-08-01...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    109s
  • max time network
    131s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/08/2026, 00:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-01_50353b3724533f0850371760a93e2875_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 41.1MB
  • Sample260802-a4snqa1cnf
  • SHA256 94204e1c89b8204ee497f2fb4f084cddb158a6f34c9dcf09e390456cf04bb454
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_50353b3724533f0850371760a93e2875_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-01_50353b3724533f0850371760a93e2875_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4680
  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_50353b3724533f0850371760a93e2875_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-01_50353b3724533f0850371760a93e2875_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3056

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 41.7MB
        • SHA256 7a476b8fb53e766feba920d01428b6bbe07913b8c5afaf7d2e614d40cacf1eea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 47.1MB
        • SHA256 51383db55ab44f8e6edbf293ed7cb857f77676e8da3892117d1cc46e7656829b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 83.8MB
        • SHA256 e6cfb5498c9ddbc31b00b9ce7b024aca50fa5406abd6d145e0cee5eaf62b2061
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 84.0MB
        • SHA256 ef1d4cbea59388256cfc2ca4c73b61eee37836a52d0cc632d36586781d4a4123
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 85.2MB
        • SHA256 281ef5d3c83478d63b9b0931be058c889fba9c16e9eeb7c508364d1eff673511
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 83.5MB
        • SHA256 acda2e3fd9f80c7b9488a003a1f59613b5cd7dc6305535f6ee4ecf6911549ca7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 82.1MB
        • SHA256 87848b445f0550efb4a6b9adbd71e7b6314909c235218adffcbb6f34c0c2a8ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 82.1MB
        • SHA256 478fd7d074bec250fe409f9f135934f789c7909928b909882bfa8da9f3d251cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 82.1MB
        • SHA256 8a3e498e004c0a5e5609c77f023f7da7afd5793631fa39a74025702d63696fa0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 41.1MB
        • SHA256 f9d82e03553077e71cb954b8df5994393004c696fe6351ed071e4d2b1379d610
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 80.9MB
        • SHA256 0c44c731db968505ac455035d55941f41c918f7a03446cfce2518b01c6e0bf6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 71.9MB
        • SHA256 08a3cdd9287ffdb7858c9a4c0865ac3b3fab76107314cf1beb5aece1d0d55093
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 75.9MB
        • SHA256 61fce7c22cb7a63f1c14bad0285e6c7024a869c8083a7f97d2432090f755966c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 65.0MB
        • SHA256 0e87f55a576bd8eb7886e6a418fde0cd1e1dcf3dbe8011eccdec742ccc2a77fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 64.8MB
        • SHA256 34d89aa684f927b5c684175b76c19ca919c82461e00e3b571bf2601dcb609199
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 54.8MB
        • SHA256 20f92f233880bd2c2ac954193420254ba6cdecb42f458842f6beb64b77f11aff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 64.1MB
        • SHA256 801c10574afefd8c235e2d3790e57e1a92337e0a30734c4329e20b0c4ec52917
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 63.2MB
        • SHA256 818daa64ef3a8169376217f9e52636087488b063f7ffee69b4df4f6d7ad1fe52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 63.0MB
        • SHA256 e696c7ff24e9ee48c9f61689f109cffbdca2995ba0681f8aa59bcf293ea088cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 61.3MB
        • SHA256 aa1497e0494783fc0303be288c8a8f1bcac2093e8e1a991b9064b6a81c04602e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 58.4MB
        • SHA256 602d4b4b58eb51323e7b9ac2c9a2f7c97fae7af034c079b4a6bd09f9d1f46bfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 57.9MB
        • SHA256 dfcdf83c5bd100e4e6350cd85ec861085a1aa117459519b42ffaebfcec74d3ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 55.8MB
        • SHA256 9edbb1cc967b56259fe09dcdeeba05f6a5086ed4e25f5fbbc3ec636879491d39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 55.5MB
        • SHA256 2b341dd638f344a3e5a4561895c3ce57617f6fb7266f26ae14bae4f4fe777a1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 55.6MB
        • SHA256 1945a39aef60313e83c798ac795222b4958bd41db70a2e30db2732130f428e5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 49.7MB
        • SHA256 d34071e8ea73081e26b5d58d38d7cd03937c07a15b7f0cf81bae35f433f16843
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 41.1MB
        • SHA256 94204e1c89b8204ee497f2fb4f084cddb158a6f34c9dcf09e390456cf04bb454
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3056-6-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3056-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4680-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4680-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download