Overview

overview

8

Static

static

3

2026-08-01...r_.exe

windows10-2004-x64

8

2026-08-01...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    40s
  • max time network
    155s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 00:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-01_50353b3724533f0850371760a93e2875_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 41.1MB
  • Sample260802-a4snqa1cnf
  • SHA256 94204e1c89b8204ee497f2fb4f084cddb158a6f34c9dcf09e390456cf04bb454
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_50353b3724533f0850371760a93e2875_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-01_50353b3724533f0850371760a93e2875_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4988
  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_50353b3724533f0850371760a93e2875_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-01_50353b3724533f0850371760a93e2875_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3748

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 41.1MB
        • SHA256 94204e1c89b8204ee497f2fb4f084cddb158a6f34c9dcf09e390456cf04bb454
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 82.2MB
        • SHA256 d7b6417f520fd74a9e2df055a5a82f2d16e7c5e7f3f6a9072c116e913f379a9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 84.8MB
        • SHA256 5a469a32c6a38f2ab4f4945d6e12b6649d5e41c52b0744b87fd6a8e96e7012a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 41.4MB
        • SHA256 810879a9903c02592cc3dd9ecadaab3e115131dc47b76bf54eaf460650a31f8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 79.6MB
        • SHA256 49f774a9e4482a5da8762af7eb7c7ce377926c0829b90191ea52c1ccf1951370
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 72.4MB
        • SHA256 0837955ae007486987ed4cb68e819893dd7367b66c4d43a03b8b8a635a844953
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 74.8MB
        • SHA256 655752e7ab8530ce31da07a6deb95b72bf0128b59e14b81bc09c8183cc888033
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 72.4MB
        • SHA256 cffc6f009cbe9a625651b128e34d2f5f37a582ce6479ad6d78b4ced2cdc6382a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 70.9MB
        • SHA256 45428dc63dcc9ea4707d8e9ad98837c5c3588501d8f89a4790c20e5ad5d786d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 69.1MB
        • SHA256 05182e1f60396547a53609b73fa60c5f9bcbb4010ae9c63f583b3ff96bace1f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 128KB
        • SHA256 018b597827351ef5fba9c0e1d321cfa9b45d887ff0f8d5607452eb75d8626cb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 41.1MB
        • SHA256 be1a922465dd1ec7d94bf06c48f2a5db6259a2ea15235f9504853ed484f4eab3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 41.1MB
        • SHA256 e3e8d3304625646d70cdeb43c559d49afad2fb45d8c100697aefade352c4a0fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 64.9MB
        • SHA256 c42405c478532bb44ed7f83ae6a39558c03ace7e17e6445e5658498e6d1c2fb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 63.2MB
        • SHA256 818daa64ef3a8169376217f9e52636087488b063f7ffee69b4df4f6d7ad1fe52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 832KB
        • SHA256 b983604409cb7b55389c7b3aaa4c83e30ffa9318f52a36406ce2a03d50073086
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 58.8MB
        • SHA256 adc4e4bf406114c10c7d7d33301e65b4f5f983c46abfda483911ce7c1ba3d118
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 57.6MB
        • SHA256 f37cebbcf604f9b06bfc096193f5f8fa0756d29d7d8d71d4a5e5f61f8b99c02e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 57.4MB
        • SHA256 4d21d8e5908df2e2020187d50ab8d8744ff727d15013a22beae9e3597f04245e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 57.0MB
        • SHA256 6071fd43f81c8928e7acd1d9626c52a855744f00a466ca7ce22e8df4d19fb947
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 56.6MB
        • SHA256 fd53434a882dbc8a1943ee5e4f5dbe8462596e38cbe750afc9c1fcd4afe517b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 55.7MB
        • SHA256 c47adf1b44bc6ae070db965839d9d2a1cb1699a9a84cfbef636059ba5f97c5fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 54.1MB
        • SHA256 522c5f89749a45b94f8d2409b5e16f2f1f7fcd008fd01c108056ca30df3d8936
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 54.8MB
        • SHA256 20f92f233880bd2c2ac954193420254ba6cdecb42f458842f6beb64b77f11aff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 54.1MB
        • SHA256 02c3406ac80ad9c7e69b1b604087ccb7754e87c04e18ed6daf3542018677a998
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 53.9MB
        • SHA256 a15f59788e56d474920c83742ac91fe286b9575a55e8197e99d367e8626c52d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 53.4MB
        • SHA256 24035977f3d77ebcada93e987f18503b9dba31d876fb6ffd1e0db144b5cf75f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 49.1MB
        • SHA256 02f62ead96f2495e2649870b4623d8dca5682267ea60881834a0268930a8be2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 47.4MB
        • SHA256 1e5370270054f59010f77c7669eb8d295a00d8a394e17c5c2eab43d061c030d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 45.6MB
        • SHA256 499bbf55891a1faf07dac08a1596f41c0beaf2cea03b2502189ccb5f6c44e90a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 44.8MB
        • SHA256 f2fbfd4323fc2fe958245a6409f76bd9188ffb09aaafde3adf3e1162aacf5d44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 43.9MB
        • SHA256 70e57d1974165ae70fabd44ac9d6c7925fffadd004a4e07ceee402fa5310e8ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 42.8MB
        • SHA256 321af2e20a865c0ad78080db489eb46c567234d24061acba4d1704d15041df8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 42.4MB
        • SHA256 856b20bd13d30f98e6bc3f933df32f6c2b1491ef55e19022385a95da48cf65ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 41.2MB
        • SHA256 5c02fb360d5a0085fc2b6d929b948ba0b12269aea96ba779155c437f522e8066
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 41.1MB
        • SHA256 c452d3290aa3b74e2e3ecbb41923c1c43c5ff67f3403e61f9a51bbe73f194f2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 78.3MB
        • SHA256 a1633f826a587d27f16f257bc70fe19ffc3f986d95e1eced553541d85a218864
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 75.9MB
        • SHA256 af08025a9d05679be3f073203e991f205b31d7683b2b688ca07d6a99bcdf9918
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3748-17-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4988-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4988-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download