Overview

overview

8

Static

static

3

2026-08-01...r_.exe

windows10-2004-x64

8

2026-08-01...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    54s
  • max time network
    157s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 00:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-01_872718b982e3a6dd0379ddd3402d8378_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 40.8MB
  • Sample260802-amkxjszycs
  • SHA256 8ac6fdf296e785e0727ee9d9ff0cf290cbdd1b668d46e0041bc1494d40107504
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_872718b982e3a6dd0379ddd3402d8378_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-01_872718b982e3a6dd0379ddd3402d8378_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1684
  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_872718b982e3a6dd0379ddd3402d8378_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-01_872718b982e3a6dd0379ddd3402d8378_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1332

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 41.1MB
        • SHA256 c5058565ccf00f38c7c6e63fedc9d2be58156c8891bb91ba225fe5d752fd4534
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 81.7MB
        • SHA256 a979e66468eb2dd1842181c3ff7337f9e60d0dc809428565bb7feefc5950a6d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 85.8MB
        • SHA256 fa4e05ea3c49636d337091d2beef90a0978fe914124dfe3d5acc13cf48218c88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 82.0MB
        • SHA256 651e163fe33a0254b8fa0a0a9b3b511d729d572b3fc6902375c70bc9bc3014fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 43.0MB
        • SHA256 0a079df45831ba982c76b3730009121039d20bf53aa734a3f881571c7369bf1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 81.8MB
        • SHA256 af69d4c8e36a1a1865cb4b5d2b26ea4bb1b320925364856d5ae57db1308745bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 79.0MB
        • SHA256 2b2bc53f1cfddde769f3b2acc77e78cc39aac1c0890608da93513e4144bedc9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 76.8MB
        • SHA256 69b72903b07da66c305eb1bfd2cf1fb8b9aedcfc7fe321115b706b329062b2e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 80.6MB
        • SHA256 702c5ce670709a3a4e7158cf18089e0c56df65deb2472c8ac7c24b24902ec146
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 78.6MB
        • SHA256 e937a48071379b622317cf00f23319f405aa23a68d7a61ff46497a5bd3f31dd7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 77.9MB
        • SHA256 31c7420cc662139fcede8c3af30f34c0288b95ade8462eafd7c23a2c99ffb344
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 75.6MB
        • SHA256 366ef9256f242719bf28da9a3ca24f1837bb3935c776b25df5559e003be9e61c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 74.5MB
        • SHA256 24857e9b2d06acac9419cc88cc5f2e4a0b71fc8a97b845b03e448628cf35ebc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 1.3MB
        • SHA256 08238e2d065757a73bae6cd4f815e487df4a19ee5eaa8b591c38befb7137df71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 70.4MB
        • SHA256 a5bafae1111cf1e155bc68d4b8e2d86b57b1d0e5d0c977a7969c3bec3be887c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 67.0MB
        • SHA256 47bc1d3c6cd91a41c21e69839ea7b83004deb9ff30560057a85b30727edcb706
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 62.5MB
        • SHA256 f0b3481c965590e7c8f951219d7481ed0ce9ce6137846a995efcf86d61b31ff5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 65.2MB
        • SHA256 74cd42a363f4ab321832d238901f777ea7cf1eccec03fdf34aecd290f885753e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 64.2MB
        • SHA256 591987c000057a89937ccc85093eb40ff68a8d729c21bdc38e4cb9335af5253e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 62.8MB
        • SHA256 badc0383e1e27c4df67d5c2da4b5acdcba870194cfbd55cfe59b97cc0126bd66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 61.8MB
        • SHA256 9fdf84e1bbb0194c38652e8bd4acaf920e55f56e82f8300878128d9133b126e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 60.6MB
        • SHA256 8ce917fbc8a0d86a6cd19ae17ce5abe4ed02343ba5ad27c353a0a02ab25dbcfc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 60.3MB
        • SHA256 4a32e22626456222fa290b589297846b000f4e4acb219b8ba534c5f2e09e0dc9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 58.7MB
        • SHA256 70b0e8dbfc437b2530249e1c25fe7e62707b8c8eeca328a781b34c9324290ac6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 57.9MB
        • SHA256 7d48b4134c00b79aaa161d7f462033854ffcf71fefeada277e7e0f54c1fd4e7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 40.9MB
        • SHA256 5e4ec597527c0a7961b9a490ac9fddb95da09bc7829e6e6bf918386939f38de7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 1.6MB
        • SHA256 66fea294ef32aeff494860adb053e260f79469aa0b35c811dd20a5e8079bade1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 1.2MB
        • SHA256 0d0258c89e76dc4257d5b19fb97ad8a3c681955e184d38b6cd889691eef84576
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 640KB
        • SHA256 36e46251acaa3c1f6ddca77a7802721efdce2c29bd1eb6d91a02a5f772f39704
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 192KB
        • SHA256 56d5b720b4307ef448fb38ef6495ea0a6fb25e8bfa8f9c140729b820c8e0cc1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 81.8MB
        • SHA256 d6974ce134c4b3072f55db0c9d2d4c4e6d508188a986c3f0ffcff79861dc98b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 81.7MB
        • SHA256 5c6f119bf924ed644ea8cbd030e5fdbbfc4117dd0ecbe9d0119ac70f40809d42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 81.7MB
        • SHA256 ffb3d2128d4acab2fefbd093bc018e4017c219b2fa2609fe21d240f6ab7a7ec1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 81.7MB
        • SHA256 711b23f55b6e0f4b421b0c8d59b8a04eff0c78d3e2fa8c094a51812cb8d1ee27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download