Overview

overview

8

Static

static

3

2026-08-02...r_.exe

windows10-2004-x64

8

2026-08-02...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    98s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/08/2026, 03:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-02_1c5a4a5f4730cd218d650a73dfca7728_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 26.4MB
  • Sample260802-d3csnatcpg
  • SHA256 e3de0b60418e3798b13b2ee4ac3f17a75d0abe4ffc71f80e1561f8fd46cf95e9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_1c5a4a5f4730cd218d650a73dfca7728_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-02_1c5a4a5f4730cd218d650a73dfca7728_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5112
  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_1c5a4a5f4730cd218d650a73dfca7728_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-02_1c5a4a5f4730cd218d650a73dfca7728_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4976

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 27.1MB
        • SHA256 f9551579174a8f413e892b79deae398350c35bfa3fa33bdd597178e787e2361f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 26.5MB
        • SHA256 ff7bbdbecc11be87e72bd39e5fec0bc98067da088f0ef531ffd2c5dda7d2d22c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 32.5MB
        • SHA256 43db8f2cd50ccc0434583d4cd52c5ed4f3a7390369b5f76ab5a0e334fd55119d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 29.9MB
        • SHA256 f6ad3ce9d2140fef4249b881f4fa92e22cad8168e7367643253274986a892d8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 54.4MB
        • SHA256 8e95fdf69fda6b0f5adb0121b3813da08e44cd3ec9ac404310b7c25edeed1356
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 55.9MB
        • SHA256 56922e8edb8c650554a48f0dcaa1fff7287ad18ad51e36784dec0625345ac920
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 54.2MB
        • SHA256 af28ac7d7ba38d5fd595f46a55e1b29948b27758bc9c187bd7e1e022b1139e4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 52.8MB
        • SHA256 6fe4abfb268aa0b807e974669fe6759b8eb4a717237cbf2da63405ea03d516d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 52.8MB
        • SHA256 5edf0392b3267a99714b11c046ddddbfe9bad9c4b58dede9110539eebfc82e37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 52.8MB
        • SHA256 e7202fffbb000f177da3841d1614001f9fc399286422630d7ba0b19a83eff86a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 52.8MB
        • SHA256 d7adf93d0ee193cd01cc7f9025dae036e1dd1e3bddb20e1958a5d205baddcb87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 52.8MB
        • SHA256 13a54600b730d67a2828162ab64ea2585ea7afff3baa2237fd4d2ed682f59c55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 52.8MB
        • SHA256 7a27e8dbf620b440ca61494e3b1cdff2fb2dc7c57d8f38a8bfd6c7d1b55ecb40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 53.1MB
        • SHA256 da782c432ad7a714250f239bc101c453e52bd4be06cdd7c18aa888655d75b4e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 52.8MB
        • SHA256 4a0d9bd65decb8c17408918931c54d15742b4eea8b426814ba72381ec6c521d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 50.8MB
        • SHA256 2938c3c284e3da21ff24e88dc5fbc30c67db0c7c85d5eaac050c6c85f255afbe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 42.9MB
        • SHA256 39638b38c803aa7ae733d89c00f9f4bfb3c21a885745f4830326c8a303b6ab16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 35.1MB
        • SHA256 96ae8fec964232b85844b355ce9d769f962db945566d7b29c368236bf52f8754
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 34.6MB
        • SHA256 b173adc1f513f10eee1acc6f5c26d7dae4d497db5d310e229c1e351d185c66b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 31.7MB
        • SHA256 81dfeb899f5999322b5ec328fb9bc860c20d8aa7bf42e425976d90b852b9cb88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 31.1MB
        • SHA256 420264ff0bd851d596fcfac3310347747317a0f64b5f9b5c973424e0006f592f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 34.0MB
        • SHA256 c8edd3872bb7247205fdac2b22ed016f1e05cfbe6b27c64bd52f484524b33354
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 33.8MB
        • SHA256 defdb816df802be75de890aff7d9ab15bc97f81f25e7b97c42d16819a328a2fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 23.6MB
        • SHA256 011640a1fe111873384161f31610c2193d00ab274302e35da02dc2a65f36fe57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 26.5MB
        • SHA256 58375587efdceb6a6420fb49d7e9defcb04eacdd1b71301b2ed0942d9df81246
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 26.3MB
        • SHA256 b9decb873a451ad32962958eb4f214e305e883a52ebd815b65af009a438ebb59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 25.8MB
        • SHA256 8ce523b524513d12cc39b9d53fb3b0f19dabfb5c8c0bd2168194e14ac890f409
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 26.1MB
        • SHA256 d5a9f11b665882a0ee19ec55ff48adaddfbe2d38bb8449fc8870263c10897313
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 24.0MB
        • SHA256 170a6978375790ea6bff6d2cc72393aba189398d14171f4d38dc53d57dfe9c28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 25.9MB
        • SHA256 b2e170e550a4ebd29c443016e6f81af8a3e36b28dfdd64222f35354fa0b8b599
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 25.7MB
        • SHA256 828f9eaafdbc763b777b02a78b4f4664ed0ab77f30eb921a3a23c5ad5ef904bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 25.8MB
        • SHA256 8ed8f0ff454c9e09b1cfa8549b3108fec79664e14c16fb9f7c00147dde864daf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 25.4MB
        • SHA256 27123b9c027533f62b27560ab79289ecd4cd47a5445250a8f7b9e579404ceb53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 25.2MB
        • SHA256 5d45e3be1b3fad04f78877fe8b7159c7e6e4c22c18d5bc6845de4a51b7525e56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 25.2MB
        • SHA256 539de59f9af517772193c48309d920056341517097eb57c0e0e6edd09d136bbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 24.4MB
        • SHA256 a630d65dac2edf0feee246fea9951f80d9c562ee44547e30211b58501337f68c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 26.1MB
        • SHA256 4a838c4259bf3ca2a8a65a687313e8bca762c83605193b04bd0f4dc76bddd271
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 22.5MB
        • SHA256 e2ebafc401c4811e6aa04e8760e4e138baa7f654eea88eeae9caf3d9f4cdbe76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 24.9MB
        • SHA256 997cf56b46d9a641f1760a28ee772700f5d5ea388d6264c02542139cd80ddb04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 24.2MB
        • SHA256 8ed5ce07020dd4fba32d5d64efb90527aabc3193be80ccdfd7e821cc15fbde73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 23.9MB
        • SHA256 cec066edf4a755269cdddcb4b4eae55e250e36dcc85d21d76a13ce48f7d6c3b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 26.4MB
        • SHA256 e3de0b60418e3798b13b2ee4ac3f17a75d0abe4ffc71f80e1561f8fd46cf95e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4976-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5112-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5112-4-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download