Overview

overview

8

Static

static

3

2026-08-02...r_.exe

windows10-2004-x64

8

2026-08-02...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    20s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 02:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-02_8ea8e0f5c4cd46b3929404cce5c7e304_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 19.0MB
  • Sample260802-ddc25a11c1
  • SHA256 bd15389c6d18b7dc8e3a1a7991b742036fd49bebdc8bca33b8bd858bea4da953
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_8ea8e0f5c4cd46b3929404cce5c7e304_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-02_8ea8e0f5c4cd46b3929404cce5c7e304_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5804
  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_8ea8e0f5c4cd46b3929404cce5c7e304_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-02_8ea8e0f5c4cd46b3929404cce5c7e304_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:760

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 38.2MB
        • SHA256 de23329b32354b127f537929d3c374146fbee6fad5f70f6bd2745bd0b2befd0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 38.0MB
        • SHA256 768fc49ab703665f86210b364fc26a0c819bb5c14edf5be33b3ad6b6ad04bf3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 42.0MB
        • SHA256 e747245e766f5bc108c0880209eb69748e26965977e622a0cced66f8085e66b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 19.3MB
        • SHA256 67712a9d764fe21bd6dc83d4b2ee519ac0a788981ab951caa06a0b058f9aa0c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 21.1MB
        • SHA256 fbce2f4838a1f76f9ec8782e6d4d73f595c02bfe72e4d888fc6f33602cf9e729
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 44.0MB
        • SHA256 7b15905e1172beba982c2ade583addbdea2e472429ce7ee7b3c4e70983577af1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 39.6MB
        • SHA256 d70dbdf41c2b8fcff63e77c7322a18cfd78310c9299c7883e2ea4586184187cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 41.4MB
        • SHA256 0082945c62469fd4b534fd98d7594b0681735a2fb27be9de73f4f990774e902b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 40.2MB
        • SHA256 2d2f5d653133391ea3e6b7e59e09482e255a39960116c212cd17b075be7d4df5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 39.6MB
        • SHA256 453d4c144e412e72bf7d3df201820a02aa3429a90e10514a36f0595d50f49540
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 39.8MB
        • SHA256 23590770d7387720eb488da3942bff52355dd219197aebfa4edae3cbfe36744b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 41.0MB
        • SHA256 cfe9ad7f402fcbff173c11c5ccbb3c87b3ac5795f67cd81522c79c97b0eded1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 39.4MB
        • SHA256 d22c4769391eaf8588852147e5d8e370fb2d76b77534e61e69252f6999ccbbf8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 38.0MB
        • SHA256 e964368ecae5df5e03db5999cb0be283b54e9704202c0369e01a1e4dc8d8f001
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 38.0MB
        • SHA256 6140e0d606e79a5a8cb6f959d290c6f4b2f95aa91d3504dd520259b759b548f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 38.0MB
        • SHA256 1afd517673d95a1a97be8cb45d282de90209478d349ce9e1761e3208a68bf1c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 38.0MB
        • SHA256 64673d75e9a29111279ac542ac6fab3ec28c1e7ba588554fa7ccfa4a58707f78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 38.0MB
        • SHA256 0e02d8d1d290ea50cd54a1ec5aed2b4c594656a9ffb14aa5a9c474c2418e67f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 38.0MB
        • SHA256 77b36326e8ead6796dc5c5e582c0797a6d40e25f0dde1e35233f45105c0b7d30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 19.0MB
        • SHA256 a7de4de7455a66465296b27fed599ec5a7f68ce9e7461ab03761404c22a4525d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 38.2MB
        • SHA256 c3adb5dbf2000d2571dc67612772c2760a83c2e88006ef7e27d4501ee2ab26e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 38.0MB
        • SHA256 5177b7abf5ce2252459dbc3a37d1d0272bd366384d9e9f0f2d1254f4a7787bfc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 38.0MB
        • SHA256 f129feaeb67ae0fcb0d1affe8aa76f44a16cc209585fba6eb0f39e30daddf546
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 38.1MB
        • SHA256 bd1e0516574e8ffe1930acdb7e999067cd5c0affd22bfa149b38fe090748ad03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 38.0MB
        • SHA256 8ccb2ec305806eddf4bfb090a790fe20a2ea4db5c32363a07fcd349ae6fc7e47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 38.0MB
        • SHA256 b1daaff05e940526456622d2799490601c271622dbd1c63e04086a812ceaf825
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 38.1MB
        • SHA256 35636924d8dfd34373e3dcc09dc485f34f4b7015002a5730ea671a31485466a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 38.2MB
        • SHA256 54108daaceee1a0036c23c09ecf8ffc3865e13c14b8d8168c3ac360514938a09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 38.4MB
        • SHA256 428718f1a635c7138a07b8d294c34dc7cdae72884a23c9552cb8248f2da394d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 38.0MB
        • SHA256 61919d48d40bf92790cd3b7a40c5f565ac183601dba77d9efbf8a4f23934ab2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 38.0MB
        • SHA256 872d82ab9538f1bfd9b6586875d575acfc66d9be8ec80ecae200a3d4890e94f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 38.0MB
        • SHA256 981734a71a3f724e01b142aafe1ddb0f5c6bb81aadcc4f647aafe7c8c7061ac0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 38.0MB
        • SHA256 22a9032d874b378bfebf2837bfb5bda4822081068efdf4e1fe8bbeccffb16ac9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 38.0MB
        • SHA256 e4f948bea62378c12e0d134688e60fb54c20f534f4c35858460ff83100995567
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 38.0MB
        • SHA256 58e682d12c2752328fa0a0d6c2afe4d408d848d6457ed32bd179f764eccf6a7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 38.0MB
        • SHA256 bb713f0850a5fa5835b8ce26c0cda33fc9a3d7159aedad32f2c277665d4b4d42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 38.0MB
        • SHA256 93e840e7826a2ba8c9e6176e28ac3d1e8e5418f921987e408571a7d98ce2982b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 38.0MB
        • SHA256 aa2448440595003ba5548cdb87c7700ab03b4d6316a5a1e7bde4c205f50dfa58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 38.0MB
        • SHA256 6ad4cc177aa91288ff5cb4b8949607989dfda842abffa3a80453cb029076cfbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 38.0MB
        • SHA256 52d2bc849700abe7926265782d8abc75b2636bbf0dc66f23174f8d91aa400050
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 38.0MB
        • SHA256 74c7963376739bcb25966935a9abcba65e989e789c218e41c869753ef09c19b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 38.0MB
        • SHA256 05f4c6b3da3ca80da5dc66f956615b4513b96f3dd2661436f0e94a8e765df0c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 38.0MB
        • SHA256 e9cb84202e15d1050adc6030d8abc31fecdd9ee873e2c516c3d47264ce251f92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 38.0MB
        • SHA256 44b3af0dc03d7551f3c61c733f1d54c5cb3d54b4a6fcf3798cd5263199986962
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 38.0MB
        • SHA256 90a46ee1a6b7eb2df5e870e8204d1c43109345c9220a10c1a4f290960324c68d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 38.0MB
        • SHA256 232686977e7660d3853a23933a0fecf2866aa39c6779405225e18bb1aceeef3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 38.0MB
        • SHA256 e9fd64d16e45f91c835b21f12837ae6db7f2d1f3f58cfe4821ec3da9360d2e3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 38.0MB
        • SHA256 6f327ffc8c8173b96c864dbe44a5923a26d7346ea133266c0d14f3c08cc9bd87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 38.0MB
        • SHA256 803d4700fe4112da003f5595558e8d3b7b18a54cebf9154940340c0fb5ca0b44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 38.0MB
        • SHA256 e2c99b8cbee41e668c77b097720d2e1cfcf3ee805f431e8d24826a83781b36ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 38.0MB
        • SHA256 eb025b7684989ef1e61d81529dcf0750565ea440e32e0ab806acb82111bbf4f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 38.0MB
        • SHA256 59eecf5115c68713dbe4a76e2b59ce2d8e1a3fbbf14e7a303719a085f0e5772c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 38.1MB
        • SHA256 7b84175d90b27fcf70bb9522cc89e31bc61d7228f3ac5bb4969dd4f0b6f2eb97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 38.0MB
        • SHA256 97dd35d4468900b66292f6a67eb097c736bccca424bc6d3a819eb3fe73b18a8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 38.1MB
        • SHA256 b4f8c8f1999d7a02d9cff91e42c928839befbc7d1ebe77506c232612d89dd3ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 19.0MB
        • SHA256 207ceeb773d40e5ad720238066089bcc1456505e6c97bf96a8872c97cd1fa8a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/760-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5804-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5804-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download