Overview

overview

8

Static

static

3

2026-08-02...ij.exe

windows10-2004-x64

8

2026-08-02...ij.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    49s
  • max time network
    157s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/08/2026, 00:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-02_85c637c50669c08e37f305d651852428_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe
  • Size 42.7MB
  • Sample260803-ad8bgsvake
  • SHA256 63789d9983faf37b6e92d69a4cb698d1df11e804dda2185fb1125966a10d302e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_85c637c50669c08e37f305d651852428_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-02_85c637c50669c08e37f305d651852428_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5708
  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_85c637c50669c08e37f305d651852428_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-02_85c637c50669c08e37f305d651852428_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5236

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 43.0MB
        • SHA256 1db36a3a0bed303361fb1a734861a02cb971e0ee4b8eca91cb15aa814fbe6383
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 85.4MB
        • SHA256 2d31b8088e91e61afd1b8dbd6fb8bd0a34e5c4463c6c3f9fd7e88ea7eb567735
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 89.5MB
        • SHA256 0879b3ba84f2e3ccaaee4d6c8b0b7b370902a7474d5ea34a413fcb3e68ef246a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 85.7MB
        • SHA256 e92006034720f5ab6465ebd9b937430c559d8f5fa8b79f309ff07eff0bd04643
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 44.8MB
        • SHA256 b000a0eab7ca29cec390e46ffe6cc38bd16a5f9984b9b73fee86a56eb16d0a17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 85.5MB
        • SHA256 5eaddaebfa9ede569d144761318dca1402bc02f7750d4625bad7c2ffcc408e22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 75.4MB
        • SHA256 ecf1422c336c3efc74433859798b014d6142c5c2c317e094242a9e520c948546
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 78.8MB
        • SHA256 d326a5b9e5a7189f0ec5fa1de848bc2ec7783ab1478678ba3ff0510d174467a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 77.9MB
        • SHA256 0af1e8f9fdd2b54f1a2d55b6bbfa8f78f3e6cb53d813d21d540cb003d0cfb8e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 76.3MB
        • SHA256 08cc267eda5995b2c3e5d14bdd1eec3bda9228b862844335cb8f49c152b7b54e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 75.5MB
        • SHA256 39059490dc8e681964797e677eeeb18919d7c34510d11d9bd026b0dfd338af47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 74.4MB
        • SHA256 f07c9decff3d8240241e62fc190d11f61b7ea488717a56f21dd4867bfc2628e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 74.2MB
        • SHA256 7bf19d104e3712a25f5e7227b71f8f80ad041179ce322bccad66d1b9d50c6d86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 71.6MB
        • SHA256 f390969e34dae9236873f464531b9c8654562f7431f0766c7990f8499654ffe8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 67.2MB
        • SHA256 c6d727581e6c89c6092852606dbae12abb1e53d6bd62187ec585ba083263c763
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 66.5MB
        • SHA256 14273094b5504503316dea97b29fb1e94c7f424345519f2c706a7de906c6b463
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 64.7MB
        • SHA256 e3b64089393e0fd7aef27cb38097926cc1fb427d8413a4601342bcb1b6b3ad73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 63.1MB
        • SHA256 63ec252bc6003b70e430e6dcdcd0b14f0acddb8e16899e31cccc348b270a2d17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 60.2MB
        • SHA256 401a5ddebcd6b1319eefd6b6f509fa96f4f48bce10f20f6d5967666027788d0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 59.6MB
        • SHA256 d9d6716c778b3af76eea9b5f8b02d8bff0d2ec638babdbe767e65f5bcbaf3738
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 58.1MB
        • SHA256 8b891d12872c6f2e5c7af998b9deb2f7fd6076af2a0cce9b7e773e27b758b869
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 56.6MB
        • SHA256 f0992b0ff00b5ad93c87989721e2f02850bd813caa613037048f954763a88855
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 54.6MB
        • SHA256 a9f96dc00e0488522d18f11ef456021edf3e0fc9ccb4d29679652dfa5bde903d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 53.1MB
        • SHA256 583a13c9275f0c648bbbd4b4f48ae44f29b51f292d0cd67d39b384c1cd79f623
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 49.6MB
        • SHA256 427abe6cff3c2be708f2eb4cbefa714c3287d0187170592044635313c4f2e047
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 42.7MB
        • SHA256 e5a0b0e3280f11529698c2e20959299caa315fddea3a7562c3382433fc2da1b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 85.5MB
        • SHA256 1b7aa2163b07b060ec4710c054a99df689a8f9f1bf70b56678b8c47f2b5aad49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 85.4MB
        • SHA256 8ac87e79a26f4d8606765ab0fbca64ea812fd5324ba019e539343359b1814519
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 85.4MB
        • SHA256 b8f11d91288bba60a1cb5e30b420ded7db225975d85d41bf6ff4e7f3ced5c782
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 81.9MB
        • SHA256 e092390541c011f145b43d158e40a21cd828fae340f098e77af92857ffb9d05a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download