Overview

overview

8

Static

static

3

2026-08-03...r_.exe

windows10-2004-x64

8

2026-08-03...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    03/08/2026, 16:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_c8d9815f36542b47cef45b4585c20e29_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 18.3MB
  • Sample260803-vfglrstdlh
  • SHA256 c5646012c62c07c7a5ee10546db620b9b83ac67b6374574f36d63042eb5b276f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_c8d9815f36542b47cef45b4585c20e29_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_c8d9815f36542b47cef45b4585c20e29_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4356
  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_c8d9815f36542b47cef45b4585c20e29_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-03_c8d9815f36542b47cef45b4585c20e29_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3068

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 18.8MB
        • SHA256 dc30f0db869e30f144a7b0a08f48fef04b55bef526a4f0a8e235e1a07019f235
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 36.6MB
        • SHA256 10d3548df09ca0648ce6437b0ff375ccdcc29b79101f61489453f50bf08d7061
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 36.8MB
        • SHA256 95f13583836dd963a59c5958446e82b186b8b153bdb944f22c59ee5fb178366f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 36.6MB
        • SHA256 75424f58028308cda4c7c566a9db6e80b0598f6b29ea76dda6cec4af2ad4a20c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 40.7MB
        • SHA256 d3ede14ca766af5812040e5e9416028e2a37ea72c01e8d091723913d863045a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 36.9MB
        • SHA256 cb9a192e19ab19ff128b017db4ba405dc505ad97bb6fad34775911e20c1b5876
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 60.0MB
        • SHA256 5e72b3a435becb627adacfe2c5bb4ecf1780585fa4260618fc4256c347627ae9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 38.7MB
        • SHA256 b997c25903bf1f2cdb44c218d6769912969617a9b0d5c901bf9eb90cfbe8288d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 42.6MB
        • SHA256 350e580e729a77a3ddae0a71c6a0c5d9fa994f4ffba746a23034502017de604c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 38.3MB
        • SHA256 3a432d3850919cf7cbcc14d1c868be2011718da3581a081ae9d890af5c8a3e9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 40.0MB
        • SHA256 ceefd315c9aca608a06a2477904381eab5d343feab707839efd8089ea7f58d5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 38.8MB
        • SHA256 e20d96d8238e3ae5e26dbc1bc7516fbf28e4ce569087c92a34567431f3e10ee1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 38.2MB
        • SHA256 d47d72299f48787e097f0f067c225d9c1d1722ba262397d46236ba8c19fefff1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 38.4MB
        • SHA256 43284ede642fb6c1e556d28ecb6ab52f619291b97b0e6039770e3cd5d1757d83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 39.6MB
        • SHA256 65eed7ba6c637c1bdbbcb791ef10d85439f40e5fcb0e8fe62e25c29c81b09011
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 36.6MB
        • SHA256 460807eb7e033c0f4045be9e2b458ea13579d43f455f2b0704fe7492a9f2c72a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 36.6MB
        • SHA256 21acd1701abcf682349dcfb4d292eefdf50518be4bdf1a80c0fff14d022354a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 36.6MB
        • SHA256 9f71b682fb9b8b27627df6347a61b140304bf1c3559e29e166d12609ed530f23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 36.6MB
        • SHA256 12400d8fbecf11f3c43551a1e11db952578e8cef96850428af81d745aa44a8ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 36.6MB
        • SHA256 cda86b090b23c94417e18990f2730084e263199eb3768daa1eceb95e74ebfd9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 36.6MB
        • SHA256 146502fa3ac073708e1f9e199623751e72f3e777bfc6605dd3da3217b6e30bbd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 36.8MB
        • SHA256 a5b3edde28ab6e01e42ad24d51d39719e77bfab3a9fbdf9fbc51f921f7ba8da9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 36.6MB
        • SHA256 7c65a7f1286ce3b0d1dd332ad6b6a8325b5303cb613ed67cf8c246987401bae0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 36.6MB
        • SHA256 43cddb2ef2916c1cd0d8c84ca65e6eed1fecfc91da2e491aaade077cfbeeef15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 36.7MB
        • SHA256 f9e53ba2ba7eb326947993b16d7aeba9f9dd7930054fd4fceca0e126df558944
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 36.6MB
        • SHA256 be4142788523e58901a42b822c2c950a0a4751137886697d6a14b4c6c881607d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 36.6MB
        • SHA256 38f3e77626d8a7edc30265c4c8a2790eeaec69da9b9a5d310b0edbb4b9127f09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 36.7MB
        • SHA256 8d873751c74e67dcd403fe677c964826f7840dfd366c2aebb368dd8d430fd772
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 37.0MB
        • SHA256 74a3376eb9ba60c65345a903e661e29f8779c5616876dd3da0717e34ec5e9574
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 36.6MB
        • SHA256 bc4cfc2e70934136371e5394676f3cc18b62c7b4a5423edae179d1e5d3f209a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 36.6MB
        • SHA256 bd6e1215e46441903985cd5520579abb16bd0e19dea2f20ef010b8b510e6dab8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 36.6MB
        • SHA256 84fafe38ec3f7980d28d298621122379609432102f9e1c0e899110227ecd77ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 36.6MB
        • SHA256 b64a0bedf7bac78e170484c6b917d7a0fe3d9e121025107d875ef07e1a861d70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 36.6MB
        • SHA256 990bbb9b36df508059ce6f0ce0eff1c7bb0d1909331263325c79682ef742f58d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 36.6MB
        • SHA256 f8138783c472255a297136794279cdc6e6d1065804087495366aa73a8b687bc4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 36.6MB
        • SHA256 424216863abcbc30e5be880ad9e24e40d2ee235d64510707fd7024a8eba9824c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 36.6MB
        • SHA256 d17a5ce04a14ab22c0b43cc32a9f05c0c0e26b7a8d791cb309702c693282be8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 36.6MB
        • SHA256 408163ca804804a43a425d16a838c41065dafeec1401da9ec9a90ec9a4e6c06b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 36.6MB
        • SHA256 059f3ce0a7f00136fd93e789916e191fceeef65b87cfbe7c8f07823bfca44902
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 18.3MB
        • SHA256 0d06d04ae8a168a33f3163a05a5f3bc37b6b3a49da7e07dd1207feb11bdad820
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 33.2MB
        • SHA256 ff464638eb5048968a7e91cf938d3abd40e846f09f46f7e789f6a659b707ff8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 24.1MB
        • SHA256 35270e63cefff8fa5a955a2937a379db2fb34e00ffd11844e2748d888bd58438
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 19.1MB
        • SHA256 1f4bef5ce9d7ec78c982b135eea7d6372b3d6986ee2d817e0cebbaa019244282
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 12.0MB
        • SHA256 434a48cf972a63b122161e582d40957794b065d9bce1097cbb2327a4a55c2af3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 36.7MB
        • SHA256 b4b10a49f4e1da9249b8eb21f27fd45948f7c081a179915194a405f565341d8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 36.6MB
        • SHA256 31ff5bd71dbc4018bbe883bca6b63c68a493263f65f5ebb1b683fdb78ce331f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 36.6MB
        • SHA256 cbd3ee1aa94adcf27069cd413ec2c148fa8abe7ad7bdaaecbb7c28b764cc2e7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 36.6MB
        • SHA256 e65a5b739c8e95ec13dd41e8ee7d0491d9605f4e9bb6e9ba2f0228ab47cd433c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 18.3MB
        • SHA256 c5646012c62c07c7a5ee10546db620b9b83ac67b6374574f36d63042eb5b276f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3068-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3068-6-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4356-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4356-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download