Overview

overview

8

Static

static

3

2026-08-03...r_.exe

windows10-2004-x64

8

2026-08-03...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    03/08/2026, 17:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_71de3aff4527606c51a48175197f684d_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 18.5MB
  • Sample260803-wembasxtd1
  • SHA256 7fa80822db8bb55800ac261ee80a6144cf2187355f0c83aa5ea692ce79b63072
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_71de3aff4527606c51a48175197f684d_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_71de3aff4527606c51a48175197f684d_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:812
  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_71de3aff4527606c51a48175197f684d_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-03_71de3aff4527606c51a48175197f684d_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:464

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 19.2MB
        • SHA256 afdbec923a1a887ca2f6529ad34627a025804955fd6f4855c488f75ef862c864
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 18.6MB
        • SHA256 46305d932cd9ab8604d2da05652b104e594f62729ad5ebd189b3b6237e2b90a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 42.0MB
        • SHA256 c980274e165c520f633d0c48079dce49e4c8fab14d811ae3c7d36143648140e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 18.6MB
        • SHA256 1193a42c2d6cec53fcb6b8bc286f8bb29b87c70f24e2b308a0e87ed71b6018a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 43.1MB
        • SHA256 e80269094e4c16be1fb5bb5856af4c5e411051c8fc2c198e918533472901e955
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 38.8MB
        • SHA256 f2a4355bfb0a3e7fd57b7264c847f23545ce996c5f30e4444d05c0dab057ff12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 40.5MB
        • SHA256 c4a38e6bb54ea3a852af5353f45240954310f736cfc1a38c8be258150238efc9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 39.3MB
        • SHA256 224cd65d570602f0e404dcd3857178db59338cede50ddf140c6d183e428a8add
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 38.7MB
        • SHA256 7a3d62e7ebecd6fb0ffb76ac8bfa56353435266c9fd12290e6d4feb781547307
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 38.9MB
        • SHA256 8b4763e4a1e1415033037f47dd4af350496360106f7b503bcf858e4be693eb17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 40.1MB
        • SHA256 34ee2bf29ae183e420faecff7567991c4b763c168ce585cae058d157e071a405
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 38.5MB
        • SHA256 4c7413b2840609abdfbba8e17b0e37b60474e20b88a4f0b93390a580e485a382
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 37.1MB
        • SHA256 856e010c3f0436296ba7152f6fea1216d14185a9f3fc76482bfd8e2d70049100
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 37.1MB
        • SHA256 fdd58c03b532874676164af50f80a7217386756b8eb781a5b746e17521407169
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 37.1MB
        • SHA256 bd49688ae0ee151a75c995b761e7ca291800344bf5f1b0a535b64cd6ac1731d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 37.1MB
        • SHA256 832fc2dcc71d2c88c1ebed4a18c6328d35549467141d7074178136c1fa4ddf21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 37.1MB
        • SHA256 bca7af6b21bdbb88f2bad130a7cc27c5b7caf58e095ae664e9508725f01f5cb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 37.1MB
        • SHA256 36f6db6e05343c1f2a0cfc67a3ed58bc4ec649140c3a179f07df788868a27100
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 37.1MB
        • SHA256 b0ac873166983483ff97c83581421fba73b03eca9173296533d2de39d733c786
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 37.4MB
        • SHA256 4daf348eb18678807f46a0ffd8ec08d00a4491b2b14749afbc52699f63de522b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 37.1MB
        • SHA256 b55cde6548c7983bcf5204e0ae1e156f5e8a116a41ed370c91938bc00ceb7653
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 37.1MB
        • SHA256 4770b5625664b726084d7787ff99a64ed69e54ae1ca1a9256b68fcd102b324db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 37.2MB
        • SHA256 3bb76caf4c9ae28cf55a4597c05f944404fdd4df16687153aba4d0764f69508c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 37.1MB
        • SHA256 69a686243dbeb0691a60b1dbfb222c8c39fec913a95c42928bdc64028d8add8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 37.1MB
        • SHA256 d7d35c4d92ee55e1e88c69307bc6c555cdd795253aa2eac8c3df3b6a389df641
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 37.2MB
        • SHA256 d8f41e3e9d498777996dac37828235f8fba610476ca93483ac65eca23dc480b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 37.4MB
        • SHA256 15d20740ac0695325db98674e820cb07e2962dd87db1e8bae37ccb9ac3550cce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 37.5MB
        • SHA256 e11c12d101f8f6532f5f478febb3661cf6d21f7f3de4f9dedf0c90c7cd1c1993
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 37.1MB
        • SHA256 9a30f3b0dde880cda6822afd8f5a0e217c29ef41b3487b8ebed6dbf430b2e606
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 18.6MB
        • SHA256 1217c41d2919b9b58a70007135df67f9a525fd7f72002e1ad2fd3557275e0e84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 37.1MB
        • SHA256 023eb2875c7c90a41cc6c93c10e628086c4a7606acec2bb5286b50b4dca942b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 37.1MB
        • SHA256 73f8544ae817462c03ddd9d5cebac924934bea15035e3a277e1bd8e0725ff115
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 37.1MB
        • SHA256 5c0254f52a11b1dcdc244d039e274bc30816d98bffac69e13346b1ecac16e0d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 37.1MB
        • SHA256 62229368d7a5d9c6bcaa618665b026d0de5710f6680a0b06363cfefd7f9306f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 37.1MB
        • SHA256 0591b7c022d60c659340462e7e8c86279cca3df73e590e635404bf3f0bf6ab9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 37.1MB
        • SHA256 73688e400f7547acff31e4993579421c905a7b1ea045b46d9515e2cca4e657b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 37.1MB
        • SHA256 48885365924900be84adb8befe59080b09a45602dd7951d08899dad2a90c9d48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 37.1MB
        • SHA256 c74ee20eb716d15440e8f96e605545bd7fcab93d3e434017f586e28ef83b483a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 37.1MB
        • SHA256 1052b771f5875e06f5e79c99348eb9d4f47f1a73e0dabbf841d57832a64db498
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 37.1MB
        • SHA256 e6e50cd4e21493a78f45fecac641638bdebb4f48393c7222d0edd5a9169c16f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 37.1MB
        • SHA256 19578d0d441fb93aa6578e04fe72d2c1a8bd405b2515308f48887255f245e1cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 18.6MB
        • SHA256 18867baca0e17f39119481605dc663803d391095c5ef343e0640e2211d0a3d12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 17.0MB
        • SHA256 269b780228a67447b4c64284342cdfee6f2d2c50015779787568f3d4108d07ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 7.2MB
        • SHA256 88220e995604e281b56b6bd6444612f1fbfbf0ef699ca7e0b79c5470967e25c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 7.8MB
        • SHA256 a935f8183375382c4eeb96ea1fe26f43bf589182563f67c78525577ae05f88e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 7.6MB
        • SHA256 0f34c9b6661e6e10510826a77212a17e22145cabd864112392b49516b09b9bf9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 4.1MB
        • SHA256 972539436835c693b1485ffbed6a7130b8849fc141c80a5fcba39d28f8259c2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 37.2MB
        • SHA256 ff89b8e2709c589b5bab242bf6233ccbf92bcdd2ef9327f5de70ff33aa8f774a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 37.1MB
        • SHA256 78c319a1b88443c0d8eff8dd7e815cade3f6c715284170445cb81d3876bc00ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 37.1MB
        • SHA256 d1ec6b7fb08ffbbc5a52d3cb890e5ee29f57f3b6797f2f10e9350220f121fd1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 37.1MB
        • SHA256 4473a67cccfa276a5328f85ddb84ae0ab29ed7da97e1a3b8bf405d35eb078b96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 18.5MB
        • SHA256 7fa80822db8bb55800ac261ee80a6144cf2187355f0c83aa5ea692ce79b63072
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download