Overview

overview

8

Static

static

3

2026-08-04...r_.exe

windows10-2004-x64

8

2026-08-04...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    28s
  • max time network
    140s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 23:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_3c3bffa6a99257b147e6deb596a498d3_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 21.1MB
  • Sample260804-236mqsfn7w
  • SHA256 5c3f022a734bbe25438ac6929455f70fa240acda5ced13771e45c9f52138d2d4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_3c3bffa6a99257b147e6deb596a498d3_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_3c3bffa6a99257b147e6deb596a498d3_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4740
  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_3c3bffa6a99257b147e6deb596a498d3_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-04_3c3bffa6a99257b147e6deb596a498d3_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5328

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 22.0MB
        • SHA256 29478c6b86267142adb5e6f98fa41f6811613540418b2031cca471c7904c0722
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 42.8MB
        • SHA256 219a13ca8f42d86490a7ebb19e17b8e9107ad894bf18f8574071f311f27740df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 42.2MB
        • SHA256 026a0591f7f06995511abe7c2c0cba462c16f4c58d8da67c331d6dd97ac1d40d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 42.4MB
        • SHA256 8182b401b9a21d6d54321760371b58590209a45bc582e1eb4b1a9cf37f17ee0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 46.2MB
        • SHA256 8e721e87c40f48340ccd07d94dc93f67aee0bd2c97d68f80abb21f5ddcb21b09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 42.5MB
        • SHA256 dfd22a1fbdb543fa1f3dfa996d9a26c1251eda26f77918009e8092910e08b63a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 50.6MB
        • SHA256 ef69dd63ab40ff741a93c172266588877829310b1741a9ea7e593b80e6d6d818
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 44.3MB
        • SHA256 8f58555b09914df14a254c642f0e6b5cd13f86ad53eb3154253a6445b28440d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 39.9MB
        • SHA256 9085f1ba699854f13c5e7754ae28caa11d97ba036445d93f87bf673e7ff46466
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 37.8MB
        • SHA256 b42b28c07efe5398a4647d8ee3e3ed9f885f336cccab1ca150292d875c38ecd5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 43.9MB
        • SHA256 f9ae1b3a7d5ca18a99feee9359870fe31c81fbddbe46749a409e8ec31b68921f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 39.5MB
        • SHA256 76c12220a644b22d9cc731c711e3b484aa87761a090c5e8f58221f354435e94d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 37.6MB
        • SHA256 53522610e020ddbc28e690832e5c99f598c6398891c8a5c86e82425e1d69b551
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 39.0MB
        • SHA256 aff9b59fedd2a2c6ad4e00d32626891d4b3cff2c96f486c3ee55c73a332b9c63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 38.0MB
        • SHA256 8c7f3af4e0752d71d3d7aeb939d826dad62e714e945843d0be1d256701856df4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 37.2MB
        • SHA256 216a76e14a9db762278e4cb45c495027ae81e080d7ee0e61cab0a0c982fac5ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 35.2MB
        • SHA256 82011e56636c93536cec8c8399e403dde264bf8b54b1fb64c3d9272d7be98d89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 34.4MB
        • SHA256 cc45f51a92d01026542d810620a6782b72c362cb0bca947540e5cf959f01d530
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 36.4MB
        • SHA256 5db47ea55c19ea7fbe509143691f0413323248867173b80cef47cf11b5ed26d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 33.4MB
        • SHA256 e0a431ba44282ca1c589d6dbf535b05fa61abe96e9823ebaae03cd3ef6b06c8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 33.3MB
        • SHA256 9142548587673d3d93890b2ee3c95f8bed739e4fd1dac7a2e0529558c5fab281
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 29.8MB
        • SHA256 950b311a863c02a5bb345716af4fcdd8d5bcce031c55ef90e107a1f57e619088
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 29.9MB
        • SHA256 0b77abd1e902215997c2569d70a4659a5a1f07d98214a915a33e094d4267153e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 32.1MB
        • SHA256 adae646a65213c1cd21e5dfc78388fb6582a30a6c54afef7e23177f161d80d32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 30.9MB
        • SHA256 01d13dfc3b07125b2ad9617a2d089b139e919b4760fc2e73ccf2efe896c141b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 31.9MB
        • SHA256 3a28ed1124bdc33ac02610fe4f01a84521f2fb8c22d0ef07dafcb41ede79b430
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 32.1MB
        • SHA256 907a7dbb800ca676cfaefb47a19c0d0856c988d3ad7f603d307496f378843799
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 28.3MB
        • SHA256 274f122ca79403de0adceaeb77f54679276f4b1713d31a98abfc4f659e0db089
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 30.5MB
        • SHA256 dc9412d2ef5ea598b8bb0b8e0677ded500b077cc09fdcd768386f05568be6a62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 30.4MB
        • SHA256 3122fbdc4836841433ad450279ad8b042efda463e5903b1701cdebf46d4631e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 31.1MB
        • SHA256 e9c45fb79c730ef63f0c4263508ed34e44f79f06be1a7b94d0f960a3e3cdfc73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 30.1MB
        • SHA256 f76c39d538b87155cbe07ba0004b9ad9fea9636ebfeb154ca10654dff2d8f726
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 27.1MB
        • SHA256 cd68b95ba531fd3775b564d5572cb447eef33cfd4a37202bb15679b5daea7ff1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 26.7MB
        • SHA256 933e1c24cbcc316dd4e6cf09fd7c132cdd09f12d1711810a2a734d02b9719073
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 29.1MB
        • SHA256 115406db2c5e46d9392193471b9798ca69ec5203bacf4c6f37959f6d61924a5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 29.3MB
        • SHA256 5de2ea8f80e5a4517132b3d6908fbcf582141a09ed84e323354cc8cfcac2c95a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 26.4MB
        • SHA256 3b9d9691f25342984de4f1cf5463a31eeb9b394f5be9c7abe7a789d2f5cfb06d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 28.8MB
        • SHA256 ec6e8340bf4c14a897007374c89bf95e7f748eaa7cfb7ae819ae51a207298726
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 29.0MB
        • SHA256 4a6d6a154c83dd27656b85a29aeb5d9b7aaca1c92deefe36b7f92cbcff5351f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 28.4MB
        • SHA256 e6053ae9c9f385b1866dd734e601df9cfeb7f9a72dabb07a630b695bed094472
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 28.1MB
        • SHA256 842ed9a23a5d6ddcc4f536c4eff3d288371356f62951a51c46345d851cd13b2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 27.7MB
        • SHA256 a8584bd4ad3790990f996818be8b684f96ba8cf7d6cd42d054c338dcb722603d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 27.9MB
        • SHA256 eda51fb3dc457be893f8f1a52e23883ff57fe6b4f7ea51b6bf4db01d28a0146f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 27.2MB
        • SHA256 7f71dc4db3f581b386f7f6b0f98d46a57169a3a66b9dd4146babf206267f2083
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 25.2MB
        • SHA256 723f540cb9af15524d0d15743169790d9a274966ee12b6f6a77494cb2bc79662
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 27.8MB
        • SHA256 801dfc61e5432cd27037fbd1377be1b6c4cb80bc4d80b18f56a86df65640e326
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 26.9MB
        • SHA256 2c57417ecf4a6ebd263107cc5294a2cc8272de37b561665998f3dff127e808e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 27.4MB
        • SHA256 447f113b0a995bbb261b7fbf8e6385b8681e17d657e5ee2ff5073decc458a752
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 24.4MB
        • SHA256 27d1c4d4018b45d9ab43d6d0ea7ee1655c0123e1ffeca3c51444960f3b53754f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 42.2MB
        • SHA256 4dc51d6fa7b051500548ea884eb813f619363f5a29e190d947ecf1b34d7c26c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 42.2MB
        • SHA256 3ee63fdd6473a680ee7c26915d905deded76fd713ebbd021e9dee9b43584be09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 42.2MB
        • SHA256 8af943fe994139499986d652f65b181fa2036c04ec5f5f116610f2ce54fdfba7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4740-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4740-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5328-3-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download