Overview

overview

8

Static

static

3

2026-08-04...r_.exe

windows10-2004-x64

8

2026-08-04...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    46s
  • max time network
    158s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 23:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_1fe69ff8749760fff037d69202869f93_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 30.8MB
  • Sample260804-298exafp9t
  • SHA256 a312a10ff22d98e19fcb55260896569800978ca9df67b27af32fe2a820788aa3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_1fe69ff8749760fff037d69202869f93_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_1fe69ff8749760fff037d69202869f93_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4348
  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_1fe69ff8749760fff037d69202869f93_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-04_1fe69ff8749760fff037d69202869f93_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5112

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 31.4MB
        • SHA256 7f5504eefb346dbe0acf6237ee6d1a58eb19d116fea554c85ef2edf3780336a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 30.8MB
        • SHA256 a312a10ff22d98e19fcb55260896569800978ca9df67b27af32fe2a820788aa3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 30.9MB
        • SHA256 48fa179ce7e9a4309f38bb3e9f90d1b8b169bd202b381263034f53f8e10b8125
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 61.6MB
        • SHA256 3a9cd9070aacac6b82d3ecf6b6497e2f8209dca2781e47416eeb5cc6c76019e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 59.7MB
        • SHA256 7cd2f29f3bab3705dedd12367e99eb2aabdf75a9a9353a3aadcac5f30fc63a68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 60.1MB
        • SHA256 e0b28458269054b15c46ed46b155505c34b088186696adb5363a5015fe061597
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 56.8MB
        • SHA256 836e6377a141e3b06ad3c9e1a19e5eb796d4e638fdbcbd229584a0581dc41e30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 61.2MB
        • SHA256 b5d3f6e7aeac07ef50198bf81160e3b92ff1f10e8bda6bbb7349241b5180a877
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 63.6MB
        • SHA256 deba0c2ffec99cfc56d6254a38b2ecc88d72da849eefc70d3d306fb8fd28cd0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 49.6MB
        • SHA256 217fc642f0afa5aa7e98c2ba0ffd55a94bee784b8b4820122b039869b8a17f3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ConfirmShow.asp
        • Path C:\Program Files\ConfirmShow.asp
        • Size 53.3MB
        • SHA256 dedb5d1517fc3a8b9ff18ecb376150bb4106a9d6ef3e3906a255644d887cd289
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 49.3MB
        • SHA256 86bb7e4f22dcd4d9e7c9002b3fde1c7d4e9a54b38b95538e774c85c97d43490a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 47.8MB
        • SHA256 20d984ce69b06b9a90424b423b65c8e0a565c982dab7c6aa135f535d12df3dcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 50.9MB
        • SHA256 a3f38dc2e5cb535ed2f9e9f9bafc709af3cf6907cbbc4e4f7ab476e013d9e295
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 48.2MB
        • SHA256 7bdca1513355c36d0555ed34114ab670a45a71cf9cbd3c532e286a631fb0a132
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 48.2MB
        • SHA256 1872150cd36b539ff5507a97d44eaa5bb282a3ac1c59020c816efc00278736fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 47.4MB
        • SHA256 7f54e7e55faec6348084da6a3d6e0b0b15e1537ac000db8d66bf09ec41073022
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 45.6MB
        • SHA256 ce2ece3bcaddb64174c1618df7778fd278366283d02e6b7dc8388338d9f7245a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 48.7MB
        • SHA256 ef7ba4efc8e30eae44f54e3186ae1add952504bbb12b4dbda81d37f8694c356d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 46.4MB
        • SHA256 5ed97030176eb5ff7542d0beb090b1f41195668e3d279d6cd2ab12cb737e5cef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 46.2MB
        • SHA256 a99d8a7465849716bb86217e2383371cd38d191e5a50943db9f0df8a6fad42ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 44.9MB
        • SHA256 568b2d0fb39355a2fb0a4f4ec3362bd0a011f5e385daaf6d7c50314e20e79a9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 45.0MB
        • SHA256 adc374be8ef39cf6e64f0f13ab6f07f553e772baf4cdba4f8801698a842d28ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 45.3MB
        • SHA256 20b36c9f48e8ca2f94e27bac4f4060f6674f4f8af61980732156973a3df4962a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 42.5MB
        • SHA256 9863be9379103bb08144f739acce1e264a5fd541648c004c143b86979b1b424b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 37.6MB
        • SHA256 909ba79f4f035db006a3c1564938932bb939f75db80ab8f9918e54ba200515c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 41.1MB
        • SHA256 87561a7435e78f116e451a6d3efaba906aad73c4c439a2b20883b62d28c6ec24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 40.2MB
        • SHA256 cc9e5404d7580f52c49c55066f7ca5dd9f8f48efc6d750867358b88a49ed1cad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 38.4MB
        • SHA256 938e6ef0b648d12eb4e95fbc8e747e54217a4eac05e5f03040e9ec7bfe7a92da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 37.9MB
        • SHA256 470c50d6343a7284b4761f7b148c9b7cd4d55c7155877b62abb5a6b619856343
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 38.0MB
        • SHA256 2dbdd79419f29e8154c2cf11c72aed11fb7c8c516c6e5266e30962cad3cc8f6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 36.1MB
        • SHA256 9435da86cd952a7284a8a351dd0ab7b039d0e20c56b6e96ac51c9298638309f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 37.4MB
        • SHA256 8f17fd5cea7555a31bb4492cafdc30b1a4910f5d35097c8a6b286c2fd10301a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 35.1MB
        • SHA256 6361a7e6e25de35ea30196e66e5fb27e157a5f8356689cbe575912ec031a5187
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 35.2MB
        • SHA256 d1808c54068af8ae0935cda203b564644e9d0c51cb38b20d765b1d8858a8ab9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 36.0MB
        • SHA256 8da9ca4c01fbcceb42a34c906fae88e0767c42425f12acb5bd8e7aa9be19dedb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 33.9MB
        • SHA256 9c6adb2a47951719ff95a9cb42333972cb49bd6ddc033742d59909f77bf8bd18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 33.2MB
        • SHA256 d75d1f2831dec1920193c56a1cde1a79266b4ca022981fffbc9a56f51e0cfcca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 33.0MB
        • SHA256 8451ead2b2231e89211e24253f23a3bc5c9dcc4c2cf58f4eed847ddfb0f41b65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 31.3MB
        • SHA256 036f274790dcbe6a3c50ab712e4108a6c69c8eef6e3deab380c6e89f91fba54c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 32.1MB
        • SHA256 1540fca3d850ff6bca63dbe8d6ddb326b05c9a205f34b913f4d756aabbcf4c7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 704KB
        • SHA256 d00fd9890e5b8b4ab20c6c689c78fd344e6f1bfc77541401e70ed34840570659
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 26.6MB
        • SHA256 3d4ddbb187243c08a64d0315102f6305025687ff9909cff6f23af35abb880cc1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 28.6MB
        • SHA256 3d838fa78b8305dff95d347f8b71ab766ee589ae13394ac996e300be344ddf4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 28.5MB
        • SHA256 caa8f02399826673b13793d755c2e9c33188079ab805d66dbaae683f34399803
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 27.0MB
        • SHA256 bfc7deb536e28258e282976af9d24e5a66f61c31d36378fe629b61b45d3aff12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 27.0MB
        • SHA256 307bfd29ca6981cb0a4a4524f865ef268656d924e56004b51878c0bf6f72df77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 26.9MB
        • SHA256 0a68871856f571e60ae20712f0258e088e214ee85a98fcd82b5fcaf96cd43175
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 27.5MB
        • SHA256 e09a7125340cc4fb61609bd1a845531120943f4a7f86e71c385f35a7c1014329
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 25.5MB
        • SHA256 fc2874a0bacc8f7f8b3334e5cb3f0b16763e0b2748143b984ec12daa502ff5e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 25.6MB
        • SHA256 24a8a22a78b8e9ba6268c1a5fc9aac1a06cbd70ce4067b3790662543fb2286f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 48.0MB
        • SHA256 d3353050754abd36ecb44154d3210c700278bb4b732fa6d0409f4480a3c4125b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 51.4MB
        • SHA256 8cdead50375673be2d1387ed47beb60f06f9adaf2ae1dbbcd88ddc58fd965aea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 50.1MB
        • SHA256 3666c84f13665a749a5371f6504aab515c33f8fc328c062fc0b8fb748ced2b17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download