Overview

overview

8

Static

static

3

2026-08-04...r_.exe

windows10-2004-x64

8

2026-08-04...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    72s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/08/2026, 22:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_b5e3f31b1529bbab1bbe3bb778b1c34a_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 22.4MB
  • Sample260804-2brdqszsaz
  • SHA256 d013fadb0221b12e42f20565ae57d0506b1eafe8a25270d9db059d504cb60804
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_b5e3f31b1529bbab1bbe3bb778b1c34a_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_b5e3f31b1529bbab1bbe3bb778b1c34a_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1812
  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_b5e3f31b1529bbab1bbe3bb778b1c34a_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-04_b5e3f31b1529bbab1bbe3bb778b1c34a_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3456

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 23.0MB
        • SHA256 8ff2cd582bebba4c31a45a76f153c039f1ee3e36fa71930b3b748c712327c757
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 22.7MB
        • SHA256 c0a04122bb42cd36b8045382dd84e59f4510c51e9fbe001857199e2af08f39a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 50.8MB
        • SHA256 b08a44d5cc1932b1ec5c0e5785a0dab05846d33bd92251182a69126425a23101
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 46.5MB
        • SHA256 9379d043f25a8bd8e20ead80c9aee3d6980cd49bb72849d6561d5a63dd7bf882
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 48.2MB
        • SHA256 cacec3df21abf66fd86da126c8b204ad8b51278e803df07c100bfdda6cbad991
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 47.0MB
        • SHA256 426d5094803d5a671290984d82043da262393b16b4d757472bdaff9c6c07765c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 46.4MB
        • SHA256 eadda7ac4be39815205def002d0b590d41f1ae03b11d3cdce901bc0d1ed88614
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 46.6MB
        • SHA256 636784b491a6956ced19a24faf3c8b2a97728f03023ec5b3d51ead29addb8124
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 47.8MB
        • SHA256 6727c193644631f090cc62853d98e2757f384280795e0380327ad559c0f4b707
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 46.2MB
        • SHA256 86e56e56a933ca1be1c281baaab47c7d192d5bd5a614c3f9929ff210ce32cd49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 44.8MB
        • SHA256 9184e2aaf5708dd571183350a6f8ea26757b343783a61bd68ea2e5b3a706218f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 44.8MB
        • SHA256 3eed9a41f636b0866c92b3a50409ff899064845f9fdea0508f603b681cb2c274
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 44.8MB
        • SHA256 cf321f78f930a6b812a1612cd9681eb81c4472bd7df9f29dd79391ab3dda23ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 38.6MB
        • SHA256 81fa1d62cd144af267aa5f02ad6d3180513c74f7e249996bc72274989afec128
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 38.9MB
        • SHA256 0008a88e183da198969ca804635d5a5fe97133d3f8837e1c2ab6ad8ef5c87e06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 38.6MB
        • SHA256 a3381329e7f10bc7125d329aa6fbd2aaaf990591f673be28f3c8e185cbf5026a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 37.8MB
        • SHA256 40a512cd80d5bde1edac836f125e9cd94519cdde68537a4025d4aa7a821dd070
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 29.0MB
        • SHA256 956d8400e452b0e39282eaf6d565537dca43f4b42506ac7f97b74d76d2bed983
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 26.1MB
        • SHA256 b747fd29b44c225ce41c54b11d8a7e0b50af4f443cb61a1e134188f13c8dde20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 25.2MB
        • SHA256 0bcc0bea7db459b799a52401595e6599bd50746aecdee0c416b8ba3624d6d5a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 24.2MB
        • SHA256 5949b7a4e92ef23817a8a9e726b9bbc365db1fe9255253814f379a2f3170c20e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 24.1MB
        • SHA256 75aacdaefd58207b56132de6cf5d8b1f46ca089384f3386d2d22036b50e6281a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 23.9MB
        • SHA256 fb473e1ae6cc409e5302ff7234fa4299e3eda2b0fb3abac9c1a39adba3eaf226
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 23.8MB
        • SHA256 ef4fb6b8a5f10eced18c5568601093eab5c57470e9985ffff9422127cde65bdc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 23.7MB
        • SHA256 cbe4c6061e48e59b09563dadd3b3100c3be24225994e478ed4a919c46cf91120
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 23.6MB
        • SHA256 c71cec3283e624b70645addaca72354f1fa6717ff9fbfb60e197fbdd2ae1b780
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 23.4MB
        • SHA256 b50797be0688e52ced3d464d055aa0e60431fa134f57363baa58ab4869d0bd67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 23.4MB
        • SHA256 9b2f5a352c0a0c091e55833cea6c141676f238f88a8fb9df5445062eb2c96c9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 23.2MB
        • SHA256 e822e24c285d947ea020ecd5a250cc4f565528dcb973decf65c44da50c7b823e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 23.2MB
        • SHA256 52b97d86eb6a9b82fb4d5bcc919a2336d6c2508aaf603c8e36f190bd2cb6bf36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 23.1MB
        • SHA256 f736aea53452f79f45181ccb4f17e3560f8493f3c6d5e66000a43781b5ca5cba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 22.9MB
        • SHA256 f0a28cffa24cc7ad78ba6419e8a65b9766501c0c9d70d9862f732950107a8a1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 22.9MB
        • SHA256 23d0b547ab439b1a1be6857963b05f971144d075fab76e9d412a3438a7827509
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 22.9MB
        • SHA256 fec427f077103bd16fadd8e2bb2afa04ec4502ee98508274cf16ac1828af306a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 22.4MB
        • SHA256 20cd4343011fbc7fbc7c60580f71184cd513e017eea3e22fae977f14d9713836
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 22.2MB
        • SHA256 0e3ad35ad43ff645790528a480ba35f386f62511da81e7910528f4957a253a76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 22.3MB
        • SHA256 443436727ac7c802c5ba0fc6f8a0aa8d8dcb76d579d66741607e167159a8b723
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 22.1MB
        • SHA256 7bbe7eb51cedec5656b3919fa2610aa75545867c097c26512cac8428238dc168
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 21.9MB
        • SHA256 fa6da3c228c6960333487302708f914a815f9cb6867f719bb6782ea134059963
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 22.1MB
        • SHA256 0a4192634dc18c9abc53ac65d5f56153d18da663b077fb20ae0814f88dd08a2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 21.9MB
        • SHA256 d57ba9605d162b127b59f3df7a8443acc1be160758d637b9337e2277f464fd2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 21.8MB
        • SHA256 6c36753e3560d4c72a4138486b071f376d9d090408beecbb2ce7e83a465636fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 21.7MB
        • SHA256 ffd54bcbf2364f48485c31f3afac7be757a412badedb4ca8af37729d24c9dcfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 21.4MB
        • SHA256 dbdba876a8288318f9d07d3b800fd573f27bb1804aff2c25ec88280e3b4c9df7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 21.6MB
        • SHA256 b31e7cab4498239eab1cdc25a418db633ac750ab6be93eab623bc6a5d277a2d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 21.4MB
        • SHA256 f64544e732a08b6f93263fa226d81cfc7ee871dff75be5248eec5733563bc008
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 21.5MB
        • SHA256 7f1461aafa965c90e76a1cef5c099ffb93956c0d880effe5e7c3eab247d5812a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 21.3MB
        • SHA256 71de3b1083c7d5f6243b0798a742419ff31ad1b9c9a538ff04d7695768c81fcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 22.4MB
        • SHA256 8fa75b44f58b6f42e74ff5a5c502fbfdf0c1b430c63e920a77fdd1920655a1ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1812-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/1812-4-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3456-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download