Overview

overview

8

Static

static

3

2026-08-04...r_.exe

windows10-2004-x64

8

2026-08-04...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    147s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/08/2026, 22:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_a382721969746690d7c91658fe1368a2_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 29.2MB
  • Sample260804-2ftdwsfk2s
  • SHA256 59456f7d7400729aa6711d7579c9cf9c30726553afdd19bdf02c87d452e13e6a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_a382721969746690d7c91658fe1368a2_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_a382721969746690d7c91658fe1368a2_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4124
  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_a382721969746690d7c91658fe1368a2_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-04_a382721969746690d7c91658fe1368a2_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4072

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 29.9MB
        • SHA256 42b3a65a13e956563d133a146a557ab5ebd2888fe26cc002afaa821af202a7df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 33.3MB
        • SHA256 8d9d7aef226914e6b5df95e496e430b2b626fe217b4dbee57c09c8f6d44aad74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 58.8MB
        • SHA256 144aea4e4f30df63390d0bfe1aa04c893e2539ab9cd8b954310e0a10aaf1e259
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 58.6MB
        • SHA256 053981ae367b002bfbf2fde6e879532e873c7691f3c79eeecc0f3e3db22c1a25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 64.6MB
        • SHA256 056f921392f531cc3d0d86e6efb514718a0d730bf0a786af70d775f31a91ec8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 60.2MB
        • SHA256 c8952b5c3b11f50e3bb06f62872c042c6d882bf1dca289e3632429343f79a1ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 60.8MB
        • SHA256 b372bc63e735b7fe2878a44719782beb1c0a0a979d8774c75576f45c81b01bf4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 60.1MB
        • SHA256 4d5cb35520d976790910ce86677eddb1560dde07ada454da9b54338ff33d792c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 61.6MB
        • SHA256 1c8a378bdd916436f4aba7ed3a33024f8b944d01b464525aac6f3fe1fbdd2abd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 59.9MB
        • SHA256 2cc20997e7457d481209b5330e26e151c44117bf2d870e86ff9600dfd5045156
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 58.5MB
        • SHA256 b2f1f6d08cc5eb8ece5ae757393031cbf841e8493da96ec7d3f2d2a4d9f8dd13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 58.5MB
        • SHA256 136ca54c68c6b3508f227912f49d2459cc1af4c4c935f823f6b7081249deacd0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 58.5MB
        • SHA256 9f94e2ae82b12d46eacccaa76f87b696944b80cc2cc6c34737ca43d77e3bb351
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 58.5MB
        • SHA256 29291ae22c79b0d56bd501760453da796fe03571c9400b254df45c5701791ea5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 58.5MB
        • SHA256 8d000a72d912c0621ca42fc44ee813317b91fb944a595ec0bb06b359d362834f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 58.5MB
        • SHA256 4bc1baf5dc3b909e054e459cb2ad3b97e59e4210fdea860d221488be41eb52bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 58.5MB
        • SHA256 580451400c86bdd77cddd68a96ef34bec0f09c41fd6c876eef07eca905f79d27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 58.5MB
        • SHA256 e98db2f37b2aee52c4442a7f8c49aeb76fdbb00f002e4e4d56cc017d4207ef7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 29.4MB
        • SHA256 96227e8b466327f8e25fc7d4aa9696359ce15fded0b27ec51a142ac30e73d608
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 54.4MB
        • SHA256 59fc1584a0118eae740e372386ea4400340a36aafb2046475c33e46e3edb0522
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 53.2MB
        • SHA256 6da5617ccd5f54ce9a88010e44515f60179504cc9bf72da597d9c605695eb0af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 41.9MB
        • SHA256 a717097cc26f917dcd6995197b57b5da120089ac1fdb87c89b6c527306bdd75e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 44.8MB
        • SHA256 cc709b0c54e3493fe225ba250a2f4464830045e66dd7e31b5efe5dc1447ab5e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 30.1MB
        • SHA256 48a95580d6a6e636172e82b529821169ab4c8e3307b882295964dd639a890e12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 34.9MB
        • SHA256 f959b08c065cb58d19520a0d88d455b6aa4f0e826e55c18cf438bfd729962f85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 33.6MB
        • SHA256 9fa70ccb399627d5a852f968dbe065f7028f08ec351fddd1dfb57c225f45bf12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 58.6MB
        • SHA256 f8768b558732c84cbee566bfbc153e1ecbf601a069c4eab930e3842ffb562a6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 58.6MB
        • SHA256 c79daad5673bccfe65c0181066c5ed48916372f33f094f541f0b291c2b415cc2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 58.6MB
        • SHA256 3a0d7ec20358f48809bf8b04799bb19f4e52b8d5ee9df20e7bf8f4bdf1babcf3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 58.6MB
        • SHA256 93b020fa2e3f95f53917769c392eee016c497a7484020e6d4f16904d509aaf4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 29.2MB
        • SHA256 59456f7d7400729aa6711d7579c9cf9c30726553afdd19bdf02c87d452e13e6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download