Overview

overview

8

Static

static

3

2026-08-04...r_.exe

windows10-2004-x64

8

2026-08-04...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    29s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 22:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_a382721969746690d7c91658fe1368a2_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 29.2MB
  • Sample260804-2ftdwsfk2s
  • SHA256 59456f7d7400729aa6711d7579c9cf9c30726553afdd19bdf02c87d452e13e6a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_a382721969746690d7c91658fe1368a2_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_a382721969746690d7c91658fe1368a2_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:6292
  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_a382721969746690d7c91658fe1368a2_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-04_a382721969746690d7c91658fe1368a2_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:6788

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 29.2MB
        • SHA256 59456f7d7400729aa6711d7579c9cf9c30726553afdd19bdf02c87d452e13e6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 58.8MB
        • SHA256 8dd62474b754c9e1d50bb7a273b1b8e1894abba1b2d62480e5754b6befad2fca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 58.5MB
        • SHA256 f37ad6ac770c891a428651fdf257b579c6fafe0aed4265ec856d97cbe495db88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 62.6MB
        • SHA256 71e9a640f79cb8c315f6a7b422ce992581e3c7fcbca46e0e5e222c314754c4b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 58.8MB
        • SHA256 144aea4e4f30df63390d0bfe1aa04c893e2539ab9cd8b954310e0a10aaf1e259
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 60.6MB
        • SHA256 eedbe021bed52cc1b7e4e4967cb8babffa4a3e75d16196f702f0b1c7d74c1082
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 58.6MB
        • SHA256 053981ae367b002bfbf2fde6e879532e873c7691f3c79eeecc0f3e3db22c1a25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 59.2MB
        • SHA256 3ef13b8840c95812f931f01e55281024ddbe1d03321aadd136a0bf28b99351ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 58.2MB
        • SHA256 d21559b846579328ec90c4fd81f6d38919db7fcdd31c0ffdf973b6bf2f6af8ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 60.2MB
        • SHA256 c8952b5c3b11f50e3bb06f62872c042c6d882bf1dca289e3632429343f79a1ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 59.3MB
        • SHA256 3808398830e4e1460c02367693af32f1b055fa723b9f85be01b89e5a2edeafaa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 54.4MB
        • SHA256 4e805cf4da839f1ef0edcca5e9417f8eb5cc1a50b7c24945b99c8b19e40db2c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 52.7MB
        • SHA256 802601e6d5e615a8c9b347ee69e5a26ab7ce90036b662f5c5e038a9bea748674
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 51.1MB
        • SHA256 906d31610b68b892b80071595ac61b27d95d3474bc32b99c9a3f1d87a04176ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 49.6MB
        • SHA256 6599f9c89909a30e20fcff15b5bfdb4ec5a6632d722d64ca00be8e59a85678f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 49.1MB
        • SHA256 3d0f1618a335e2d87d2a35df4ea249503a0ac4b3d1b1ec8c4621f38042d7dd0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 512KB
        • SHA256 fded04c6d782f8085d397cfe282605c1f1fba531c6920ee79072db343ae14316
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 48.1MB
        • SHA256 de86bdc8a9e25947e497d21a748da8dd92f6a02458434f629540685800e03420
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 45.2MB
        • SHA256 37601f4777a61823d23c665b4c28cdc37b1b3192d15cea326f11383040c861d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 44.2MB
        • SHA256 e9476895e1ca696383793604b1ef880a365411a9181d0203417a519cff396e2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 42.2MB
        • SHA256 0005c5bb974f25cd0901df0d61693b01415d6cad2e9f10d9458253919461f862
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 44.3MB
        • SHA256 ab952ce423beee592fe5b3c1861fe147ea53559c17c84abecaa96bcd9a7b2750
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 41.6MB
        • SHA256 bc6ddff153ddc8e27ca6e8dbde99b8e4de09eeaae546cf8671491dd0c981efb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 44.5MB
        • SHA256 cc136c2dd14f41c4fbf23e37ba35f84655157f71cb10edcd079636d1d9054ac9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 41.2MB
        • SHA256 fbba2accd19aff707543697d43d8eec024a8c3af76749d2293787aebac97ff32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 42.6MB
        • SHA256 e367e4e8db6daa7802afc3f138f0206cc49b25746073e82e9006d929e6aa6f85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 42.8MB
        • SHA256 2a3dce09a35e298add624e6eb6a496bf13367ac80b86a5ae2e2529014c8d6d1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 41.9MB
        • SHA256 a717097cc26f917dcd6995197b57b5da120089ac1fdb87c89b6c527306bdd75e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 42.4MB
        • SHA256 da0b2dd2a373a8811bc9dd2589363fd7d34234df1d4e84d1b2107c3311aaed95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 41.9MB
        • SHA256 0a2223f38479fa87f85d9f4c933a5483bda6e3764543674c3c9fc41c58bdbe45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 42.0MB
        • SHA256 d3172c2715b9660c0005986aa416432c49943470f4a1d725ae5cf6647c1906ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 45.6MB
        • SHA256 d8dfa46080391e75ba20c3874f8ff5634ea9b8a8abc4bea0cdea4263d96847ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 42.2MB
        • SHA256 ed97ca361dc63eb191b159f5ac281ae5f3d58d40a8b617a21525c7a47f2505d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 40.7MB
        • SHA256 75ec872e68955cc9f74d8daeb13487785af0687ef9938254702d431f6db788d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 39.9MB
        • SHA256 3e8a3b938fb5ec4ea96f986611c62e77420fc2c041b363bac3e97e76f7c2648a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 40.6MB
        • SHA256 52936416e7254acb3f6a406e2d61cd65ad50505e5a5f3ab8b6addb195dd778f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 40.3MB
        • SHA256 36d7b48b23a5cf92d1a1171f9883018a2a9964a4a9e93d0e2213f7aed664650d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 41.0MB
        • SHA256 49ad3a80e37b73a52fe4463966991870193202c0c219916cb518e4d101a80566
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 41.6MB
        • SHA256 8247b60d3124690912a4c59778865b127608076eab17c3fdfb5e5699eec24369
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 39.4MB
        • SHA256 52ad029325e462bdc5b8aca4c0c2f9ab298648643342592539a5f5b7e1a4ce22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 39.5MB
        • SHA256 c72d6135118fbf5cccb76eba5cf27306acf80deef2fe1200e6f89b8e924f78bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 38.9MB
        • SHA256 09965c8d9cefb90d3becefd6edba6a6203a3156323eb11a1c2dec001e2fed26a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 18.3MB
        • SHA256 6f88bf91a43ea00a2fffc7fd53bd3a1589912ea43f3a46e723d22819e1372788
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 15.2MB
        • SHA256 3020c157810fbf59a727890c608c420f87c847cbd3b2f3f48d9693c6a1cf0614
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 17.4MB
        • SHA256 8961634f7cf69bc8cfcf647d1e148bbe8d7fa521b619171846bcb0fe17d796b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 16.4MB
        • SHA256 08a02a9e3135f33a74d69576274452d0a0653569965e780b58871a8e18d5c621
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 15.5MB
        • SHA256 01bbf345c9aac9aa824a26d82b9249c09f94d77dd10539515cd6915814c38e2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 128KB
        • SHA256 e52488a8a3c5c15a2f928eb2127c84d20ca0143b2598bd3c627a271a6a7a3d72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 58.6MB
        • SHA256 f8768b558732c84cbee566bfbc153e1ecbf601a069c4eab930e3842ffb562a6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 58.6MB
        • SHA256 c79daad5673bccfe65c0181066c5ed48916372f33f094f541f0b291c2b415cc2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 58.6MB
        • SHA256 3a0d7ec20358f48809bf8b04799bb19f4e52b8d5ee9df20e7bf8f4bdf1babcf3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 58.6MB
        • SHA256 93b020fa2e3f95f53917769c392eee016c497a7484020e6d4f16904d509aaf4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download