Overview

overview

8

Static

static

3

2026-08-04...r_.exe

windows10-2004-x64

8

2026-08-04...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    98s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/08/2026, 22:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_8c0e149abe3e8be09ee92c889a0af99c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 19.5MB
  • Sample260804-2k6vsasbpb
  • SHA256 1fa7e91876e7d7d07be3a7d66502994a6b1e1c88b0d4032b002f030ed280f57c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_8c0e149abe3e8be09ee92c889a0af99c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_8c0e149abe3e8be09ee92c889a0af99c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2372
  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_8c0e149abe3e8be09ee92c889a0af99c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-04_8c0e149abe3e8be09ee92c889a0af99c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2672

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 20.1MB
        • SHA256 854fe315c6eb8308e41ddfc2e1cb956cf3cae8e8d65f60e1c05939672c20e7b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 19.6MB
        • SHA256 44e9e99d2007c8135ce9193dcdd2af77961b54764a616bad10abe497304da33e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 25.5MB
        • SHA256 58923ae368ef5e2bf4452099f23d2841ed2d656c8cebb094866d4680fe28fe3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 20.9MB
        • SHA256 62c567655c06c0ae81e933ba516727181ca448a331333dff0a9f8990b3417e48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 38.9MB
        • SHA256 5abb359a8194e7e333cb0217955b79b334cc4572f8c7c895d55cbef2ea01cac5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 38.9MB
        • SHA256 77347fd0eb8e1205d726f3ffe3f7e99ba41e1fc356621837ba259b48c79f151c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 38.9MB
        • SHA256 8d9518fd7b75761d4bf37507789e52f00cd07e2e753bbc8b09cf12f82afab941
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 39.0MB
        • SHA256 77133cc979fde97d3b02d6a73a971f07eceb9c87cd0bee395e64c09a5b57d680
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 38.9MB
        • SHA256 81134b253ea2f0916153b528015e0a5aa542a4b241b4740dcf134c302094f142
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 38.9MB
        • SHA256 59b569972076d67af96ca6c82c119d13c13c2b00d35f577df54bbcc0554b26c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 38.9MB
        • SHA256 a7f4924d890cdd0b446238aa0efdcdaf62cd4662a81885ee3d0392a5fe30184e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 39.2MB
        • SHA256 0bac414f80415e04e05cc34a528e277f92e9f52552c93db3ba81327f6d32a3bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 38.9MB
        • SHA256 346da928a5c30fc85a39aac081b7199c99b38a6f92f5ed56bf50c983cdb48163
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 38.1MB
        • SHA256 f682750fcedf7d86c65202a435ec81d4c012fe9e9c39f66256d0fec8988500f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 39.1MB
        • SHA256 434d1971654507f878dcff23cbb09f59e8dc3bfcf9a5724f47f1635f30d403e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 38.6MB
        • SHA256 53e207e5202f36fa28681ff6b38da09ec8dcb372b0ad3123e05bd093d7f4b356
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 37.8MB
        • SHA256 f42ed1295886e36085ecf93ff6791ddb7722067c713aa34e532387a1ac415339
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 39.1MB
        • SHA256 14f97feb43fd5c8f814740f7a95a5db02086dc7ed1aa4fc76e6256daced465b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 39.2MB
        • SHA256 54670ff4066811ece313ce0cc532944edc90e6ea5e057b85e7406f842dbe651b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 37.9MB
        • SHA256 ae8732f68345abd50d74712557d7a6bf9401afcb33a1b25c8383d3e4c6a0ec5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 38.4MB
        • SHA256 e891b06b69c006a16dfae62dd2c02d3eb02efabfd73271aedf20d8ea617f741a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 38.6MB
        • SHA256 d9caa046c456e0b64780e890b900fe131ff9f43c3602a5570e2aa1a6eedce431
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 38.9MB
        • SHA256 7db3bf483af06dad88459d6799ac5dd73cccd3d0e7dbdddba151ded19004280b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 38.9MB
        • SHA256 5829c9793e23eb9f6a09129620b6709383882b13d57322d23604445cc7d02b60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 38.9MB
        • SHA256 84e591f7d35e215150566b3398a3c57ebea1addf7650d3c8f243c4c10d0dc752
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 38.9MB
        • SHA256 70c7190d52032a238abc4619f5b59d32a7d77cb8c3e2a70ee6f54cc39b806063
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 37.6MB
        • SHA256 a6689013ae5e18d45da5f7e9f02a3babd931c2a888543110566030406dad4c04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 37.3MB
        • SHA256 dab2742f1e358d9870f5149026581cdd77dca4a9b16f3297c1a64e4cb9544c96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 37.2MB
        • SHA256 870a4ab4044699b00ebf36a581d59b6fb059c48be5b3f8fc5f8af4a42818bf2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 38.9MB
        • SHA256 2b72696ff5085603e14fb5385d6933f03d5cf8be3d25c5229c6febd738e6ca07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 36.9MB
        • SHA256 a3cc05d865fa0c5452746645dccdf1f26f3efadee40155e418c4a3402efdb747
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 38.9MB
        • SHA256 18da6f574b00326b8b1c64ad8b4d9810fc427fa502e4e34ac3ad3841db5f6184
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 35.8MB
        • SHA256 e46cdcff2eeeb2e7a03c952a7dd6241ea463b91f19545bf7d7d53b495d4c8d4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 38.9MB
        • SHA256 6aace832a805bd8ea239ccda7c44a83f74184956cf89f1111f14cff6b10bca13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 37.6MB
        • SHA256 45dcbb50791ad420e132582667f3fb74b144f77b1d10d0d98884e5e912a557ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 33.8MB
        • SHA256 b2a08e90be0aa6b0a3d2104dfbac6f3aab91cdf9acb3f9f79131359ba6c26077
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 35.6MB
        • SHA256 5f51230e167b4d59f8f26481c8eea6e1a7f7927bd6ac13e30aa97c4349e4d73a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 35.9MB
        • SHA256 4cfba8d4b0656812c441cf84b0ba5e9f40b57ad979e5a4d813967659d75dc74e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 38.9MB
        • SHA256 91576dab761b9fe8a57ca173205831064c6a808fcf5d7b7149984b156a73559c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 38.8MB
        • SHA256 244a450899e66ffb27995b178434d18344e470847f38f606d5a31595147e2192
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 38.0MB
        • SHA256 364972049c517e692c686a6aeda22f3433c94e6be81845d2613011b0f8919270
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 34.9MB
        • SHA256 64c3d1ca24482434bbc6e777c1c410d1fb2b370b29c4577c9f07b653b122ad41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 34.1MB
        • SHA256 717cf2f5142df96e04af86dd65a76c5f16bf43d93dcac8013bba9285d00c70e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 35.1MB
        • SHA256 63fef47c9179c5ad59d586543278ee3bb46f0a97801b50f7601b168eb8169330
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 36.8MB
        • SHA256 5e01f7aa96b76efd55b469fd9a50a9f61c9a73d91a300fe812330dccd9409338
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 35.2MB
        • SHA256 fb4840c404d395b64c7ad0e2f1ef1a547922a9629edc2252505883b7c0491b55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 34.4MB
        • SHA256 ad6a300e3324c0761bcce41d078ec5863c0c9b1746f4da2c681cb8eeddf45411
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 34.9MB
        • SHA256 6dc38c89cf942e56c7ff1282b85cfe15797c5fe09d757519ed981feea2e4c540
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 37.5MB
        • SHA256 c96a065f30efbbd12ebfbe7a01051a08bf57fc648b8d4dfbdeffcab70af85c87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 33.1MB
        • SHA256 38b6a599078bcc5e9757b667c97deb66031f3fee58aa1f36b5c60c3d5f24978d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 33.9MB
        • SHA256 029d9bc0c32e6e1281d76c49c75b9b5b2e9c2774fc20876687ad92c7c2f0cce8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 33.5MB
        • SHA256 4722e2c1161c2d334ec39a04771ea0787d1ef15c99b13a3c887d94dfd1bd87bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
        • Size 35.1MB
        • SHA256 433095b285d2dd2fcdc27bb892a98fcf0b08dd0887f81eb3d5254a01a924815b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
        • Size 34.6MB
        • SHA256 8bb4520a1150795e90db865b2d83cc688682f3b6ae573064cacb66d0e6b13c66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
        • Size 35.0MB
        • SHA256 22288f3871dae62bf75150de99eaed76f1a46f54f351479315fbe0832c831664
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 19.5MB
        • SHA256 1fa7e91876e7d7d07be3a7d66502994a6b1e1c88b0d4032b002f030ed280f57c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2372-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2372-4-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2672-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download