Overview

overview

8

Static

static

3

2026-08-03...r_.exe

windows10-2004-x64

8

2026-08-03...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/08/2026, 08:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_fea90130182efc0623f3faac57c30619_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 35.7MB
  • Sample260804-kn2lsswbrg
  • SHA256 988990b36c2243d982127f9f964753804546d35027481a7d6642c1b55139d45c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_fea90130182efc0623f3faac57c30619_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_fea90130182efc0623f3faac57c30619_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3760
  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_fea90130182efc0623f3faac57c30619_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-03_fea90130182efc0623f3faac57c30619_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3352

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 36.3MB
        • SHA256 49d2456e90747bc50c132640078976f9c902f9c8c30538ff5acde09bf5913148
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 77.4MB
        • SHA256 f08fae99008510aa9ebd694e4de18ee390542bedab13d3f3d2ebb2daafafe133
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 37.4MB
        • SHA256 6da7911acf4587049e933fc5aaa4ce1d73e4d24630961770413240407f81e72b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 73.0MB
        • SHA256 9b245f1dece44bd1dd17806c4af2a3e198c0d01a34ff78b74c9dffec7e2a1b73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 73.2MB
        • SHA256 9dc8a328b659dfb3bebcc7b63a1a66f2ce93d8e4b7551bbca9f6654b4fb5046c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 74.4MB
        • SHA256 e20927e8e10430f6b2517def49e5948975a9581712336bd757ee2c3e167ed993
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 72.8MB
        • SHA256 fe6d03df48cb8915e1a6655c7109719dc01ff622583598568f4938588ce42805
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 71.4MB
        • SHA256 fa2ba08e0f70d6ac9e00fafcd233674f7709f8c631e6c53af5d483cf912f0c45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 71.4MB
        • SHA256 00b38df9800fed49b9b166c16ac2d7978b87e445a72024f48f341673b010acac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 71.4MB
        • SHA256 1895dcafd433ce0f70c7e35a934b16d133bacfa43fd8cff0ef12ba15f0bba21b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 71.4MB
        • SHA256 d0c62dcb318e1a127d31df16ee1ca4ca2c5223c451eb2a216f97c160b22fa8f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 71.4MB
        • SHA256 222d649dec9d3fd222c24a5b951ccb7a9f5632ea3e31a02e60cd314460599d96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 71.6MB
        • SHA256 65a36d2f6a4214e268ec8ce7872cbb74cacad6019f72b29ebc10e474e55affbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 35.7MB
        • SHA256 d0745741afa979931a1d4593916e5bcb381df7bbca3927c2386c83d5342baa85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 71.5MB
        • SHA256 6f69f03080087511d719eb4b4697a519428d49fda2541fdc0c57051a76febb6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 71.4MB
        • SHA256 6c144ec98c694007d6fc38c7499d517787958fc4a251120b521750f2da87ff5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 70.8MB
        • SHA256 ca35b57f950138f8f31f3d4fb0166609af65711217573f9c3c7660003c80d18d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 69.8MB
        • SHA256 01a4855c956bea467ba7f277efb740ab49dad32d547b276fa4ea7dea1d9852ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 64.9MB
        • SHA256 26dd39ff48cea5e05bfbd33827d7911f58b89179aac93b9645e2fe4cec037e7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 53.4MB
        • SHA256 7f984b79d4af2274901e64457b12be2c25073ff0e050b5caeba5661df9a1f5c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 56.6MB
        • SHA256 881b866cb82029ac2e74d8565d9574c5611c59d6952d7724c41abef0c6fb79b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 53.9MB
        • SHA256 77fe2af07e9341747041ad5f3b96d35669cc559042e6dc81b7bb6b6651850750
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 35.7MB
        • SHA256 49d911ed9fa4dc784889d9917597f76757d548b99db52002ff4d230014450a8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 3.4MB
        • SHA256 ff561ac519a45343dfb1cc771d76b33905c71591a584ff08f3e29ad7330b6020
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 35.7MB
        • SHA256 ca5fb6c66346e74e5593872044d9eac8648fcfcd6ecf19a5012a3c2d92125150
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 35.7MB
        • SHA256 988990b36c2243d982127f9f964753804546d35027481a7d6642c1b55139d45c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3352-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3760-4-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3760-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download