Overview

overview

8

Static

static

3

2026-08-03...r_.exe

windows10-2004-x64

8

2026-08-03...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    46s
  • max time network
    132s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 09:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_c8ba33130e929b3d28111161dcf313fe_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 43.6MB
  • Sample260804-lrsczacl4t
  • SHA256 c25df6ccd8b98d5a874b703b57baee70907201307dc85669f6a4c8057cb52a37
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_c8ba33130e929b3d28111161dcf313fe_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_c8ba33130e929b3d28111161dcf313fe_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5292
  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_c8ba33130e929b3d28111161dcf313fe_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-03_c8ba33130e929b3d28111161dcf313fe_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:8

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 47.7MB
        • SHA256 5e6c9ba5e51b2527deaa0211230aa79f386ef907eba6cecca8e147578ef600f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 87.5MB
        • SHA256 3a08e691526141b3d813fb7ec0b4c077ee8b84dd03c5474f48febf9f33d14983
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 45.7MB
        • SHA256 ac2d7fee9356464cb4811e1d208c04f9acd32496cbbce9b7b20043be98ac3b5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 86.4MB
        • SHA256 38d2b8ae02f5e8c3e79917f5ec74632ac1ed83fd34ffb2da3f25a6fcdc5d6f0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 72.7MB
        • SHA256 ca1bcb8128bf2d15dc23923906937d9e9840452cc5889a41bca774d1d2e2f6b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 68.7MB
        • SHA256 82c802eaddce7206a4adfbd4f65004ef1619415431ae04eeaf1d45d80ade8901
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 79.7MB
        • SHA256 8b3186469e06c983aa1bcaeaa0943631c17b050fada6b9d0452ecb860a61a1ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 77.4MB
        • SHA256 8437311823578477a2360f479fd3c69e2eba42b4853f3a19e1f96b8487af5573
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 75.1MB
        • SHA256 f04440fb869caf1b8e502621e45632f5ffbd0aa74abcf88b460ca391a6da4522
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 66.3MB
        • SHA256 eb1bac89565e368ac7ed3eb4e5cfd56f68716b2a242f26c7536e0e52864fc1c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 64.2MB
        • SHA256 85cbb6828714bdc2c3b2cf340fffabb147ad3c78cab5541bab6ad59775002551
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 62.9MB
        • SHA256 f92b3f3fdf4495c25abd32ba3c571b9b21d983cae07771f1ce8239c623d97f7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 61.7MB
        • SHA256 d5ca5d9304460f12ed62a163fd00e5fdd406d54ee74673e6e2daa4a706c5ba1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 56.1MB
        • SHA256 23f04a44f90dd781815fa4ae4b6e362cd4b7660044c93866c7ee1a4ab97cd7b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 56.2MB
        • SHA256 759a36bf8eafceb7b3a0e86b25c5667c247c4bab7212bd42aab98e0928b83467
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 55.9MB
        • SHA256 d543713eb057d5f084f761f6726adb7d28f18184e64e2b9982017c0fdd3c023e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 55.5MB
        • SHA256 8178665bbd38da77c94c87ddbf616f3d91a95db96fb86d43e61f17be85dcfe87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 54.8MB
        • SHA256 d71cb0aec206829265afaf55647c41f58307477ef1a1ae0f7db30fc9f7be9da8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 576KB
        • SHA256 9b9dd530b295572b4946420b8542313a6c2a581d9a9ea1114d003faa51914d08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 52.4MB
        • SHA256 ce03357bac08e81efe994e63e195bc323cfede2f9ec8ff84faaf10e35cf3c9ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 51.7MB
        • SHA256 d4e82de616293c10c1f97431f70675a6afb36d60a7f98f32a2b1cf136ccf13ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 49.1MB
        • SHA256 adb19e1f74b77032743fd97eaddcb65669c2eedd27ab5d4a94daf1db2ea9d961
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 46.9MB
        • SHA256 f954ec90f7ef2bb7251d935080f6d23ad839ab5b39b5e78af68387bc302453dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 44.9MB
        • SHA256 ce852b0dacd2d956553692e284070b9dd3b4ecaa3ba761ae5afaaf7448db8c51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 43.8MB
        • SHA256 b73225555f80c5db7f649afe00792995282c199195f30d87160514cc061024a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 43.1MB
        • SHA256 2b01b7946bd1198450917d9e5204af1ccde7aa979c223ce55566eb95d4b79aaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 42.8MB
        • SHA256 e658c02e309ebe1403d04e74e30cca338ee517f1edf225bd2f829244beec80eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 42.4MB
        • SHA256 6d09dade7d0d045947b55b77f41ee7197881f011bdc82677609a4e24f896e5c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 41.9MB
        • SHA256 5aa192aba3688bdcb63970fa568359dc61ebfb462ecca0d6a77aeb406c90a8ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 41.5MB
        • SHA256 ede710cf99d5bc6014315ac4a053f74765bfc5ab83caef729dd4904d9606b7c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 40.6MB
        • SHA256 929ff3f2afe05875905531eccf43ab0b618ba6d925625c23ba7a81ab7e475e28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 87.3MB
        • SHA256 eba2a4d0ffd9c91de787e959d9a40c4968fbce6f11c88a5da972eeb2120fd976
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 82.8MB
        • SHA256 3e3b47f44e5fb06e831ee5a381b8ae07e37f1ddf68eae4546e430608518be180
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 80.6MB
        • SHA256 e2e766f7762381b6acb9c34f0b23297fbc934f0cb169aaa348ab875d5c2fe27e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 78.8MB
        • SHA256 1190ca8c42aec9fe9a1b6e464cf5c4fec1a4d75bde5f7f13c0c79d0277250b53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download