Overview

overview

8

Static

static

3

2026-08-03...ij.exe

windows10-2004-x64

8

2026-08-03...ij.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    29s
  • max time network
    135s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 10:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_aa92c91be55a34ef1f18827a106b9f3a_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe
  • Size 30.7MB
  • Sample260804-mcdrpsxfjg
  • SHA256 b8907096f7fb242097f4b923013dcef722ec70425c00349bb49361c8a2d4ce34
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_aa92c91be55a34ef1f18827a106b9f3a_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_aa92c91be55a34ef1f18827a106b9f3a_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1300
  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_aa92c91be55a34ef1f18827a106b9f3a_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-03_aa92c91be55a34ef1f18827a106b9f3a_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2076

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 30.7MB
        • SHA256 b8907096f7fb242097f4b923013dcef722ec70425c00349bb49361c8a2d4ce34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 62.0MB
        • SHA256 675b27128306966482ae0b06634058373b6f23fb64e46e8e3fa82a6338f57339
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 61.4MB
        • SHA256 71ef16a93d7a350b43a93bb813f8af3b9c526fd0fdb350e562ade4e3d9ba1b2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 61.2MB
        • SHA256 fc1197c547dbceb7a8164d2799629eaa1de82d44bd602679f7dc3728d868d11f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 60.7MB
        • SHA256 628a1b4cf780a77e461a824d8a9ca8fce29eba56e8f277a410c947fe1bc06591
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 58.7MB
        • SHA256 065a5c26e83377f41386db6dff178cf16c94808e0359241332e542c549aa251f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 57.1MB
        • SHA256 7e46e258015e172075217522efa10e0b3b7a4b453c3541be9c778d5ea413f8a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 63.1MB
        • SHA256 a9aafc61ffcb5f789de1adeeb9f1fa099ae4f1ca91342be8f790b7b04797b3a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 55.9MB
        • SHA256 3e7faf8ed7ac8925014e49b50604e7c85309dc90e1e18fbf2666c8929317e550
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 47.2MB
        • SHA256 c0766e9cfe4f3964294f876d9e68137e000fefc504af2be8033d8c4560080583
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 45.1MB
        • SHA256 35facaf313597c4b7ac520a95a127e3c7892382d8e8150679ed3eb5c8436841b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 1.1MB
        • SHA256 93b0bb712f25bd640a679dbdb3e908f2defb0bf8f703343c85548c9242d55025
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 49.2MB
        • SHA256 b971c9710c883bb10e9f906210eeb4850025fd6f3ff801042a4c643e3fa45bb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 43.0MB
        • SHA256 545663eaf2acb2a3568853eeaa5ccc299236198a49b418d6459f2c0a6f686de3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 42.2MB
        • SHA256 36cd813eda5dd8ea565332449132046ee5661c51d29aa58808ebf9841b5911e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 42.1MB
        • SHA256 f8420bb7303717ce2058f0d5e584aa6a3280a3abf2b1eed51e9f5c4c2fdcf844
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 40.5MB
        • SHA256 2b11d48c0939c7e9a5af00d6d5e95ac56d3fc2ad91c7063430dd2137d1b216b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 40.2MB
        • SHA256 b1162bbb287f4f553a2cf9b4ccaf6b9d89169e687a02b42992effad5349f8f69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 39.1MB
        • SHA256 579b7c16fbcc087e71a5c4cb8b68ff3ad2ee7581f6364792beb4d857c4621509
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 38.2MB
        • SHA256 2c011d2c2aaa8b299474bb84a146262e1a9964c4c40f2feaa8daa0a1fe325e8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 37.4MB
        • SHA256 cacb9bd47a8f0f625d738ab35346dca4962c7c6ce72d3c128eb8f9631b86f8f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 36.4MB
        • SHA256 e245e81362ee8196590f1cf714ed41cddb6756b5a977f07d7a577c809bfa0eaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 33.8MB
        • SHA256 8d1aca9b6fd326f7427d358e45c1f8c264f054e8ff6764ca1116e3b8c5e6be11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 32.4MB
        • SHA256 1ed225526b7d66fa5747916a55ce78a1830688232df9bd678d5299f504c49d73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 31.6MB
        • SHA256 bf1f27e7727fb508f8c32028295088d8b64a0861bb4af919873562da184450b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 30.4MB
        • SHA256 462d07b89049bdbcdc1bc22291c2125f3263c41e19b69fde32382b41a5f186ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 29.9MB
        • SHA256 7b2b1c66545a984f5b345eb7b9026d395b1f9e96a8d047b1a26ee8ad83feb888
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 29.3MB
        • SHA256 e699783fa61903eb96d2eea6d0e299f350da8cfdfd5fe6edd2256d0a4553e2fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 28.2MB
        • SHA256 ed860703447af8031f9c2fff742a9b2794c2da4d9ed65960fe74af00b1882338
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 27.7MB
        • SHA256 9a4ea328f0f7fb3cf7492dedce355c8401dfa739a67cfd325bd9c8127d53fa35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 27.2MB
        • SHA256 cf3a1008b10e7f2a5dd985dd8830ecc5dc9364794068a0d5adea012bc0749f13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 26.8MB
        • SHA256 efce83a83ef2ecbf5c76e5c56dfdcea81561810019c150018dde6999b4f0ca58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 64KB
        • SHA256 79a0b1f3b0958e830806c9254c2ba2af079ac99713004febcc3610200c9f504e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 55.1MB
        • SHA256 7f3c7a1d2f359e7ff33f89749d0cc8b29871a164cbb6e2ebb176cf279b33e503
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 53.8MB
        • SHA256 4ed23bb03ebfceb74fa81a5f26c7f1a9fdaade446ac8a296b674fef85d402505
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 53.7MB
        • SHA256 80502eb65e817f7a83f1761b351ec3f6de9c7b1fd09a6ef9a85465339603318a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download