Overview

overview

8

Static

static

3

2026-08-03...r_.exe

windows10-2004-x64

8

2026-08-03...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    33s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/08/2026, 11:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_61ee8b8d5795d9fdb6c08c00a5b71e39_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 22.4MB
  • Sample260804-nsk2dsdp3w
  • SHA256 07e8fbe67389cd250c7b28b2a9ceb6d2625e25ed4dc8aed82184fd175ba01faf
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_61ee8b8d5795d9fdb6c08c00a5b71e39_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_61ee8b8d5795d9fdb6c08c00a5b71e39_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:576
  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_61ee8b8d5795d9fdb6c08c00a5b71e39_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-03_61ee8b8d5795d9fdb6c08c00a5b71e39_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3924

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 23.0MB
        • SHA256 35244332b37c5eaed95c5e119c3c3cfa05d992348c8d184079aa6067d8af2ee9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 23.4MB
        • SHA256 f14c25f9cc7a9f67cfe014110e194aed6bcc5367a818595bf155d2b656b24b69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 22.7MB
        • SHA256 4dfb7b48d6fce638114a1747e1df49d7bab886c305eb8cfa4828fede8824a312
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 22.5MB
        • SHA256 4aa6fa767df136efd589f4c87a0d7d3046b5d2dc6018940b8076b4b8e995e2fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 24.1MB
        • SHA256 e1b7be2357af507ad0e15dbd76285dbf205ebb4f5a6ca5b07158e805ab6ff06e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 22.5MB
        • SHA256 598902cf3c7fc47431e5b323bf1345525c6a387230baa94429b2d4c075222e11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 22.5MB
        • SHA256 863aed08f581fc1fabb4c27bb18ef95a6baad5135662594ba0d9b8aaf1767f37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 22.7MB
        • SHA256 98072b60d82e3b1d085665a884ca94316c4cfd37a06c9aacaeabd69b87513f48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 22.6MB
        • SHA256 811d1c3bb855c52cafeb0b72472762d89d56662cfca456317d236bc02cfc9c7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 33.9MB
        • SHA256 aa9bc19c6de02d882f363a857af9fa53301104b5bc7e749f5a81bb936e366b79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 33.0MB
        • SHA256 2acf33b72429f7ceb8e3f25784b66ac16278fdd4afc9b013dd6664a18b42aaa4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 32.7MB
        • SHA256 ca89329f3b7b1bd24b38a91e8b81e345dd3a85a70614648d9f06051f0d3e7233
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 32.8MB
        • SHA256 219437693cc20886b840fde1f7bf45d6a608556c284ada499afb152939fc267e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 32.2MB
        • SHA256 c2afa27351a5f865fcea985a859d402716d3fcd1b897c92761e71ad8b5145c1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 32.2MB
        • SHA256 09935b6971da6bc9be11b540cb65840dd995528e22695ab14c3b37bb31e7e935
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 32.4MB
        • SHA256 445e26f8c6e97b5e68e2aea2ac5b65486147966fdc6179aa14a3a211f1123084
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 31.9MB
        • SHA256 e23cf60d75ea3db992b561c7f1997598b2b817357e3b1e363de16cac215b1f80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 320KB
        • SHA256 3b2679bef1dfc624cc66cba514201f6f20db7692b1c43cdb81a938876ffadd4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 30.9MB
        • SHA256 00229c8dceb708c8880c21cc5a23da909453a99a9249674731935ccab23758d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 31.3MB
        • SHA256 d483098068e26b30f70ca64c05f9eb46af827c7aa18001f30b8b9c435feb31a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 30.2MB
        • SHA256 5bca940741327f01c9f4cba43e64694de4aa002fccacfc8beaf2999109ab6103
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 30.4MB
        • SHA256 a828757f0a32eac48d3ca8c58e4313f718a64a0ce3a9757a3fc52d48ff8e007d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 30.1MB
        • SHA256 8547636e64da9b132f6acd08b9fb4763eb5f7d0382dd106d33c0e14ff45e5df3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 29.8MB
        • SHA256 c243ab6732c36d5771581989188f60f0a3a3bca24cc61a49db76f63f7d61fa92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 29.8MB
        • SHA256 706970a6b1beb6cdf3ea6be3a57d29aea474ffb934f796c2573020d0464c829c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 28.6MB
        • SHA256 225c267e5294707e3b3cdd6225e16c317d3e7ef65ed826c276b331802c3c667e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 28.4MB
        • SHA256 74a94e710cee6580435c546ce144f331db7b3304830f3d0733a8923d8aa80451
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 28.4MB
        • SHA256 2a69fb373f67a97a965aca3476ec16d7d939e2e414d071e58eed328f12380436
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 28.1MB
        • SHA256 825d1642d1b498d94a99bdc61000af75ca8a8f2ccaf1a9bdb803d2b7afc16c65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 28.2MB
        • SHA256 f2386ff652851c252fd850f304fa33c9df69428c650671075b3bd6cfe59619c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 28.1MB
        • SHA256 6947ab6ada85d5c19f6407cba814d5f07797592784a1294ae551face0a7fd7a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 27.9MB
        • SHA256 999c8fbad5880bdfb0c62f5b24dd7e1720a891fcfa9549f1166b8ff2f47536ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 28.1MB
        • SHA256 246a05ae5b2cb6cf171aedce81a5cc049ddd51955a835cb7242a480c6a946beb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 27.9MB
        • SHA256 0e0e24ebb853c78d40d01460d81ac2c527f4c7d2cf685b68115f0b1f71797e94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 28.0MB
        • SHA256 570a78aa3f13e27af6bd575e266f8535ac39778962a585dd1918744ffd970bc4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 27.8MB
        • SHA256 fb415732b8b184fc2b6f60ec40836102cb532a0506515b1197c4133303ece199
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 27.7MB
        • SHA256 f241ef0f6a5e0b7f54cccfa2bbe8dc3e8af2cb8b37375b121300fa47f96bc3ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 27.4MB
        • SHA256 03cbcfb37151ecca4ac8a35a004377acbcef444065a964fb1a897468ea21f125
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 27.6MB
        • SHA256 e0abcdf10418cd84fd83e83f66dffdc80f24298451ce002d81dae9b9f0495223
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
        • Size 27.5MB
        • SHA256 625911ccd57b126c5ae8c662c17afb9517164561eafae3ea06c003582f47b765
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
        • Size 27.3MB
        • SHA256 4699095d38f3ba131ba459fe45b230c728d152cf3d58cb76e953df87c4d0321f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
        • Size 27.4MB
        • SHA256 ea9361be687cdafb628e0b4edc3dafe7bbf435ec315ccd71f00b331843d562a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 22.6MB
        • SHA256 3342ff2d7761ecb2de02ff71782afdc78bd6da0646b63b7c9e20a7429622a189
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 22.5MB
        • SHA256 edd1dde07bf80d1e23c83ded8a91a635794b2e15d33f696bb1395493a46870c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 22.5MB
        • SHA256 631f03b6fb317a165ba668fc71326395fa0c64524f8c8db7a297c3559697c1ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 22.5MB
        • SHA256 cad66c8f1bfd4676f41783ef1ce0f4f3c9066a3a48e42574bc2491076cdefd5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 22.4MB
        • SHA256 07e8fbe67389cd250c7b28b2a9ceb6d2625e25ed4dc8aed82184fd175ba01faf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download