Overview

overview

8

Static

static

3

2026-08-03...r_.exe

windows10-2004-x64

8

2026-08-03...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    30s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 11:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_61ee8b8d5795d9fdb6c08c00a5b71e39_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 22.4MB
  • Sample260804-nsk2dsdp3w
  • SHA256 07e8fbe67389cd250c7b28b2a9ceb6d2625e25ed4dc8aed82184fd175ba01faf
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_61ee8b8d5795d9fdb6c08c00a5b71e39_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_61ee8b8d5795d9fdb6c08c00a5b71e39_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2156
  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_61ee8b8d5795d9fdb6c08c00a5b71e39_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-03_61ee8b8d5795d9fdb6c08c00a5b71e39_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5552

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 22.7MB
        • SHA256 4dfb7b48d6fce638114a1747e1df49d7bab886c305eb8cfa4828fede8824a312
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 44.9MB
        • SHA256 056f5a856dc64d9e807b88c9f28184904fb3f036e4483c52eabef6af9942debd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 40.7MB
        • SHA256 551ccbaa55964f0fc968b5ec69daad244f7355eb05918e1353712237016718b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 44.7MB
        • SHA256 6ef565be02980919fae3f34687f2123c57ccfb2b05bd1f96e30870274353efc8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 41.1MB
        • SHA256 83456549d770d7d0cee36266345e14ab8fb3ce4961dfc3fdc038c9a2b4a8cbea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 24.6MB
        • SHA256 2cc8ea4651ff0013840a3accdaa4df230f7d8ab8bc2595be069f96fe491f5f7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 22.5MB
        • SHA256 3b7815bf735259402ba2b944ba2c7877586a1942f594cbeaeeb03ad1e60a1e8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 28.5MB
        • SHA256 7a5be2aab105e8499dd1bc7fc5fc63726bce8d285f8e5b7e8c0455d6977ddb01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 39.0MB
        • SHA256 c80545209326e91d786b008a6dc270704b55beca7d27e68ff3f6a177d54d2fbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 24.1MB
        • SHA256 f9b7351156f623bd7fd9f5d29fdcfc2c0526c05d832b7eb899759c5767e44489
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 22.4MB
        • SHA256 07e8fbe67389cd250c7b28b2a9ceb6d2625e25ed4dc8aed82184fd175ba01faf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 35.6MB
        • SHA256 4fde1e7338edbe7b72ee838702c944811824c5abc52c9cf1a02d19898cb86326
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 31.4MB
        • SHA256 48328a75d3155fd69fcaab1a690a603bf626a37d4ac2d2551bdf5ab4ae8a90fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 35.1MB
        • SHA256 b932242d35783749ed978c3841b450882e266f79edfe46e2dfabfb2a72fc239e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 34.3MB
        • SHA256 97e907dc37bf3d361f9cb67bb563db4a029c3aa917dd294c20fd3dc63780913c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 33.7MB
        • SHA256 47a934c0133f666bf16d374c2af8e158f294c057dd586861d6c9e39772133846
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 31.6MB
        • SHA256 8ddb8a684776ae1342dc5933ac212787f6fb7e90360ee232ece8eef7826e10bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 31.2MB
        • SHA256 885b490618cb8b09a514f58c3ecd4b2dd3e8cb5e620ed478e8344e3c5e2970c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 33.6MB
        • SHA256 edb5090ed5d8eb8b2d862d9dd59c0e5524227e571b0bc70a36cb8ad725da9921
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 33.4MB
        • SHA256 8e4dba23971596584fd0c4762e3cce732368923eb82aef8c76c6fcea1c8ba532
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 30.2MB
        • SHA256 ee95b7714c8b5f8b64f58f06fd5be1de2adb3a1cf97d9c1603652d2722928e31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 33.2MB
        • SHA256 8689d97824607a541b6220788004c731feb55fab684e3eed79bae1aa984fe234
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 32.9MB
        • SHA256 dbf0e5d1e31f1ae5e9c6b54f2b2688f79db2fe1cb82584b93505f90eafdb7fa1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 29.1MB
        • SHA256 7c4a27bef814d1235e481816c4e98c1ccfc42ecbed975e2eb987493174c3d161
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 32.8MB
        • SHA256 2f0fd9e224ded6a3120891b8e907240d799ed3705d97be094af07c35ee6fc13b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 31.7MB
        • SHA256 0b53e74685910a6228e5892f5bf4b8443c0d8be9e9bf3f31923b010b15a3e9c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 31.8MB
        • SHA256 fc968c85dd6ef7aec0d164b9941a90d293fb29a05ea0bb396103723680c311fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 31.4MB
        • SHA256 396f2cab8fd6c2fdd9031c0adc2185e4415bb6c5aeb6f4a2e8a354530609b50b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 28.6MB
        • SHA256 b22a503f8f8f8b77c8a9a0f4fbb27ca719a5fea8badc372787812766f6fd883f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 27.8MB
        • SHA256 b330e41c01fa613c576c1b046b012b0c258d35d17c96c1ed06fc16dd97c619cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 31.5MB
        • SHA256 02228b832f23af2af8d34139a6fef435c0377f018cc082800b59e0d57598b821
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 31.0MB
        • SHA256 3a071b754c8d3807c14b754773ca9491b64603ff73fe92528df0de2a6b8c3a4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 28.2MB
        • SHA256 402f08ddae8a95e7d39522631c7949cc5c8e6c162b4daceafbf678e1a9670135
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 30.4MB
        • SHA256 0dafd69c6836488bf926784abc2f1eae24eb1278eab04f42c08ce33d07ec3d9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 30.3MB
        • SHA256 c50df910f4ddabbf2d4eea91ffa68a230b4b47b6def94ec1fb5acd12793c6ce0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 29.6MB
        • SHA256 30c14e23a3f12fcb07c1aaf374838820f7578cdaf55918bf57d01a195b299375
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 28.6MB
        • SHA256 225c267e5294707e3b3cdd6225e16c317d3e7ef65ed826c276b331802c3c667e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 29.2MB
        • SHA256 688cd1d4b9021bb5099940f0bc3ebeb2c79d3850cebfe9f51f1f4a20cfd17c0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 29.1MB
        • SHA256 63509157cc578ae27097f3f7237ff1fab93c57f5eb811aed895778d8019eee3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 28.4MB
        • SHA256 2a69fb373f67a97a965aca3476ec16d7d939e2e414d071e58eed328f12380436
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 25.7MB
        • SHA256 5bf6c408a735bac173e4aaf5a776bbd811cef055e70d9646507835c488cc53e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 25.5MB
        • SHA256 7fa0d108a14fc35fa117ce9de4a5cfd9abe2b3c94cceb4a8476be7222d13a2e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 26.7MB
        • SHA256 9791e16d681888f7c3cedda0e154c24a2f19d5ee7ec47c3cf0046afbd4caeed0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 26.8MB
        • SHA256 e3d542b3a4501135907eae4139a98cdeaf5c67c283b779e5f2256e7e255426db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 27.1MB
        • SHA256 cc9a9dd05d3a3ca046c7f2c337bfdf244a7b98f5e9949945f189f6ead6c95ce7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 26.4MB
        • SHA256 5689650a0944a34a9a4bfb26a2c76aa0f9b452c1954d51936e02798555c5dada
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 26.2MB
        • SHA256 64709924692bb9f1ff491acd29b02027314d9c061d58d80fa77494cb8901e932
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 25.4MB
        • SHA256 1737595bd30acd9d7e3080ab32f9284e18f1d443f75d9ec80ded120e7a745760
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 25.0MB
        • SHA256 a3c69b20c29a480f4f73a57439397f2a6c7de48b7e4d36aca4fe2b28df62f565
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 39.8MB
        • SHA256 71a543f1ed5e0a5a1de42ae777c6bbefd1eebeab234b94243db3cc392511f58a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 40.8MB
        • SHA256 01202aec28df27cb0c99e3207f37988f415099eed5770a1101e8c7cc59137c0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download