Overview

overview

8

Static

static

3

2026-08-03...r_.exe

windows10-2004-x64

8

2026-08-03...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    103s
  • max time network
    157s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 12:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_1e30494b97bf155f42f986d717d835db_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 46.7MB
  • Sample260804-p3neyaer9w
  • SHA256 817011627f68f8eeaa169f0f3b506524e7a89c5149efad4f54f6d501ea1a9bec
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_1e30494b97bf155f42f986d717d835db_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_1e30494b97bf155f42f986d717d835db_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1728
  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_1e30494b97bf155f42f986d717d835db_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-03_1e30494b97bf155f42f986d717d835db_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5172

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 47.0MB
        • SHA256 7000f432c98a43f218d1a89b5c9345d1c48b7d028572bc1f67d9c885f15a469b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 93.5MB
        • SHA256 d45e393454c1f5c93960b2118623843cf0e86bbfbc8d05bbaff1e530763f95ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 93.8MB
        • SHA256 dc079f9ddc32f37eab1ffa885b267218267a3e4888c383d47b5b93e9ecf6fab5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 48.8MB
        • SHA256 69bc8dc37655176d3dd8a39b53c0fc5531e43dde3131a3f1648d3efe0756b278
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 93.5MB
        • SHA256 68cb117c422cb030b73f2a16a6e1f725ad495d5870d40e6703ace1a82c1cb4d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 95.2MB
        • SHA256 f8df0849745d45aab768cf8c565b9d5ad8cdad3dac804e3d9e4209fd17030520
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 58.3MB
        • SHA256 97488dc71f2d9d18dcb0b7ef8902794a04280a812aa805f40f825275864e95d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 52.4MB
        • SHA256 a1582f76c66855b2b03c3dcb41a21aedb3647f70fa921ac96980907410a89e56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 832KB
        • SHA256 fa8b9cb29a86f59d8f273b148ff27cdaf09d33b15bbfa2790ba1fd0a9b50a372
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 48.8MB
        • SHA256 87189d25a26dbca20125caed9a11fef98f2742b5b52e04fbf74c328b51b9afee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 46.6MB
        • SHA256 16f414dcf621230872116f52a73f6da812f16f38462f7236382465f41b176e0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InitializeAssert.exe
        • Path C:\Program Files\InitializeAssert.exe
        • Size 44.9MB
        • SHA256 6eb197cdd3c24a01af2064d8b6388f1892925b72101b2dfd13c88f390480bb8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 42.5MB
        • SHA256 5ec0b9e5284a5d7fff03e1f47ca9c3b08038ef775065e688b9557745199cda9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 40.7MB
        • SHA256 c3c3bd29b14711517e023fd74046e54bdef4a0f23678a833c99926bd89fb5226
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 38.7MB
        • SHA256 75154d7b1f9283aefe5e89254a3c8dbd8505f960aacb6ab07c3ca484e1a866f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 37.2MB
        • SHA256 817136f509d9ab76051af0d35adbc55fcf2eccacbf99f0b9a25aab00fe64b632
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 36.0MB
        • SHA256 4cf2bc8914c19e9e5caee0348515009de5f2f090192723604b93c5b62b6b3448
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 35.2MB
        • SHA256 9044c189626ee21ab5cf665ae83938cd1699d317e9a48776790b92bab5992eb9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 33.2MB
        • SHA256 d0fe183b8add9d87117f23af515c576ea757f97829045935b02e4a3306b7ef50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 32.9MB
        • SHA256 a599eb065f3fa3245ecbb3d7f90892ce77dfa2f8ef70ca2da0955b34c3bb777e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 32.7MB
        • SHA256 a0a3421b167f4b31dfde990848d2c0d58f5e916cb61cc58e60df07be908c2bf4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 256KB
        • SHA256 6adff2403606f3fae51ba272308ce91c8124c63f116c3d886a5a38b4ccbce497
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 31.9MB
        • SHA256 544919bcfcb549648dbe14c9dad4b6dc1ad3c9f96c1d74ae71688c05402a43aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 31.5MB
        • SHA256 4ff619476f2365d9675a20da352d2836eaff8c6dfec8e1c76bcc45c999959e10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 30.1MB
        • SHA256 fda21f11baf8dd60c405af8741915c22505bc67cffa79b5e7655642b74db2f6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 30.2MB
        • SHA256 ef7294fa620cf69fdd4f73aaa894d6748823eb1448ec762a95172af1743be047
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 28.5MB
        • SHA256 40834bf4c745fb4643f37aad10501a30829cda0901e4a90b5efc10d64fb5e3d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 28.6MB
        • SHA256 ae2cfafe8da0d4189c857add0b522210519f217579134d65a5a35a42b6401178
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 28.1MB
        • SHA256 155999f25217b3f8c2fc46e806bbfb65f4ec897252042a1424bbb662db17dbd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 28.9MB
        • SHA256 257258a20a8dbd1f2e9e2d0de76b6e80d871d73e81c42e156c614f5bf2cb346b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 27.9MB
        • SHA256 4471666316cab260e2d04cfc9bf71628bb233a06314d4bc0677744ae3d1ecc68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 25.9MB
        • SHA256 042f6a743514307579c39d5c19ec629498d54aaf0f8b8265eb74d2649f89205a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 25.9MB
        • SHA256 d9375a21a3299353e4481e95f6e93c2dd3a221dd576de0159b941cb1b1260b33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 25.8MB
        • SHA256 d7114e218434250b564e11d65381b3980aa009eb3e107b3000d0295f65999600
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 25.2MB
        • SHA256 baad9896d14426d4afcd09b5419923f276cbfdfc813ffb9e1c17f2d0d10931dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 24.2MB
        • SHA256 aa2e57f5ad71b6416640212a0a46d299282191010a4361eb32efdb9e77b1da6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 24.6MB
        • SHA256 7ed0c675ad252c346fd3ca8102ca4826a671c56334014d8809d46511c2668a3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 23.8MB
        • SHA256 cd1163391aebd031242a762366ae0177f749934d01f92c72ec41569171686a82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 22.9MB
        • SHA256 581951592eb7056d024f43f7ef1412c2fcbf121f2e3f17136514fd68b77592b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 21.8MB
        • SHA256 6794d552c8cde830f40c98a9608d34256503673cde0cf88e8284c4bc9624ae01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 20.7MB
        • SHA256 4250ce9aa8493b404985381301e68cb22991f528d16d9106fd019506fe68d431
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 19.8MB
        • SHA256 f4373d400d75460abbb7bfdcf9e915935487a3109864b358790cfae9018c1e2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 18.7MB
        • SHA256 41f7872aa76b4363e787299777c4493e33e2de4159346290029c9dd5008fc4ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 93.6MB
        • SHA256 3699794315b51d66f22b3bdfb0357e6ccbb19446482ddb74b57b85e5e8186cfa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 93.5MB
        • SHA256 7e700ca24267550da44a17691c8cb5cc3dd9bd8c3f8bcf80c491f9b54619c97b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 93.5MB
        • SHA256 e8818055f413670e0e048ba5191d5df2aa32f9811a2764ca561756f9b843227c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 93.5MB
        • SHA256 a56aca3293ab11ea61d6f634f72758a0882c72845a271d238aa960facc6dd5d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download