Overview

overview

8

Static

static

3

2026-08-03...r_.exe

windows10-2004-x64

8

2026-08-03...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    40s
  • max time network
    137s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 12:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_3b305378d0229ab4873031c140df5122_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 23.1MB
  • Sample260804-pkmqpaen21
  • SHA256 9455dee19b2dc2eb099770f8535925d8c64222ebcd1e8d27146eb8c39a9fe7a0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_3b305378d0229ab4873031c140df5122_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_3b305378d0229ab4873031c140df5122_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4528
  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_3b305378d0229ab4873031c140df5122_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-03_3b305378d0229ab4873031c140df5122_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4764

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 23.2MB
        • SHA256 9541e78a123ff7d7f6f951cca40f17cb3e4443bf405cbc20c614bc4b29e254d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 40.6MB
        • SHA256 2a147b4e1d6e2d2b361cd6221391cb774745e16b9f2553965f73849814d6dec8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 37.8MB
        • SHA256 a0befb5d44f8059db8b80472802045ec0c2e8b1036a8db3cac8d21eea053a881
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 37.2MB
        • SHA256 3de4c73a23b7b78183dbc6bfb425e74524ade01a11f97f9c1099683f853d8ee1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 25.3MB
        • SHA256 8e5e616b557b9112dd1ccd1e59f5e37289a21a8c763ce29a8d550c82e005d180
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 35.1MB
        • SHA256 a74086d9e4f523777a617f9b12e7f4d388c51375d70644c96adfe8310476cadd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GetConvert.htm
        • Path C:\Program Files\GetConvert.htm
        • Size 33.0MB
        • SHA256 a672517666252b5aa2d75db079c30f27cbde8e59a62bde132052948b53bd74a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 29.7MB
        • SHA256 d3bcdad99264c1eaafb408fe30d006d11a2ede38330f32e2734ea7abaf7c9cfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 30.8MB
        • SHA256 1f55a19b27ba55505f8b20fd0d9e1773f703e3cd28f7867abdd431d1549b010e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 32.3MB
        • SHA256 6fa571a2b47d6c9c9bd9deac279dc89dec9ecca72d934d22e3ffa0f039a6ecc4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 32.2MB
        • SHA256 79b4be76323ef6d8ae56b17f688dd1772cc26278c73841d916ee04675e5b3c1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 32.5MB
        • SHA256 eaecb3b02ee03e07eb3e85435a3aead8e29956650312d017415962743949a01c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 30.3MB
        • SHA256 f7d0858e18f473d82cc3108207ef577d7327ee7878e7d79832d67e335b786f2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 27.9MB
        • SHA256 4a7ca3f072fecae219a9b35b6a08c3ad7ad38d084e4cde737ee3bf0ea01f3b0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 29.2MB
        • SHA256 c41ccf1bdd59cba5bc025acd25d23049a17c7a24bc6e73a66b9fb528dbf58851
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 30.4MB
        • SHA256 bec7617d1861ac0162f132d196b2660e290f11ef67606b89b985c5015cf8c0d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 26.6MB
        • SHA256 91c46976589241816c4b332ee8da69ffaead47a8c6081ea4ef185a5d4d893928
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 30.2MB
        • SHA256 bfa49244b052f12d77d621e07818b4aeb277b759637024b40118b63be442808b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 26.1MB
        • SHA256 a2cf4f3f4f66e81a9fdb40885931a56a451393340c70d48ed9b6c7a1169796aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 28.6MB
        • SHA256 c8cf60401892304dcd0e54fbbe2e2c3d3608b4f1c53a51b4a4959e917183c553
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 29.3MB
        • SHA256 72b77d519430b398302e32ae8bcb7c2fbdeb3bd3c1c8d51fe0421a69c5fd88e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 28.8MB
        • SHA256 7575e19e4ee48f9d465d924d9327ab43196a7c9a7dcd9ad218c1fa9e7aa18eb1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 25.8MB
        • SHA256 0a31f624579369cf219d57017b93e65129eceab2a213401eac9564dbe56c368a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 28.8MB
        • SHA256 8772415bbfd75e2d133c4e6fb58d6f213989adce78d30e4531aaca19bb2d76a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 27.1MB
        • SHA256 47aa69a178b681be619b1d7c0bd8006bc566b70c9c0630502341417a4947106d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 28.9MB
        • SHA256 ee0573a1957abbff215bc5ea8398a17650cd6dfe8331a68d5748b13743c60e8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 26.2MB
        • SHA256 5b38e10a6c0d514a1cde2d75a8091ecc4a0a0a4b1e5c32ef210c01afe5d4d25c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 29.1MB
        • SHA256 73dbeb9540d30a4bf2bc8746b64fd70cbd922877f0766f7b41af5ae557079bbe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 320KB
        • SHA256 21e9dd8769a39db9165211e397543c288db6cfea67fb378fdcbfa803d9a215f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 28.1MB
        • SHA256 4b67d957e90ad8868fa570b5de73eb68751dfabbc5689afb2ca3c4d061de702f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 28.2MB
        • SHA256 bf782a208d5361b3fc7ee62b59f79e3c38429dc92745e855b1ad0ba59adf4f53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 27.6MB
        • SHA256 504e29b4761d606b7484c765056e89f4e010fb611319ebedff0801986e227294
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 24.5MB
        • SHA256 75f51c884c21594987bd6dd3db733f6438cb2f0991d8f0b8c315cce2f0b63e4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 27.9MB
        • SHA256 f6b737c6d771fe93c5be9457f665af2bab1d36afc5798a12ef37b002c54f36cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 24.4MB
        • SHA256 2149ee8b19aebc5f389641a6289ae4aed40cc45be34adc43bce5de15197f418d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 27.8MB
        • SHA256 17375d466e501925ae62065641323c92b1e3dbbdd3d894c32f8b847f71868d1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 27.3MB
        • SHA256 a797af2171933026de2a6082b4a80674d217f70dfdf24ddd87175ca94e8dfccc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 28.1MB
        • SHA256 c240afa2162c83c03dc52c20b57dbc33685039f53e0d0235f53ab760903bf95d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 26.8MB
        • SHA256 d1cde390cc9ee211a67083b1ba89ff963d6c9364e3482db807c70f6b8e26ea1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 128KB
        • SHA256 018b597827351ef5fba9c0e1d321cfa9b45d887ff0f8d5607452eb75d8626cb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 27.4MB
        • SHA256 9b230fad48e4961d2155f022c3e40db66c2aae4426c777898f0ab507c8fe014d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 26.4MB
        • SHA256 316b0ac7e4d5c5f4b3ceead2da4f96f12f596c2aa9263fec5c39dfdbf41e403b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 27.0MB
        • SHA256 4d728624792e5abf914614e4dc0e53bb8bd3a40f9d5084ff459edfccb4cf2f95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 27.1MB
        • SHA256 18394b203f19c23a6ae09b6c82edbd912b75ee2c05651e518064da19ccc84784
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 26.2MB
        • SHA256 2dff3881f59c4016c768914cadf3eb1c6b4211eba227733f94f8dc4b49c1d6b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 24.0MB
        • SHA256 768bc0c5176eed096b4306eb17d145c6dd5cbdfc482b1d7f374cd887897d796d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 25.9MB
        • SHA256 e6d84e44b5f67d49cb2556a424c92458ea6e93d785dd732e2f00412e03ac56a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 23.8MB
        • SHA256 130fe1df3b19f9543d516449c917fb64bdd948a2833b6c441e1c472f936c4983
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 34.4MB
        • SHA256 3b53479cf294a8938659fecacd20c884bfb14c38a5e50201062499807753fbb9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 32.6MB
        • SHA256 416d85cdc59dc5e383b7f1b55287d9409cb378a0bb3cfcd73bffdc1420be6b11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 33.4MB
        • SHA256 a8b58e4fa28ad8b7134c2393dff366f331bff59c5868ffb27db13c588bc2e77c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 33.6MB
        • SHA256 99b00ffe5b208bb4365e744c5b6cd893278268118bf3216b2f3d049f8769524b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4528-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4528-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4764-9-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download