Overview

overview

8

Static

static

3

2026-08-04...r_.exe

windows10-2004-x64

8

2026-08-04...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    49s
  • max time network
    120s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 20:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_5cf607f51fff901c88b21f4ceae5b491_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 18.7MB
  • Sample260804-ytmlqaxsh1
  • SHA256 a50e28d2cc920ce5ed5c4dc0108d4b1718b1c17d5a7e2569395ee87639fbbddc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_5cf607f51fff901c88b21f4ceae5b491_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_5cf607f51fff901c88b21f4ceae5b491_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4136
  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_5cf607f51fff901c88b21f4ceae5b491_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-04_5cf607f51fff901c88b21f4ceae5b491_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4924

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 37.5MB
        • SHA256 d5cb0555104a2efe13610fd0f731e8b9e46e4434234bd873ff708fe67d7bde2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 41.5MB
        • SHA256 32ae0b54fff4e4f016abad33086851c959510f86139d3c5d9992fbdf5142257e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 37.8MB
        • SHA256 248d42ada67336bea0780d9a64a1d7ac585749c3e3c59a57b828d051b68a7778
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 44.7MB
        • SHA256 a9555a9377ade38888aeef8f61784962146ccc124fc84c6258419ea29573ceaa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 20.9MB
        • SHA256 8de182a86c666d8265f647ce460a7fd79e6c8251d42107ec763efc4a748d792b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 37.5MB
        • SHA256 2d6192fea7de0d2fbfe4853307eca4061f2a05796f58f4367cf1d1a8d7ec0ac4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 38.7MB
        • SHA256 d94ad77317e45e8341d226f17a860eed66484dc1e2687af06053fd6e65ad9715
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 39.7MB
        • SHA256 0261b6a32ddadc37b2fca715d5d95fc24a0811ec587782489e6d0fa63e166cfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 39.1MB
        • SHA256 f4dad9fec1d1dab06b009dd4c83cf0c9f640ba75dc5aa2cded1c4360a70efa3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 38.5MB
        • SHA256 603726f9cacd2106bbb849cce7a917e5535c380c0552a665ce2aa1654f378322
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 38.4MB
        • SHA256 e672f62ab5f20413a11f622445a881c61f47bb91e3ffe08b59ce0d0d91b2f752
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 37.5MB
        • SHA256 f37a572d688c590492c8a866805a07a8fc504fdfe088dd156cab2c66ed22cc48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 37.5MB
        • SHA256 71a2224539b01a127ea63c67a14048ec50a36243611b145ead56bacfa98ce5c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 37.5MB
        • SHA256 fdece19d66beb8c7185cac2ab6adb3e8ba680c4563aca3d65b1565e377fcdd89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 37.4MB
        • SHA256 9c7c83e60a77b4e9d17a11ed230fddc0cf13cb95e0831c6467a6e361747d5a91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 19.0MB
        • SHA256 0a43c041c89a1e7272d906de0a3fdc43eb26c620ea2a64427087fe3743345bd6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 37.5MB
        • SHA256 27a09e228f74b474e63ddc177e13b496f3de0578fa760c569bed375e47bf99d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 36.6MB
        • SHA256 acc65aae1baba4ea19fc41a17926d22d19ba725d2de6550f3855cb46f1933ead
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 18.9MB
        • SHA256 b2b4b260ea32829baa6e3dc6e7584c0add08ce8d659ee7bc48dc0c4df9f63075
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 35.6MB
        • SHA256 caa42205f0ea5a6b8e3e6ab9e6d51b7a21d82b45604a58f8c48c70cbb41c6e1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 36.2MB
        • SHA256 39bc673a4710be05bc9e9f32559987b0de21b62a39eb38c4e8e3a9837a502b55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 37.6MB
        • SHA256 8217a210ec11bda54456152291c6f169382e07893b7bb7f59c5da760e6c2b652
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 37.1MB
        • SHA256 876829fca19ca349b9613ae6976f11aaef30f18ace8e566378e7d75d934d0200
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 35.2MB
        • SHA256 32b4129e7ca77b1d420177d34c17557faebaa24c61f200600837b28b550d5cc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 37.0MB
        • SHA256 217b1cf32630c3e2f32bdcd52eecef532bf1a0f9b3c3746762452babdfea40f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 37.5MB
        • SHA256 78749dfccdc302f2f82dacbe961b17f68c1e8e5b23e880fdc77834c7fa1ce204
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 35.4MB
        • SHA256 4360f1f744567899524a55102ce88f7f5db5e8a2903664e7ac1bdb31eed8c59a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 35.0MB
        • SHA256 10621001e41ce31f2d77b29ef653ad94da374a70469dc3783822b94eede3c9ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 35.8MB
        • SHA256 9b9bd0e221b64d6161cd3a0f12c74b7c36c0d4dff5518a4266e13e217269aaa2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 37.5MB
        • SHA256 eb164cbfd4660e5fa2401239ee29a6a3ab11f9fbdab0779e6991e65c2c2edad6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 36.8MB
        • SHA256 8b2daa0d1c0a38057caf9acaefb553158951633dfedb0326b8e634f32f5e0684
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 34.8MB
        • SHA256 cc63baa99714ea26fddca2077af01ea2f118d1aaa44877854d94bccca4e53d5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 18.7MB
        • SHA256 84a84fc2b18cd1ed8ac75b5d34c2e795a6b5d61b457a734119c18da9422096e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 34.5MB
        • SHA256 61d0eaede3a2aeda57034056ae126bc75cde0fe6999cf64af1d4e7b7e9022eb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 18.7MB
        • SHA256 3e7e7db7c2595d6d2856262a0d2512d4a306bce09a8033509ddc43718af25d38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 33.8MB
        • SHA256 856a9986ca252dd9641348aed21fb68e2ae7e6e220e86f089e034d569de13223
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 34.1MB
        • SHA256 d3e889c9c461864550dac68b639dafdd5bee082051febef352f81d93a7b2b5ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 34.9MB
        • SHA256 ff081826ceab15d3217278e0eb680db4d5c9c9e0888f928c9f528096088251ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 33.8MB
        • SHA256 fd59454a09e10d07ebc39d999de3ff88113a85fae0663b6b71dab653c0acec9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 34.4MB
        • SHA256 415fa97a9dbe424a940c27385a6ff035e022d671c42aa1f9e63c899953cba276
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 32.8MB
        • SHA256 7d451a3a417ad61704052fbcb0f8ceef1caa83815bef1082e190d9e181e1cbcc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 32.9MB
        • SHA256 637421b3e850a2c01401c61b0fb0d48f623618c5878052eca0372f3b1bf934b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 33.1MB
        • SHA256 1b4b9d32559465bbfc8b3a44562e44d6b999f87f7630997c3cbcc26d0fad88a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 33.6MB
        • SHA256 04ecee73c75a3bd3a77114622e4f2f4a008f65f1914a59b53b84c58180004348
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 32.2MB
        • SHA256 04c4216c8a3152cc1b749d91b42ce1c0d126340c267c091b95778dfefa8a5370
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 32.4MB
        • SHA256 1db9a2e09d5906a8827d922ca53f023507db1f3e29dcb76078d51ad91e22fe4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 37.6MB
        • SHA256 5109054df71911de56772681b10ba720a6601b556a7df933962f18de148fcdbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 37.5MB
        • SHA256 91caaa98d4f52fc39996a085adef307b9bf26ebae36aee0bcc6241a3e5878a70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 37.5MB
        • SHA256 81047d1c6806bdac6944784b1dab2cb7c600e5f010c6b849f12b0de038880fb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 37.5MB
        • SHA256 2a1220b51034bb0e2711a9b7bc233126cb53325e7df20b330c00f5a24e453b77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download