Overview

overview

8

Static

static

3

2026-08-05...ij.exe

windows10-2004-x64

8

2026-08-05...ij.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    33s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/08/2026, 18:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-05_3f39c4c16bcfa07869dd86b8d16e13c3_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe
  • Size 19.0MB
  • Sample260805-xd65rateqe
  • SHA256 fceb4389878c19cf261f378e9f835bf7bb9a0829222c53be1bed0d0d9fe79c0a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-05_3f39c4c16bcfa07869dd86b8d16e13c3_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-05_3f39c4c16bcfa07869dd86b8d16e13c3_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3352
  • C:\Users\Admin\AppData\Local\Temp\2026-08-05_3f39c4c16bcfa07869dd86b8d16e13c3_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-05_3f39c4c16bcfa07869dd86b8d16e13c3_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5944

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 38.0MB
        • SHA256 f84ec50c4295c50f4d9b386953a73f8bebbf798e1e9b0dc280a54c485b23b2bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 42.1MB
        • SHA256 8eaa6b57d12fc23baac25845f0729cdb6b0c3313a600e50927c5314a2b57c26b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 38.3MB
        • SHA256 1fa352f986dad051f782d6ae7896237db2a8a434b25e1dcc3a85e10b872d1570
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 61.4MB
        • SHA256 9d5df7d8999c26a7e6391807f72da64be8baec640c97e57752ba420cccb24915
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 21.1MB
        • SHA256 e37046b92c37df32695e44466e3e05228f71ba2a1ff6115d85a35a7290b78189
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 38.1MB
        • SHA256 24576d03ef10695b24d3a1c8b8977bc126effc3728661ec20ac3f193c2a1a43f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 42.9MB
        • SHA256 bf685a11eeb3cf0692727ff7b2a2f8738d88e2e7daaa2a419a2243ed2bd160b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 44.0MB
        • SHA256 12f399d1937d92b1d0757a7a2af34dccbce25f4019df2f1871567d7c1bcfedbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 39.7MB
        • SHA256 1de642270d2a6bb5824769d407d12d2bf2fc299e86a1ebd2af27bb8824947af5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 41.4MB
        • SHA256 d8c41ab04fa2d9e07b2646092b952b41a95e5376ab00a120d5395c55d22e49f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 40.2MB
        • SHA256 4651d9a5895506a43bbf39d4d328e6ab433a164ddbd5092f7ae4a2dd3bb53b57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 20.2MB
        • SHA256 72bcbdcca5942299cbc978bf0dab30de3b39a0fbe7d21c442a7c16f35bffe118
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 41.0MB
        • SHA256 a71cca85d2925ca53d83a838f5f09fffd0eeae069a747284cdf61c90d1da55ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 37.2MB
        • SHA256 bca2d1e8828ff211a06ee65bd93565716a4d0ff5aea0f751c2d4c21e44810d17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 38.0MB
        • SHA256 9af23d35ee31d2813082c984cd853770b678b1ba94949693da0307f30bdec5c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 38.0MB
        • SHA256 89da9f6f61bdc413bbce652cb5474865dc3f7cef9c5e588b8383d364ecd6bdf4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 38.0MB
        • SHA256 200e2c2accc2857dd0765c47afde6bc6ec7da314146ccfe179f64fa5da25d5cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 38.0MB
        • SHA256 a2bd1693f2cd308e3cf2c41322ab4d0497ac74b7e3bc0ec1b46416a9c239df5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 37.8MB
        • SHA256 6fbdf98baf8bd423fd01fbdc770abd824ffe74500c0c76b69863d1b0e7e9e1e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 37.6MB
        • SHA256 3ba75c1ee9505a478ac959144e6ce12496079afae15e25c680adac357afc4b98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 32.9MB
        • SHA256 e2a78fb0db7366f2f382e3f22ef85d417894fccea3b051435dfd9a6d8796733a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 35.6MB
        • SHA256 9e7ad32089f802839b6cbca5157523e0ac9d42f043e74198be71135a370dcc72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 35.8MB
        • SHA256 f9a770c9e6440cbdcf9aca6d43fe15b59feed4d6ca496e59ac42987f333d57b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 35.2MB
        • SHA256 c5fb9e8c25142b40f03af15100d6380834d9d5cf1fba3843de1f88f58f6e5f02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 34.9MB
        • SHA256 51ae3341bfdc2ceb7773ef823152bcf519238a8f60257d20f2feb4cae6a32222
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 34.6MB
        • SHA256 a427fda6696f91946bfc2fbfafecf47e9f4c5b07de6544ec7301533edfeb9cf2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 34.8MB
        • SHA256 43b721de7b356e277d425451f562cedab633b1d04c457bf3b870ee7d12617830
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 34.4MB
        • SHA256 b38843b7030f3f9f9a09d9d8b934cf14ddf81ce89680e1ee5bb691f031f201a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 34.4MB
        • SHA256 68bfa4ea1176241885268ddee255d13f22a9a2fc21c6675fa834f862d02065db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 34.5MB
        • SHA256 74d4158f21cf486d95899ddf873ed5d173c3cd2a8c1ba91e5037bf40b51395ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 34.1MB
        • SHA256 2882c0b9e9a6af8831076425536565da31f57f4b1f3c629b8b1554f0825e88f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 34.0MB
        • SHA256 08116119a98a522950c2ce69a1fac66e4aff3dcc2ed0178ae7276b81c58e9cd3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 33.9MB
        • SHA256 0f09e0241d389a773cf5b33fa794b5dbae038b110d73eca0baf20ce630f43771
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 33.8MB
        • SHA256 e0c3c6f7c98b493566e527b02face2e6b2533d3548477b17f6de4e30b2f969d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 33.1MB
        • SHA256 2fb849bf39930502ec2e0c670b909de818ebe2b2a6e67490f5967b20a0acd649
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 33.6MB
        • SHA256 b377742ee2dcec69e464ba8c56dd911b3a26edf6122dc79a19cc5f076163675c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 33.5MB
        • SHA256 23bbdaeb149fd1074f9d649e604c4805fc0454ada68c72becd36f4b3bdc27fc1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 33.3MB
        • SHA256 6083fec890998d43a93e2dae9271f90a830c551fb78076b34bbb85197591045c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 33.2MB
        • SHA256 e1aff3118d7d305784887e3b2d297d5072d9cdfac5751d8a335ae396932ee89c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 33.1MB
        • SHA256 9ebaac1cbee0d711d0c665eb01c66467d7bed46891b2a25c9f430b1518183de7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 33.0MB
        • SHA256 2cf2d4ef19cca72c98a899ec30e532ae97d6869982cf9ddd05fd7e1339fd1a65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 32.9MB
        • SHA256 c026d45ae4dff69e4f0cd7efd40c55c0e78ef7d2e666d62465f2dc909dc57957
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 32.6MB
        • SHA256 d271da367a57139bc4ff74c0eb50fd783d8ff8eda6bf963453e220ad32376e13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 32.8MB
        • SHA256 af4df02505f563a2998a5162f223d27f5ba53e9f298fa802b384cb28180d71e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 32.7MB
        • SHA256 b744c85101104cde05bc7e5ed3802103b6b030b0df07838473db3935ab78159f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 32.6MB
        • SHA256 7152e55538ccd130e34696961dd7220c91b9756cbf8c9cfa5b2e3abacad13fff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 32.5MB
        • SHA256 2d908d0a2292834923c3c2bf70cb9776d0510c070a756253a1c4c9dc582f4c95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 32.4MB
        • SHA256 f4a88e3d2823931ccbcf66f077af4f0ad6893000473764ef2e58c5fb24ca0ac5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 32.1MB
        • SHA256 f38e3568f1b05e28a357b04ce2b0359b309c17a807f0ee70d55bc1f5308328d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 19.1MB
        • SHA256 60727d38b83534fd3f3ae295e299671f17c91fa8e5cdd44e9c098be2171c7515
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 38.0MB
        • SHA256 906ff8fe7b9fd847668f7e56470601edd386caf9a63c28bf502deb6fea2996c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 38.0MB
        • SHA256 34bc8fbac25315ef649b8cbd3c7586f7f2fd1ec43cafbe7a1414b34996e989c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 38.0MB
        • SHA256 24a87d9a5001bb29278bd7d3b41bf695f617ca34bd1cbccf1df4c695a6464c11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download