Overview

overview

8

Static

static

3

2026-08-07...r_.exe

windows10-2004-x64

8

2026-08-07...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    47s
  • max time network
    145s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 00:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-07_bbeb281045afdf72b22d782e80081276_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 39.5MB
  • Sample260808-a3333awgjb
  • SHA256 a842b8017f1647c661bb816d52e0a09c9a08fa03d317086df4ae2f69400f7f85
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_bbeb281045afdf72b22d782e80081276_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-07_bbeb281045afdf72b22d782e80081276_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5092
  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_bbeb281045afdf72b22d782e80081276_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-07_bbeb281045afdf72b22d782e80081276_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2376

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 39.5MB
        • SHA256 e40d332c06cd0cb9e70f8c0c120af2fcb35928a90dadcfbc8422f33b27a233aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 79.2MB
        • SHA256 4a6837d489e436d130f986939be51b8edcfa8f896ac877a4bc922bc923d37368
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 79.0MB
        • SHA256 f6f7a59145f9d6be6b86b5fb73ef19d423ebc0073ca0fb01d08799c12100f361
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 81.0MB
        • SHA256 df2febbd8049e7d8fd37c894b6543c6cd5242ebf4a2613d2dd6d9473a43127bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 79.3MB
        • SHA256 e49a062f1339b0738da855bc297e91bb4a2a1510dfc8e98caa820b8220f742a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 62.9MB
        • SHA256 89b38a59b724a19672cbaf93770015022fad28208d8401434a90fa0aec0a2bcf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 39.5MB
        • SHA256 a842b8017f1647c661bb816d52e0a09c9a08fa03d317086df4ae2f69400f7f85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 78.4MB
        • SHA256 75f611d832af6d7157893979126e63f805192e373eb7857b937c3ee33fab2293
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 63.9MB
        • SHA256 f93fb8adf32796458943572b23a798b3533eac55be4211338811cdc55ed9c924
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 64.7MB
        • SHA256 3557a246134989bd1c7d897237c1273107fe5fbc7a65cba12d0d4b9ed5ab2f4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 67.5MB
        • SHA256 c8c62eb955ef50c48ba0fb4db420dd226784fd76b115fb925bc630262cc7d156
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 66.9MB
        • SHA256 a33c15b49e73735edc9e2e38f99c65bfbb6a53c421a0e53e6a2c86e312384c8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 65.5MB
        • SHA256 5b2e66f5d5fd26508060c4ddf64f01d8db3dea782faa6db6c4c0e6162c4650f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 64.1MB
        • SHA256 4436993a1afc899b3fd6382301371bcbc797dc0ef191ec6d2325b1d5a6ba3406
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 63.3MB
        • SHA256 3796c0d29b357a35d46bac885c781d0588685dd146205fc71148fde8093ddd7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 61.8MB
        • SHA256 323f09fe7d5dfaa81a2148128a9b17d4e2826e4a9d3f737484ab322c5e53da49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 61.0MB
        • SHA256 71641ec5b30c97011ff84886da8f2274436aac13cc0a9e7a043de176d7d30ce9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 58.1MB
        • SHA256 d326500707e79cada20dc994c01fe031c9a227d7c5c1123f7312fe4bf4615624
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 56.1MB
        • SHA256 0625ef821775122b5f467ed75d88021701fa26cc5e1044879847fc69bf7f8aed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 53.9MB
        • SHA256 8e745a64570a99f4be98c7bb6994ac6b152bd47f2401ba4f1d5d197f6c30cc72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 51.9MB
        • SHA256 f8ce61fb20d979bb6e30b6d7d8029aefad27bfb09611da66417c07c81399596a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 51.0MB
        • SHA256 c70c851730608b02abbec0c529ca38cada9ec096a00ad8a250bd86715f120edd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 58.3MB
        • SHA256 fc3e8f4c05f434b43d2ef8906329f032a2c85f5a23108567ffb5637e0f0f67f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 73.5MB
        • SHA256 7a86d841e3157a2378a85d4f0a232d7713a7877f7b4489a4943585c5d614cd0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 71.8MB
        • SHA256 7564b392c3290543aaf68948618887afd6a3b7dd15647e13993d9f680a0f171a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 70.9MB
        • SHA256 70f27a7aa9361c5004594d96d3e07b7de230257294b0c117298dc839c223da62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 70.6MB
        • SHA256 fadc13ae981efb1c0704b9d2fcefb85f5350c5a3f498f36af3adc31ec989fd39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 70.4MB
        • SHA256 d40217bf507832cced7bf4ec91cf926f84e31b875c6437785ef560a60fb84c9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 69.8MB
        • SHA256 da5f7d5bf95d2380bf075b9a0192cc1916b0844f10c178a7de75e066fadfd01f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 69.5MB
        • SHA256 54d4c1e1becbb13a7869facb0762b12c5a7a28a452172ff8a0332eb976bff850
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 41.9MB
        • SHA256 a59cf9078004fd83e543651a3e6a2a09467549b80dd834ca1b0e4fbafa2f0b3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 40.6MB
        • SHA256 0da62bd91704631e6c1d69e65c8eac94c19bc1443e1dc1c58a102a3f0ba8719a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 39.6MB
        • SHA256 0fdfca5e8fd8a4f0598bb5101ddbe42afc76ca732e00c3e7f52d79379125f21d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 39.2MB
        • SHA256 e31aeae7452af5a48410d5af6a4eb72664da3f8361b824bbf43891787d226bcc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 74.1MB
        • SHA256 8fdbfe7a900860f8a948ae4f2ba8ca385dc63f04d2685361165c7b38d30cc8e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 72.9MB
        • SHA256 52d640cdaa5a103a19ef6b49953c9c4cf18a63e90aa0a430d196a8305dc1f43e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 71.2MB
        • SHA256 d4bf53e6b84cfa41d3b5027de8e5c977e0cfb29021b2ca311c36fbc674186b06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 68.4MB
        • SHA256 0f4f36d99607ea60fb44b02244fb03c769987d34eade2b5cf77f264f041eb4e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download