Overview

overview

8

Static

static

3

2026-08-07...r_.exe

windows10-2004-x64

8

2026-08-07...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    147s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    08/08/2026, 00:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-07_978bf474ba2492a1501b1a181740e4d9_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 41.9MB
  • Sample260808-a964aser3t
  • SHA256 99c0b9319d64fae26105c92e85ed08516b7b63894e3b21ed46035ebc558c75b4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_978bf474ba2492a1501b1a181740e4d9_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-07_978bf474ba2492a1501b1a181740e4d9_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4456
  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_978bf474ba2492a1501b1a181740e4d9_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-07_978bf474ba2492a1501b1a181740e4d9_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:688

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 42.6MB
        • SHA256 8a0062f852cd6fc37bb17ea9998afbc8ea0d434e1bd0e622c9de5bee4fb75c67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 65.4MB
        • SHA256 688fcb47c96c7bdaabac9d2e686ba50179d6697a7f18da5f4535a76ccc410051
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 83.9MB
        • SHA256 cf774c2a7126c8207b5ca478a66e9feef4895bf5ea32eab0594b08f3e45450d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 83.9MB
        • SHA256 d71163eb2f68ca04a4cdaf297ae30c8d2decbf618dd84d5883e2a19032392121
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 83.9MB
        • SHA256 0df8801986af69b30cc50ac8a361a7a9c62b4ee00ffbcda52ab89f830de073e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 83.9MB
        • SHA256 973ed8e8afa047fe3299841977e7a6f125d19804d3bb3123ef7bd743b8e22c11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 83.9MB
        • SHA256 29af040c820600fdf9484108878a1a7903910ca62e56c25540dc79fd52cf01de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 83.9MB
        • SHA256 bd0e8a0e0a93c36623f80cff4d6045e2e213b4d3a180ebbb47e3b98e61de00ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 83.9MB
        • SHA256 28b9beb1defae1f77d181b5fd10b73981ccc0a1119169fe15b4763d166c7a2ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 83.9MB
        • SHA256 cf6a69e0430638615a2650515e6e68daefae8fea1922b1f56d49ad134c8382de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 83.9MB
        • SHA256 53a651d0a1784a99005e30a2656a6ea2ad7555cd61a1443e4f247c09b0f62a6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 84.1MB
        • SHA256 49afb4a538d0c60689fc2488acee442f6446f32ae1af01799214e56d50b337f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 83.9MB
        • SHA256 942d035a760c50438ab5fefc4b1a5dc27e416714aeaf8c3b4e843846b1738067
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 84.2MB
        • SHA256 c8435011d201cdf2c18f5b1fcc20795081f63735e07bd7788ae4a31e77c96a5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 84.0MB
        • SHA256 aaadd1e413ad01ea20c55d859b670db1a1d4fb784795940d36dcc02d16c84c78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 65.2MB
        • SHA256 c3e2251fad1a29be1016ff20662a3ceac26e813921e999473375e79c913185c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 53.2MB
        • SHA256 9704949b450ea3bc08b5b70a6216c98fdb082a2c8660d4d82629d410881aa03a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
        • Size 58.2MB
        • SHA256 8923d4b9ef489f01ddd419b2dedd88182e79b7fffed702f3539f88310994f27f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
        • Size 58.7MB
        • SHA256 010a1232325eebb99fb8789b34a758529b7939943e4b24cab6cfcdfc1173567a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
        • Size 15.7MB
        • SHA256 c7f9a7f9b1429884250b7c7227e9a8ae64a114ae09195d49c59bda9c34c140b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
        • Size 10.4MB
        • SHA256 a536e391f6430d6a8acf0fb441240c3d7e84f71564269e7c9f90bd119e612a30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
        • Size 9.6MB
        • SHA256 3d375af3323230bb94a4476170fd1daaa73240ea8eebc22c18d6c42cf10a38fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
        • Size 384KB
        • SHA256 3e4e65210d0ce663e458df3dc7915e7345a65463edc2c4781b0feb1a0cd3389a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 41.9MB
        • SHA256 99c0b9319d64fae26105c92e85ed08516b7b63894e3b21ed46035ebc558c75b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download