Overview

overview

8

Static

static

3

2026-08-07...r_.exe

windows10-2004-x64

8

2026-08-07...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    34s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 00:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-07_978bf474ba2492a1501b1a181740e4d9_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 41.9MB
  • Sample260808-a964aser3t
  • SHA256 99c0b9319d64fae26105c92e85ed08516b7b63894e3b21ed46035ebc558c75b4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_978bf474ba2492a1501b1a181740e4d9_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-07_978bf474ba2492a1501b1a181740e4d9_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5012
  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_978bf474ba2492a1501b1a181740e4d9_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-07_978bf474ba2492a1501b1a181740e4d9_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2428

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 41.9MB
        • SHA256 99c0b9319d64fae26105c92e85ed08516b7b63894e3b21ed46035ebc558c75b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 46.0MB
        • SHA256 a1b7c8942f40c13b3596f61327cd905fccf359b1399c2ecf863edbb4b8d84b4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 63.4MB
        • SHA256 72c23df81b2c20d8bf3462b8fa23df3bd473ccb8527149771023ab3904ed597f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 44.1MB
        • SHA256 79c6e50e4c68fc98e06fd9157a32676565bdf31ef78fe2c50a35af460d2bcf99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 59.8MB
        • SHA256 0550b5f1f042740b94e73139810808e6ab7f2e002bdaa1774cae26991b403a15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 50.8MB
        • SHA256 85767f19c033e71a916d1721d87aa8d058d940b3515b0607e1810d4403949a05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 49.1MB
        • SHA256 31749d18fc18f08df2d9aab4c2f433c15b035af6a1d32e64c783b4dff728e57b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 54.2MB
        • SHA256 c73389dc4026915743137d8cbb6c22bd828e9189e55306a416731acbee35113a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 54.2MB
        • SHA256 92a8bd92438b20ad1e7dc7e829d273a736a2f95a85802bb8d5f7596b285aa1ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 52.7MB
        • SHA256 e1efc7037505e0ecbc123142b0135c0ca21fd6b2b53f999f77880b0cbfded44e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 48.9MB
        • SHA256 32cb406abdf15d079471f4bcebd3c12a71cb8ccdf0c113655b3c653777ef1fc3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 48.6MB
        • SHA256 1c78749e1ebff2dd33ac94f88371041ebeb34b4c9abbe7ca8b5109c670c87155
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 48.1MB
        • SHA256 e344a2744fa6850ab64daae67c813a7c5ea9514d0962e6cd1179f4814207912f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 47.6MB
        • SHA256 d4fa0a43cb285ca73b3b40c2c2e56ccc9b0e92b17cc8741e8fc94e9e7a625fb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 45.8MB
        • SHA256 6cd17e9d0b880230555d3de5fdd76c2e457faf794411749cb36c113317748069
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 45.6MB
        • SHA256 2e6e04bd4f0e8854c1972e44fba8b395a4acc2e560f8158d44e75b191d8abd45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 43.1MB
        • SHA256 fcf81f8d017d3467472fe7ebbbbfef6d490d4edac7675a8005a4b5e257eb9f53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 42.8MB
        • SHA256 a62ae9d1544fcaa612198155084ef904562bd770325772ab17a21f18cb689674
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 42.2MB
        • SHA256 52ab01856e5b43f1cc477de3fd42d5d80e7ea7c743e82370485b1e294b3c98d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 40.8MB
        • SHA256 0640b159a186f773c7d993272e056a13b58fec5c76094a80fc55d065a1792d84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 40.9MB
        • SHA256 679833181c9c6dcee3c9a018b89c3cd395a5f4d69f6a7311ddc988fd5b3580b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 41.2MB
        • SHA256 f88f07555a9021bf7ba8aeed2091e11433868dbfd03657a6635bc0b17c5ef59c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 40.2MB
        • SHA256 c422893c191c9346678c11bc053406bbf49c3266fef3428cdd0173ce329bbf07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 39.4MB
        • SHA256 0ef4c008f12c0d5001b93510376ccede0c927a3e1146dc9e8be6c03d51dd404a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 38.5MB
        • SHA256 1824741b15482102962a897cb1cc368ca2dee73ac54ef6aac91425a7dae975fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 38.3MB
        • SHA256 b1c1c6c32e8fd47e2326821b88b2cf8bdf6e0b66ab3c8c382f7c4912773182df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 37.1MB
        • SHA256 66ae797e250efe82a749d3b85728ffab0e744cb884101fca3794f574bc0af83e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 36.9MB
        • SHA256 fcfa3b5c6748233386b2577321f99aec08bdeb5a1f2983b4aea14eec3839449a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 36.2MB
        • SHA256 0823222c5659174729069b6f03f6a27e4a22305466e9143da647034a3ae6f40d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 35.9MB
        • SHA256 1ee1381939549851cdd1d638bb8e77ecda7053baa32d357cef5dabde36f50fcc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 35.5MB
        • SHA256 849a5f4ec13e1ab315f06849ad5d805b206cfac277a76b56fd47643c422522b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 34.8MB
        • SHA256 292d7e61dcfbacaac9c6d1ea056297f0428aa9ea1ee8c6b985c83710a6391f3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 34.2MB
        • SHA256 10e8d6fa73627f531793e50d33ba85e68f57da9b6347c6b0e895824494daf4f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 33.9MB
        • SHA256 35507fc79175e25ee8f3330427789674abcab93828889cdba4d818f65fd30da4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 33.1MB
        • SHA256 4b5f2971b7993180d8e70006b2c639ee08e8142b4edb2140440e4bde2615bdf2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 32.7MB
        • SHA256 2689f54faafd2127235c3c60eb4f7d13cd0ecd18178f2c41045668d3e28a7e13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 32.3MB
        • SHA256 3ba234044698f5e245861ab4f3246ef938a731d117671f4c49498f427d564880
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 32.4MB
        • SHA256 23c35e795a74553fc4b5d40a94c9f8a082b7d8ac805d555efdf5188345c8e0cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 32.0MB
        • SHA256 1b3c4e8f9608a35b0e68e7c4a3927668806a69e99c6710c3973f138a5e600b61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 31.4MB
        • SHA256 0721cba0e463ad1d28b1a3046d2d281e15be7f54e4d30547390874cdc01ec781
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 57.6MB
        • SHA256 8ebf32969717c7fb0120b7e95a8a56a7a89d6ef698ae1498795bfa8a403377cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 57.1MB
        • SHA256 645cdfe85c42c5a7b3add65d53de5034f48cbbfa71d96d761a60a2a60c7abd43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 55.2MB
        • SHA256 459e00965943cec4f7378336bd4ab5716e24cbd9ac5a4fab5969fe515bc09e9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 55.2MB
        • SHA256 e82e9b9ed58ac99dc4984341d9635dd1ff7e3020f66271ddd31f75690e44c1fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download