Overview

overview

8

Static

static

3

2026-08-07...ij.exe

windows10-2004-x64

8

2026-08-07...ij.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    73s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    08/08/2026, 00:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-07_ecf26a78852b7010f37e4750a0816d98_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe
  • Size 26.2MB
  • Sample260808-ar78msem6x
  • SHA256 5abe1ef50343f1eb0ce7eabe573348ea6e0d7191f565dbf642f279a143305741
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_ecf26a78852b7010f37e4750a0816d98_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-07_ecf26a78852b7010f37e4750a0816d98_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1840
  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_ecf26a78852b7010f37e4750a0816d98_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-07_ecf26a78852b7010f37e4750a0816d98_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5040

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 26.9MB
        • SHA256 a1a90c0782ecd94579440d8fd1b81642015b8d130a831b75581e9ada181a661d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 28.5MB
        • SHA256 7b66f00840202ef46847d5c7b542cb5fd73e22ffbc7e60405a2e17f05f91b9a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 26.3MB
        • SHA256 fe0e55593292dc989a941f60f1de0c2d9316b36919239df57f3965c5c351dcbe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 26.3MB
        • SHA256 b8ef707cf4232458c75062d5bd827a5f48aa4cf8ff4304c8db71cca8fdc60b20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 39.8MB
        • SHA256 44c78fdafe0185216268c0f577fb3a7819b42380266de89f47dc97ada58f601f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 42.2MB
        • SHA256 6aedc255e5c6c662a38df1a8605cf78866c6e4219b67ae262d2b0f0e55321155
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 41.2MB
        • SHA256 6f05dfa9467c892a53d30bb8324cef6adcb0017b1aea9c1dfaff653531bb32ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 43.4MB
        • SHA256 46e7d2d51da567fd4e3f530c491ef76624b171879d997663dbeeda94f28845f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 41.0MB
        • SHA256 b70358b4fdbea942a5cb99cef3280deacfa631dbdf17df43ac33aca9ac686ea3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 41.5MB
        • SHA256 fff6487a9e5b79702663b983f390a44021a57ad7d539d34b4de2f40f56de5103
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 39.3MB
        • SHA256 60c0b047388c2dfeee2d982a6580773cce65146a7c9432c5e3863e73b9fcd76c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 40.9MB
        • SHA256 97005aff6be1eb47cd395b334c6f3c46d39a79b5ab8634cc6cca9e17f2ef3106
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 37.8MB
        • SHA256 0352c0a377cdc6d78d2e07506d304d816577e173e5e0af2a4adcefd2881b52b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 37.2MB
        • SHA256 7fe135985e8b9611069fbe40902ffbf7cfe8756e42dea67b3261e42b3b6b4811
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 38.6MB
        • SHA256 a0843aeafa1422331fc807d1bcf14eee785629ca1752cb2f5ffb797fc1f4c02f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 37.1MB
        • SHA256 1c7d44e8e6f71d50045c7810ef7ab87fbbeaccac7c7827a6ad958fd1c1773ea4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 34.8MB
        • SHA256 b69fc9d7a2e60c14a1362cf3fc9bfbc36db47a6155794374d4f2b7fc5f7e5bc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 36.2MB
        • SHA256 817fc6baa52904e5931951a4731dbaa2d2a17570dafb389a451d64d1f971e745
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 35.2MB
        • SHA256 ab54f6d5af894fe26713ce67e4980b0f940211c1d242a217bb85768b17174938
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 33.6MB
        • SHA256 29f504fc7673bb870c86b98563fa065c139935e6df7b44146ae8306d3d850e1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 35.1MB
        • SHA256 f0ad64bc9732cd17a391286b2d420b2c5484451d783496adfe76b23e95478e8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 36.4MB
        • SHA256 94724330b8cff900d1b2847c0cad11ae9278a35b1941f43a2dea40fd70eeec81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 36.6MB
        • SHA256 437fa863a8b41d9cd62cef17efc77661942e32663c4b41bcb3bf575a15753a6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 33.4MB
        • SHA256 70dbc842b8987738294ecefae2fa6717fcd0b0df09095c2f68e9244b8a774792
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 35.3MB
        • SHA256 32519bb1d738b9d7c6eaf0e8912e26837e85fd7cf669f9725cbce5ef05271b0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 33.0MB
        • SHA256 b8e8ca9ff512644d33f5819968ae4fededf292cf7de719b1861476ce4ed18f03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 32.8MB
        • SHA256 5b112284154fd1905c4f7d98fac1916b2a134df73871f8fe14438a4d3b6b6381
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 30.3MB
        • SHA256 959e33d288bd29b0c1545cd18044e84b76e47275e962bd8be6182fcb3b056dbc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
        • Size 31.1MB
        • SHA256 a19dfefb5627ce231a7e9d8b22e1bce0ad1dc4c019389128c9c0fa63117e5ebe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
        • Size 31.7MB
        • SHA256 6d85d744a0121240d148fb532910436eb25a1887a19a511f7b8d69ddba419433
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
        • Size 29.3MB
        • SHA256 5b176c3bc5fd7d3e372734aa3d562a48066559772b862cd2e50ac89b4bf34131
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
        • Size 31.9MB
        • SHA256 41918891c818721a75728028c283dfb34948ade38ff525c2b5091788a937618d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
        • Size 30.5MB
        • SHA256 baa59a09b5612bfa0bdb1e062d99fdf679359fe2a6c3b08b18f9408c3362c9c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe
        • Size 36.3MB
        • SHA256 c826ccc7b268b07e4fa9aab2d525b5926a36ea9c490cb10b5da7f82c174adcfd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe
        • Size 32.2MB
        • SHA256 ee97d229b5f5b5d4cb25fa4e07ca91af1dc67dd9e4e99fd74a435f70c6636679
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe
        • Size 28.9MB
        • SHA256 e1d75b790c7ed85aa4ddcaf79322214b5fe1a74fa37cdd3dd912bc3d78594c2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
        • Size 29.4MB
        • SHA256 15b25d2b356088cbbaa2de8210cd4cc9542ee94a2ab6274f56b3d47bc4356501
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe
        • Size 28.9MB
        • SHA256 d4a625fbcae480a742148922764eb05a315396fc9bca5ecf6747c9765e9cce61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe
        • Size 28.2MB
        • SHA256 62170a46a4eb1cd1af9adff41bd079e3b726e4466264734854c09d853fbf4689
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe
        • Size 27.6MB
        • SHA256 f04e6783019f6e22a7f6cd8caa159ab074af6dc16feafc12f12402b1f4e1e967
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fontconfig.properties.src
        • Path C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src
        • Size 32.4MB
        • SHA256 0881c426c53ac172d1a36b403d752060e3816d9e4a734fbbb1b30a0a444c019d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jabswitch.exe
        • Size 30.4MB
        • SHA256 424d7d1d9bb46a1e35843f9588c355c789eb322d976680d4ca1f587229a2686a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jre-1.8\bin\java-rmi.exe
        • Size 21.8MB
        • SHA256 0b7c4cff849dcaac23d0e0ef7cd390ab289824f3eb5ba244fd0931b0eaecd6d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jre-1.8\bin\java.exe
        • Size 28.1MB
        • SHA256 472c832a4255b845a356951fdb543de5ac262de7cb3fd6213ac0198b8468d483
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javacpl.exe
        • Size 23.9MB
        • SHA256 3e980626603a0b143bdafec6716b07eb00b776f7e9384e5f7a828967a0b4b961
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javaw.exe
        • Size 23.3MB
        • SHA256 abf588e330fcffe46f02d8cc98332896fd826d61da2ee9a2faa2f2e5c7a7877a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javaws.exe
        • Size 24.4MB
        • SHA256 8c98ac5b0b77d7a2038bc9e4685ac85ca6319d29a61baf04a0bdbeeb44e3cace
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jjs.exe
        • Size 24.2MB
        • SHA256 77b49ba8c3306229264d2fcc7caba67f7a132c4b050955c1fcb2fb927ed538cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
        • Size 23.2MB
        • SHA256 c067dcc82441f3961c86bfe1dc28fb55ed1c342dc7babcf0f51b6bf5ef58a6d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jre-1.8\bin\keytool.exe
        • Size 21.4MB
        • SHA256 c94f47740e6cc7f144f90430a2797f77af262acf633517e379971f79053f8934
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jre-1.8\bin\kinit.exe
        • Size 22.1MB
        • SHA256 7f23267fa1ac515bf88021cfd2129705ea10a5ea0ece296de08d769edb35b59d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jre-1.8\bin\klist.exe
        • Size 23.0MB
        • SHA256 3a9ca570a761eb0866d5c3f19fa8ca7a87fd323691bd4074078c678533d98117
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jre-1.8\bin\ktab.exe
        • Size 19.8MB
        • SHA256 5a8be38d9d96cddb91e2163497a22f81eca093561dab23a6675bd03d6abca46c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jre-1.8\bin\orbd.exe
        • Size 22.2MB
        • SHA256 9c5676e3177b553229c190e2faf3e8f8048df4047b98e2bb3bb1824607ad3a75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jre-1.8\bin\pack200.exe
        • Size 22.6MB
        • SHA256 eda12aa27e3fb2d9c4de411cb5d4b6ff2ac19ab7eb0f8c3e6e861bfef757a1ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jre-1.8\bin\policytool.exe
        • Size 21.6MB
        • SHA256 b614b98984ac48faeb2a5fa4d6c96220b814a49ed344f027fabceb57e4023bd9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 26.2MB
        • SHA256 5abe1ef50343f1eb0ce7eabe573348ea6e0d7191f565dbf642f279a143305741
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download