Overview

overview

8

Static

static

3

2026-08-07...r_.exe

windows10-2004-x64

8

2026-08-07...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    42s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    08/08/2026, 01:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-07_230bad12b23e368721bd9d6108b1aa28_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 19.7MB
  • Sample260808-b54caafn8v
  • SHA256 e3c6be15183cd738fe13d5a85bac1ef5d06b56a36cda72e0a28f9c1d0ff2394b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_230bad12b23e368721bd9d6108b1aa28_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-07_230bad12b23e368721bd9d6108b1aa28_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4584
  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_230bad12b23e368721bd9d6108b1aa28_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-07_230bad12b23e368721bd9d6108b1aa28_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1728

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 20.4MB
        • SHA256 2d6e317eb9f31423ee6a5a7ec3dd22f9e56036a8ba5cebafa1a39e93e806ed21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 22.0MB
        • SHA256 6d78a9fd072e96ad81d822d44921f6bbbf6ce07f0038d4fbf34ee8446e2808b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 20.0MB
        • SHA256 e728192442727ac7034dbadb4142cf34cf6cac6600a6acd3232e4405d3af4b5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 19.7MB
        • SHA256 1b5234a8be3de83c7979f3067a62e44c568a6cf4b6dc4e0869aa14783158ebdc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 39.5MB
        • SHA256 bbc5f5e3608d3eee13c7a53f10e59719c9d39d5b1ef46c0e8db81612df352c84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 39.1MB
        • SHA256 c395e45e5dcf53e11a6ff28dffcaa3deaf5d2bb098f5f993c9639d2e34cb6c09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 36.8MB
        • SHA256 307e6ea501cf42e608f88f95547c89036a89b66a8ff808cbb5386121f2dcb396
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 34.9MB
        • SHA256 b2a46cb28c8b8a4c57a87d48fa616fa29dce4c08b5efc98b7b3498f44feef8f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 35.6MB
        • SHA256 9825d671b1862a071bd67e75b2350105d5c5842a9c9f6d1098a65e2d519efabc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 35.9MB
        • SHA256 9c2746e73e1fe00703fb757b38661422a431b3c7dcce070eb2eed01a02650e8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 34.3MB
        • SHA256 529fdfddeb3cbfb6d7bf6bb06cf7443fc01b839c73a215356d743be814cb6235
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 34.6MB
        • SHA256 3240a03c13e643d2521930d3dad41d6dc7be3ca0da2ee6ddf04b34811bbb945f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 34.2MB
        • SHA256 2de18ea135809de2790cf51d9a59774aa5e8bbe8eaa121fb7bb488ca5b7c0f67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 33.9MB
        • SHA256 c6733bfd177ec23404ba1b37e4edd5e9957f5e041a198aca82ea7b1fbcf517b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 35.2MB
        • SHA256 6031925a4435e81de365f91146c5d020cf55a45dea2f7011169054387ba0eef1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 32.1MB
        • SHA256 b351bef578e43aaa4cd9dd7eae3abdb774546bff3bcf76c3691ef358114cada4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 33.8MB
        • SHA256 1b3e42b688736aa13670f02eb6c5176b39c792a8798a929813ab24edf02bccdf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 33.7MB
        • SHA256 c07979080818176160128891903074851d6f400f45b524fb9bd6f0edd9b06c05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 33.6MB
        • SHA256 ba7ff8153a2714e540b45535a51617b009d4270656654678b29d69fc801e3882
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 32.8MB
        • SHA256 6b6c5bbcb7d35377a0e8658c92c800f174e87ff40bc65bc1c731f61b6387f041
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 33.2MB
        • SHA256 fd42a4b5a4d51a913c4daf1c0e8bfa8d2f45b294deaf44f475f551a7aa13ddeb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 33.5MB
        • SHA256 fb1b5d8d2b743bcbd9f6cbd8f0e6789bc73886394c43f24151f60b7f11093520
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 19.7MB
        • SHA256 75a7c03e98cb98af230dd47c1b43b1917eb8cfb002f0b1ed87c091a87e1492fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 33.0MB
        • SHA256 08e6589e71835da277ee367a0eac0876c19d3dce424cc42e75cb3ff902e8ef2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 31.0MB
        • SHA256 6b79c371c051cf49a2ef24466e1e530642f35586c1ce51eda8d1c416e8ebb9e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 32.6MB
        • SHA256 2d160564b3de41e7c681687a96eecd29393ae97099c90afd0df9134e6db44ea8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 19.9MB
        • SHA256 f41ff0c95dd794233899b44954e41a4114946f02deb9b66af658068e8174b425
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 31.7MB
        • SHA256 1280da2dbe4296a1f5cad19571b7d484291672000b1df1d60ef4d12819d2d332
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 31.8MB
        • SHA256 04b593e67c3fa7ad5556d81c5cc258e1097bbe6dea2297048c899fed751697b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 31.6MB
        • SHA256 c3bfc9af762a12bebe900528e2b3cc72e8d36bbf4d0ff55c9149183ea6cfe78a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 29.0MB
        • SHA256 d2569058cea20ee926ba524faf5f7e715eaba9abe2ae34d5b2c6e31f369d8cd2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 32.2MB
        • SHA256 78b192520ed798b556be5ae1095d41f54784403b10647ccf5e9f0fde170a974d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 31.9MB
        • SHA256 bb8aac0e87f18f82d930c718de0d04c40f588f94dcc3ba06501b2d81994bb0b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 32.9MB
        • SHA256 d48b2c37a6b7cea82b8543eb777a2a2457e6c769b98d405de1f5e023f4aad179
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 31.4MB
        • SHA256 495fa13404522ca3496e4345caf72adaa58436793a5fb6e495bdb3955a084daf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
        • Size 30.9MB
        • SHA256 28122141a271fc5189a1bcb97ab675a8b9a4f213bb374cae21c4181ede7b0a93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
        • Size 30.8MB
        • SHA256 79cace02ceb97b5e4ac06752338189d0544ad7bcaa289b698450e17c74ff2c3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
        • Size 28.9MB
        • SHA256 e7686038cbb27a5e8f18788a248ef091c1ff7a3113379199d626853c940cf8c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
        • Size 30.1MB
        • SHA256 8c078d999a3e4a6205ca03e8d64816b0ef1ff67cdf29a21add665c01ed80abd1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
        • Size 31.2MB
        • SHA256 9342909d6740375daf9f8fbaf5180bd20640390912ed4ae45416e5ecef074f7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
        • Size 30.6MB
        • SHA256 8d630e6406560641e9d0eaedc443935a2eef546d133968df4c2ad40948e823f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe
        • Size 28.0MB
        • SHA256 161efc2f7eabaec5a6f1cb2bb08f20bdbb397b6d1dde113516b4db409e217316
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe
        • Size 30.0MB
        • SHA256 ad1d80a9dd7199c2d6dcbce30b1120c670e13603979971ef80df5b4f34e2055d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe
        • Size 31.4MB
        • SHA256 796d30cbd3e0a38e77581a00e17eb5ef1fda09711c8a9e67c66bc53564f183cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
        • Size 30.2MB
        • SHA256 64367d1c8b46aef6a2b9c0d57c2cdaaaa07b2ce4dcefaaa93d1151a3ee7f46c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe
        • Size 29.7MB
        • SHA256 eb784f0969a335d1bc6de60c87874972937bf0fcaefc55cb45c2a7ce21b17c79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fontconfig.properties.src
        • Path C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src
        • Size 29.4MB
        • SHA256 25a5fa36f670f7bc057a54b74e4da6afe599d5c4501fd0ede06331351d4978a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jabswitch.exe
        • Size 30.1MB
        • SHA256 7c5fda65808f18f219de6936ae818f72c701a842e9e69f91f97b40ddcc7fb78c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jre-1.8\bin\java-rmi.exe
        • Size 30.4MB
        • SHA256 36b51206a2bc4f2f950f9846acd1961431ea4e23c8faa66bf5344de82c1f648f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jre-1.8\bin\java.exe
        • Size 29.6MB
        • SHA256 0d5fdc315c66b88559da3d7163909c049691e3735c43269e51e60dc374714178
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javacpl.exe
        • Size 27.9MB
        • SHA256 8969eb4871ea40442e197253f845604317f7ba21defcfe7e0b13446fda41bcb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 19.7MB
        • SHA256 e3c6be15183cd738fe13d5a85bac1ef5d06b56a36cda72e0a28f9c1d0ff2394b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download