Overview

overview

8

Static

static

3

2026-08-07...r_.exe

windows10-2004-x64

8

2026-08-07...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    28s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 01:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-07_230bad12b23e368721bd9d6108b1aa28_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 19.7MB
  • Sample260808-b54caafn8v
  • SHA256 e3c6be15183cd738fe13d5a85bac1ef5d06b56a36cda72e0a28f9c1d0ff2394b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_230bad12b23e368721bd9d6108b1aa28_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-07_230bad12b23e368721bd9d6108b1aa28_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:252
  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_230bad12b23e368721bd9d6108b1aa28_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-07_230bad12b23e368721bd9d6108b1aa28_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1924

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 20.3MB
        • SHA256 066371ab0ed84bb3f01ef444a54923e06725f961b416208b1cdf6bb46dc8626a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 19.7MB
        • SHA256 e3c6be15183cd738fe13d5a85bac1ef5d06b56a36cda72e0a28f9c1d0ff2394b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 19.8MB
        • SHA256 96737a94bb766756c475e8f609079001e1f9e5d64caa79083329091a4fadc0b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 23.8MB
        • SHA256 a32b4ec12f52dc1d57200d5795407077a383ab6ced98f23481accb6266b177e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 43.2MB
        • SHA256 b94c141f94f5f07a3f75f8d8d353f751e5b1615c3e7d1940d94a87180b69129b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 39.5MB
        • SHA256 d61bcc21dec3020186cc8b7b0cd1d9aa7e2a65300f4caf0d21ec426d931c6d12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 45.5MB
        • SHA256 d020f14f985ebcbfb98d2952ce7ef980312f4ed418f8315d9b48980fc6dcb0cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 42.2MB
        • SHA256 ff8c0bc6c7e9105f0ac0f0631028d2323ff6abae6e29a27102f97b163cbe3f0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 41.7MB
        • SHA256 525894144646263398f5e0d7053fb4e6179e25f84f9ff9044d430dba29c7dba2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 41.1MB
        • SHA256 9c6e5b6263573b834a89c1d807fbe0a643b6b73b727df3d39a8f3573f1b94278
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 41.3MB
        • SHA256 aacba031755dc1d9c6fd6d11205ab8e3d841608006755e21716b4ba2c0a53e0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 42.5MB
        • SHA256 f11be2e0d75c1fc6e405cc5e380d3b2f8a9203cb99d0b4bb684b606a84b994b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 40.9MB
        • SHA256 d931fb1b920067851c645683f3788766b34b8056154e059dda5574f07258d042
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ImportShow.htm
        • Path C:\Program Files\ImportShow.htm
        • Size 39.9MB
        • SHA256 93d78c77252f0cfb9d519fa52d262a79eda5b7acb3208370803915abd99054f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 39.5MB
        • SHA256 86b50db104d42fbfd20a2570bf658cdc50aa381b440645aa03baca6739a30764
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 39.4MB
        • SHA256 071edd030840cfe0094884eed080255c75e31f5c4b7f9bf935c5c8e683fb3d31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 38.0MB
        • SHA256 f28d6cb0cc491730b2434fb2eacf85ef23931b48f73e5bd4a16610a3eceb9229
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 39.5MB
        • SHA256 b6ed7bb79230494fde005e626934bee90e1f583517191721fba06130a57d4c8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 39.5MB
        • SHA256 1170485bdbb6816af09a4a9cb5d4b02825c00e65355aadd191af427f7b28b437
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 39.5MB
        • SHA256 b7c2e9672e6e3165070bcc9e1c9ee6de8a009098ae4931777b2e82c945e8af7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 39.7MB
        • SHA256 20179d4bb74735f35659561043a3fe8ad5452b01bac831c825d7d7e0726d4c09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 39.5MB
        • SHA256 c178b1cb164c2e6d274ab60bdc8c7ae17d15ed3088ea6e40f782c094c53354df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 38.9MB
        • SHA256 961d51271c6058ae9baedc5420ad9398fa6164607399c4334354c2383058dd0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 39.6MB
        • SHA256 60279dcc782e67a8a8758b327dd8571c9f08a98a82ec643ca0a50e599b060235
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 38.6MB
        • SHA256 3954d8939be27f2e75e0564db0e8f38ae71e818d0c5d9e07fda13389b1745249
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 39.5MB
        • SHA256 ca59c533642b7b52f155569493f75441e23a4840c036962497880febb0d76bec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 39.6MB
        • SHA256 3b23ead195b6d5ddf63635d1e24b459f04ea48b130465ec9d57d48f51b5684a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 39.7MB
        • SHA256 283e3b635dda5912b9d28bcf7885d66eb5a29df9a5b899f74a196a5e3ad1e677
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 39.9MB
        • SHA256 54b8a03183b5ac61d6085529aea3e14dcd0007597b2e80e1617c4e158b8ab75e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 39.5MB
        • SHA256 4a5811542f64847702e4c733ccce560dde41244346e2a7a4ee9e0a9df3cebac9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 39.5MB
        • SHA256 e17914b281425473eb74423a0a0b516d8d42bfd45f9fbbc22855c9ce2bd5af47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 39.5MB
        • SHA256 bbc5f5e3608d3eee13c7a53f10e59719c9d39d5b1ef46c0e8db81612df352c84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 35.2MB
        • SHA256 c94db4aa05083e2fc7adb6b92fa29e0171dbd4c17678d198bee888e8a1324ea6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 39.5MB
        • SHA256 f1025d4d38f5a22732fe6a737e4f26fe869f04a1b4a966e2528c11eb41500edc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 39.5MB
        • SHA256 fbaa10905dc593ba53a2c55dded90d01db78cd21ec4c47ecf7ba8dd36d021a03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 39.5MB
        • SHA256 438cf812d995d9e197ba6bbaec732622a68c7845e2e34dcfdb423c31a51c7f24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 39.5MB
        • SHA256 8deafa7d67f66104030d8095dc75b7c2a97fdc2ca003b38d5abc2f3cb6a4b97d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 39.5MB
        • SHA256 46e3fd14b2519220d054eaca152d120e567f37e30b5312c56d79fa1dccf1b200
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 39.5MB
        • SHA256 5e729571f1ebd182102ccd1409dc53decfae7de17b0718eb8f65be783a860a05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 39.5MB
        • SHA256 219646feea7a61f50d4d2bb72023889e98f32441110ee61f433da3c69c1914a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 39.5MB
        • SHA256 d25ace9e07b6f73e3924f839faa00d2133231ec45c1e86dc1c24e8457e8a3daf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 39.5MB
        • SHA256 dbdac94929d29b71a7911d26f6cf0ad9f56dce7aa5074211c4a7cf07aa72e7aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 39.5MB
        • SHA256 55b129033a3482c713b753d15baf4a16421d5debc2815257e6879fd0291cd185
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 39.5MB
        • SHA256 ec07cc76fb81554461ea95f89a17caa62c97761b011ce7e631427faa1a2c21a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 34.4MB
        • SHA256 a094ad0821d044e88139c1ef43eb88fdadad6a296326e208679f3567ddff9a96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 39.5MB
        • SHA256 f987f5d4ab35fa0f475a7af8db80418b8acc6a18241a1eb6a19f449c854b2cec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 19.7MB
        • SHA256 baad4f271daa81b88d7ec5187977b55e3adb57c9e71c78020de3a23c539ea11f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 39.5MB
        • SHA256 6d4d169fbcba86bb0214775a9d51cd403b68c8edc9b01a6cc7ca76ce87198859
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 39.5MB
        • SHA256 d3636b4d8cbf3bfa24a8310baeabb9b5ff35cba95060590df8bf185e640ea214
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 19.7MB
        • SHA256 eeb7f263fd82e1d63aea9bd2d8fb0b289d7b335c2c8e764f64f1ed6ef8234b70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 39.2MB
        • SHA256 2718714f320524de534c939dd87ff6f5132072eb0c65e8327fa62b6271ba39aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 36.5MB
        • SHA256 7e12afe6698a529a0876bf14062578163936c9f5aaeb239a49576a374562fb24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 33.6MB
        • SHA256 737279d4a7be8c06751aa5946c56f151cd0b5899ad5e8c2058bd734b1b8e275e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 39.5MB
        • SHA256 41d58f3fb7869df639c8cdc7b3f3f4c9cd61d61c72ea715b12742b05d0428acb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 38.2MB
        • SHA256 a95be441d87ad0320ff991d3fc212f44917b3bdf8a372ca82f58bbb4894a5071
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 36.1MB
        • SHA256 12d2aa827f1c5f6b2a37d18fa2569683efa22bcc4ca209a24fd609a6e98406f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 39.6MB
        • SHA256 860463222aee67c034b62b619a70901fd2da2df593ffb18fc5e126cfbb21b02c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 39.5MB
        • SHA256 3cbe7cbf72f91adb3e621a72cf5e5a1fb5ace3d9b51142a070f24a187f2d970d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download