Overview

overview

8

Static

static

3

2026-08-07...r_.exe

windows10-2004-x64

8

2026-08-07...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    65s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    08/08/2026, 01:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-07_1769d89d2f8d8c62c5d7238d57d0c9b0_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 18.8MB
  • Sample260808-b8991afp3x
  • SHA256 4997000c21e9da18891f4b05e4284048cefe70e471bd6e2e75572da764f671d8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_1769d89d2f8d8c62c5d7238d57d0c9b0_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-07_1769d89d2f8d8c62c5d7238d57d0c9b0_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4124
  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_1769d89d2f8d8c62c5d7238d57d0c9b0_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-07_1769d89d2f8d8c62c5d7238d57d0c9b0_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4616

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 19.5MB
        • SHA256 025d257c02eb7bd50c4ccf66e2efde4a9e02597bc9ee167cfe496ef9c94b978c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 20.9MB
        • SHA256 a161f4d551e831c6a037c97867345167b84a4a03e50a0734a9d09c0163b24b64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 21.8MB
        • SHA256 5a4afcda676c3596c9937bbb6ca6e2af6fb1f70335de057c8eddd86b2687b393
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 20.2MB
        • SHA256 0a6bff81f19c7ec96069c8b1574575a9944b1035fd09e7f6d5825a2614644d9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 37.6MB
        • SHA256 2966ac5f415cb9f7e51af442b1c4a64b4db02cf7d0de0524cc7c881189035891
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 37.6MB
        • SHA256 095270e318b0ce678ff3b1295b7fe11eb0b0c8ff24aee2394f25d61b7773d9b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 37.6MB
        • SHA256 3da864317bf3517161f34b6adf57a78381be4ddeffe91fa0b036ba637e22e74c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 37.6MB
        • SHA256 27a276972ef0f05665956bbf8b7ef2799cc56e547c3bddee25e04572aa788d25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 37.8MB
        • SHA256 19af5d7cbe73ec89ddf90dbc93af3794449d55742f87b29aa2f97c340a4e829a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 35.6MB
        • SHA256 0907aab7e5a81be03252727779885a9026ee6fad2117766854fd4a9123656f4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 37.6MB
        • SHA256 c36a721d7edec94374725883fd4c5cddfb6578a26cee25005d03cf8c4bc274ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 37.7MB
        • SHA256 85b39d0218701fc3a9399eed06c9f36ed045bffe447e362ee62a7b2a603be921
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 36.8MB
        • SHA256 3fd93404b7ef82e200e48f077b585543bea1a84b0c148d29243bb19825787e5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 37.6MB
        • SHA256 c8bf69a90c5cda72e7907d784b074945061cda48130e277e11de4507c850b80e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 35.1MB
        • SHA256 fb276d1602cec111c8cf1b41accd42888701bf7a21520f69874e5b9192faa5f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 37.8MB
        • SHA256 240dc4396e2882e9728ba207ba0f7c47686413a3d1ef9a71a03d53b872d31bb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 36.9MB
        • SHA256 76c5fa4c4e646768d1fbf796d5ec2eff310a359c464ce14d0fc27e153792e8d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 37.6MB
        • SHA256 5a25f196da8f1a05c252220b3b79fb45eec0b2aae27818698823fd52eb86c3ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 33.2MB
        • SHA256 3a73138f2175a523dafe7ffbc1ceffa1f483d7758990b37143e69e7fe6b34d1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 34.8MB
        • SHA256 5aedd75b6b0ba3aeb248ba43b61051ada8fb492b37c4dc58c8aefcfe9bfc92ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 37.4MB
        • SHA256 00b5f78bc825fdcb2ffb9b6ed341a0cf4941e59bb4852d8688d5b4a6232f6f6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 33.2MB
        • SHA256 93ca880f2b78bbb742a27730051d6e4ab0153caedb300b91a4bf5553da4424d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 34.8MB
        • SHA256 d3b4199d138e05e601dd3e93a45a0a3b526c15d9052a6cecc1ebc71341695449
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 34.5MB
        • SHA256 3f04cd1e011d402b067909de3f295a825ad4210d96243a3cc44d8f3b2fd11186
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 34.6MB
        • SHA256 2712bb8eef5ed6b02c184f1e81be8c64491c9c33b5ea46d757f7b4b1f113d532
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 34.1MB
        • SHA256 58611c2799583633266a17dc3c677cb3f4f23c134ec82592386a5be076b197f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 32.6MB
        • SHA256 4c5b9604609cd6273972b5f2628354bcce9f70b8c8cdbb80b3337161a24e0e44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 33.0MB
        • SHA256 2c356735adf6eee84b8908075293d09d95f292b700287e3db5e2ef790462c73f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 36.0MB
        • SHA256 5d9a4481f444fceb354328ca65a3c38d435a4c32004c8ae0612bff9035be6a38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 34.3MB
        • SHA256 1dbf0abe14ca9f499d7e7880462767a05be167185915d1ac1c49d986ced33fbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 33.9MB
        • SHA256 00e0a316a374bfab983259e53de8b6810f25e1a89b4ec6f8f22eaecc39a0aa7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 30.1MB
        • SHA256 4732903b74e152994a921c3b623ef311fa07ae63b1203045c5b09b05bb28c4f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 33.4MB
        • SHA256 a3db96107e66c4f2ec40320218a26b65cb1f38cb7625d69a98cd5f5f30c51278
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 30.5MB
        • SHA256 cc63e3c6a62e1a48eb29037c358b938e03731c4bc1548c96cf0832045f6785c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 33.4MB
        • SHA256 9ba254ea7277a9c6b7466b28e4b3b985bf7d43ab21bea2c3a8d2a9d8db104700
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 34.4MB
        • SHA256 1727d6271f7ea730e284532b3f150ccc57b4d9cb749004961772ed915133c41d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 31.8MB
        • SHA256 5f554cc507cdb17415ab6c70a87c4a78f7939b70845c8e1422e726b36eba98a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 33.6MB
        • SHA256 74eae5d617104616e4f54607402ea290880799199b653e69809a662d57cb8b8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 16.1MB
        • SHA256 2a3f566c50da009b549180b25efcadc81a803bd3de97038da0267e060d03dfa1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 31.4MB
        • SHA256 0f78427ce3a3f75dcde0326fe2710cbd6803c852a38c259757fb27406bfbefb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 33.1MB
        • SHA256 bbfa1e062f8c0385e96b7b5c4bf199c871fd49e0abc14852c4942e741e74c846
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 34.2MB
        • SHA256 d9defcae8e206da1f3d590f20e1a609b1c8d20eeafd5c727825e90d198486c69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 18.8MB
        • SHA256 2892dfc1974312e02c047f13eaaa3ab7ad9fabcbae44c9edcd6edb65de98ee85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 30.6MB
        • SHA256 6633a8550a214961f8f30d5597fcee72bcb593a19b74f9c54c5378dfe42ccf83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 32.5MB
        • SHA256 7d2364a3b4f8705dae0d72547fc58f6cef0ff429de25482f976205afbcecb652
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 32.4MB
        • SHA256 6cf2e2e9e7f446941e7b6a31554ca9c9a0c966720b87e8264d9a15deb1832c53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 32.7MB
        • SHA256 e78ba9bbc4f6f62589a6af748046050734e4c66aec7ddfd1e4103487d1479ff4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
        • Size 32.1MB
        • SHA256 2c4d80355d19ea9b418edd888a44823087c92811fe765a2ad31cce63adef65b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
        • Size 30.0MB
        • SHA256 d5d58a4df89de6c48ce1ed25306af8601edb82828b4d68eac97b3e37e40ed248
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
        • Size 32.6MB
        • SHA256 77a813ff3dd53cbd17f6fbecd3b8419034fd1b8e47368bf7a048f9e627883e71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 18.8MB
        • SHA256 4997000c21e9da18891f4b05e4284048cefe70e471bd6e2e75572da764f671d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4124-4-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4124-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4616-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download