Overview

overview

8

Static

static

3

2026-08-07...r_.exe

windows10-2004-x64

8

2026-08-07...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    39s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 00:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-07_95635a4b7c0d5e48a5e5f21636a224be_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 43.2MB
  • Sample260808-batvcsztfz
  • SHA256 71e78eda5604054da3807c68ea79d864a4863b0be915e7fcac2c6eb9fec1dd3b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_95635a4b7c0d5e48a5e5f21636a224be_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-07_95635a4b7c0d5e48a5e5f21636a224be_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5204
  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_95635a4b7c0d5e48a5e5f21636a224be_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-07_95635a4b7c0d5e48a5e5f21636a224be_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2536

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 43.5MB
        • SHA256 ae8736f6ef952e2726a5504863308c75f4676dc84cdee913527eeb5d041de60d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 80.8MB
        • SHA256 633cd9112b5daee137b1f83a85fe536325b56d528fbba8b3bc9a56c9208032c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 75.9MB
        • SHA256 2cada1b14613dca25fae33a41a8d6c112b5f7c31f972f6f1312f536e30f4732f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 70.2MB
        • SHA256 2874511abc936b07181632c0e90782721894210ba3f50169e4fc6e0687207065
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 45.3MB
        • SHA256 2bf2beabbc36b529ec27830c200fee7176b4ffaa5b001891616f96e31f6d5f02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 65.9MB
        • SHA256 73b1e9c09f0e9e66d1b5245c939c4f0c032ac68d8cf107f5734a18479f01ada3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 59.4MB
        • SHA256 ecd347e19e6981c6d880d3f0d39f503308e5367b71609bac6d38e4a663093af2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 60.6MB
        • SHA256 c75af24eada4c0a832b79c66e74f29b158bd3886d0a5dd31efa8aab4617c2566
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 60.1MB
        • SHA256 d9959e7d6d90bc31c9cc2e45fa1d8e9fbfdb1f49f828f823b48e66bf6882fa48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 57.1MB
        • SHA256 02e1e06cefa303e1f5cd3672bd25c9cee81bad671331a07aea5108a282db9bfe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 55.4MB
        • SHA256 3b6402c80557e44defbc841a8ffd805938fb09c3cc179d9ce89e3fbccb05e6dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 53.3MB
        • SHA256 770b89d7a95399860109fd50b93bdd9bf02ea2ba48142cd5e717e591d61d8fb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 52.2MB
        • SHA256 45c0e839613bcb84d74c52f80e8dfe46c4cb69587512aed4cb58ea7004a99a15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 704KB
        • SHA256 d00fd9890e5b8b4ab20c6c689c78fd344e6f1bfc77541401e70ed34840570659
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 49.2MB
        • SHA256 ef82bc502663022ea395f497dcfe3ae6e80b726cd1d0a627f7aebd81bcd88c54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 45.0MB
        • SHA256 c53304d96b2c26fa8f1724fc6135f92ed76792749c45eb3a05a6bb17a0155fba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 47.9MB
        • SHA256 cdd12520f719052052c8f1ffe7d293b76f7bb47d49b1c25187c90f3d62ca23c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 47.6MB
        • SHA256 938688725165c550a48e13c227a4c2d57e787e03f7a4b6d5eeac0f04c62978e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 47.2MB
        • SHA256 bc022a760ad59359e4941137eca325ff4a3362ac37f9c07e52c59986001b953f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 46.9MB
        • SHA256 357a243d8bc393082601808495314ad679b0458e3571219882d65b759ddcf96d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 43.6MB
        • SHA256 92cd1c7d5a0a381e9c337ec1026bcb1d0fd771f218dbb0f9e6ad14976d996431
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 46.2MB
        • SHA256 38c5b68b6e8a92da3d7838cf33edbb72cb714e3d195814c6105da873a2ee6cbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 41.7MB
        • SHA256 e36c3be2f5222a5ca70c2076474e11a313bf1f9e0640e49e26a305c0fb8f6ac7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 44.4MB
        • SHA256 ef59197d10cf90f2409d00b5062cef850acb2b48c12ebbdd15f67c67413a21ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 44.0MB
        • SHA256 0de1d5139e4ffa1e85c9c3a132ee63ce80b35b0061749f3e25bd9391677033e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 43.1MB
        • SHA256 9dc0544134da8b17b08e81800ed92ed878a18d485b400b85cee0c6848ecc553e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 42.4MB
        • SHA256 ca4bcac7443208b4f22c6c1be3c8be238828d6f182e7e69462d0c19c1e5a0b36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 42.1MB
        • SHA256 2f82ecc236ac339181bb726a633948d2d60f65f4ee5d4c912b3b91c128ef86ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 40.3MB
        • SHA256 eaee6f251c1deb04b1a8faeceecf238add932f784caf8c73e9983377dbbf302d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 39.5MB
        • SHA256 6e8a1f5f054633feb77339f054887e678ede40b3c35fa0f01d53a70b5bebd50f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 38.0MB
        • SHA256 445e065788dae9901fdaa91f2720ea23a8e3c513be53a8e7a9373dcc3bda2a70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 36.9MB
        • SHA256 fc4bc136a7cf3d507b29e15174d730b0b6dd8abe2518b72c22fe5226b6e5116f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 36.2MB
        • SHA256 8e257a0b554f2be9199e37b095829cb6bae10f754730970eda9830977d1e8a96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 34.8MB
        • SHA256 735fef5fd66dc1a8c8bb21a002a4910f46688823481052ec146ed9d0e7ca10f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 34.1MB
        • SHA256 9f3ea4ad9e2af4b7bf42a43d931231cbba5539a12838e5cf4f92ce4f11bbec2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 33.6MB
        • SHA256 a86a66969785086e39a6bac057a597258ded49d762d1aaca72ad127c3ea28f0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 33.2MB
        • SHA256 7e3ad37335b67b71eaae6666992129574d89e3dd75485c85010de392e1094d58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 33.0MB
        • SHA256 6ca0beb53594ebc0be3671dec7a42d713713d1b3737bf0bceebf52fe5da47f9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 64KB
        • SHA256 79a0b1f3b0958e830806c9254c2ba2af079ac99713004febcc3610200c9f504e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 31.4MB
        • SHA256 49ffeba18200dbd53eae5821915571f1aed0c1c416a2133c2488e427d36b2c82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 30.6MB
        • SHA256 ca61236001e370b3dcb41163b3b94717162a0afb2eb551ff1d50cc751a85e27d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 29.3MB
        • SHA256 70f5fc9b517ec09422d45c171cf290ed9478f4775dabdcc2597f25ebe097d727
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 28.4MB
        • SHA256 8d6f0aacbd0ff6bfe496ccb5a7c0e8592d3a8635609eaad7548d0d903ac99cd5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 27.9MB
        • SHA256 3b6ce36d4a2b7fa8f502e2613829c83b9deb97b53cd5a22580fe661ec17d62de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 27.7MB
        • SHA256 663acf0c5d3298250da86290f738c0ebce2b78c7b1be98e358f766d177e95aab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 27.0MB
        • SHA256 1fef145a6d851239cff3799172c267dc46750db8de84bdae8aef1864d5a52170
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 63.6MB
        • SHA256 e761de5af801182f4db99425b8ccb792c42d4fb488ee5cbd1245ba8afcd7f7e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 62.1MB
        • SHA256 cb027e9b69e5dfb53f687504dcc4b9541b4dbf737cdbff4f979d3a9d726116fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 62.0MB
        • SHA256 c994611df3a7f89a9a119a3d373d28e6522cf9b22d0eb0f3c6779db36f37283a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 61.4MB
        • SHA256 34fce9766e9bb2afea1744c04063f628d30edcd9d400790ceebf3747a7b36864
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download