Overview

overview

8

Static

static

3

2026-08-07...r_.exe

windows10-2004-x64

8

2026-08-07...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    69s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 01:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-07_48845ea9efb8cda672cccb775349e168_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 41.9MB
  • Sample260808-bt4tnsfl9t
  • SHA256 5c964caa2add77b619a2deaa104d0e83c7d832751ccca1dcc3a032d4e0a4d8a6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_48845ea9efb8cda672cccb775349e168_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-07_48845ea9efb8cda672cccb775349e168_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2148
  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_48845ea9efb8cda672cccb775349e168_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-07_48845ea9efb8cda672cccb775349e168_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5072

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 41.9MB
        • SHA256 5c964caa2add77b619a2deaa104d0e83c7d832751ccca1dcc3a032d4e0a4d8a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 42.3MB
        • SHA256 8cadcc73a6b524ece4d464f0a4d24ccd909a672aaf94dc9f463d0efc936d8eb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 44.1MB
        • SHA256 c4d713eaeb6ec0b4e62a1196a8d4fa089738f857f3fc2759c9b102051d9b9652
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 80.2MB
        • SHA256 4aa7d5522db99577a15ed2a2faa330cdc3989b5f6a72cf57a9e8dfc2d61fa5f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 65.8MB
        • SHA256 f1f79d780a0a01d45c671d9a8c9ce352b6d6d50573d9c053cccc211bd72d3b0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 64.1MB
        • SHA256 019988e1783258cdccdffc6cb48e1331431fc7de2a12a287d1435f54592d7137
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 68.6MB
        • SHA256 592ab808b408d8232eebd06dd4a33c9c863242c40f2ec6996827d7900b32e4ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 71.1MB
        • SHA256 40f42186629f95e99fdb711048d3226d757bcef21aafe864aee6b4fb9776f661
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 67.2MB
        • SHA256 db10dd2649342b5750cb465b03d5c394dc1190129daacff3431756c291d6b364
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 62.2MB
        • SHA256 376cdb76fe4b13d53ffa5d9e96aaed05a55876182b8d8ce9015992dc4de1d8f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 63.4MB
        • SHA256 41dd2cddb51111f7f4ff38a57441d48d16ecb013d2e09504f79599282e62df4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 59.4MB
        • SHA256 9640c5e9e3a441e6c163d9bcb76af2b17e3f3d772ba6021054a8f7223d5af525
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 62.4MB
        • SHA256 502419ba0b86d9a93b5fe09faaa24e1bce999bafc563766b4e6a6dc5ba19959d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 59.6MB
        • SHA256 ef078cd5c2bd63204bb8f29c7d07a5231cbc5de0309ea9d8a46b10e5d53da95e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 55.1MB
        • SHA256 319f5376df3dca0eef81b4d0802229b850a2cc0b51d25e4394ce0363dd49d9a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 53.9MB
        • SHA256 2be77967a3adc8f329f3bb59a4f054a6efdf1ab87bb4ef9a565dc66a92cb0541
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 52.8MB
        • SHA256 0859ece18d985c6582bd2a92abeabc7420cbee87ed55e064b489e21649c29881
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 52.9MB
        • SHA256 9b675f47429e984a97dcd5b5368b269faaffb3793cb9fa76fc78367348c36af4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 50.1MB
        • SHA256 e015e36c10799dfdac87f91be4447e89fb50ceeca758ed0adafd29b64a7887f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 49.6MB
        • SHA256 67cb637b2c3ffd4dae2d6c629062497153317b3a844e04e220dd0555fd337aed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 47.4MB
        • SHA256 3eb9bababb2c172deffc061960badc75574d9a139a16276160d6543598bec186
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 46.1MB
        • SHA256 c2929d446eaf6a7afd8a738d3742dd3600e3a0f3dbcb603fa5fb61d8bdfe6598
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 44.5MB
        • SHA256 519c120ca2aca045c254c3c8e4819fa4121fabc67f75b2dcaec3e64b3c8ded53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 39.4MB
        • SHA256 de3dd2b1efec28eadd417ee054c7d290736e328060405c17dfb79939e644e973
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 42.9MB
        • SHA256 c5365e47ff6c0e38f50cd7616743cd527c1b9b6d589134494a993d9225b58c6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 39.3MB
        • SHA256 782652ad39283170dae8bd73bc75f2681c066b70621c654df6322c966f3c14c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 43.2MB
        • SHA256 f808f6a51005b02ca9e62c1029ba0bf8e2eb442da751250ed11205db7f6e4dba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 44.3MB
        • SHA256 eea133133c0ba5499c51fae4c2e3e198349fa193d7539f9a28aa17f72766fa91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 35.6MB
        • SHA256 c423cdbe828611041b2402e84a45952b9e5da6bd6bfa4209560a6bbd238b95f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 38.8MB
        • SHA256 40de6021e3de14df1ecc355932b4b71330392f673fa484a1f34a050e3e3aff42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 39.9MB
        • SHA256 34a479b2fb405d6b0747b50df3245eb17c206e7e2daf85c0887625380bb147bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 39.8MB
        • SHA256 ce684f81ebffab4579c4e0d24252654c67b53746027f100149afd4daaed6f6a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 34.2MB
        • SHA256 924befa26642bf51a66eda171da3ca9957148a27fb75049646aebe38086ca8ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 37.2MB
        • SHA256 9631d84fe4d1f75608b849f1a2fca2e892f1e4b5202808ccc3677b78b091b9be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 36.6MB
        • SHA256 86ac71ca45b2a2f6e18cd7011a95f8da37290494726946bb71992cc4329f8a88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 34.7MB
        • SHA256 2776875d90eed6e6b5af989c99847b23a5f77129f3561d7a29bc99020932c4e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 32.8MB
        • SHA256 684b338c976caa3cf3c936f9d413eafab34555a87fa2e10596524bf472941128
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 31.7MB
        • SHA256 dac71632263e590814e6dc5cc7d3786964f64fb6e00567a283fb0c2305b2ef75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 29.9MB
        • SHA256 b3da938ab15cf3596b0a3092714e9b73f63c7d6c921d04de65214cefeb8942fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 28.9MB
        • SHA256 5cf79413f2e08af7e7fac220e141b5c7eb05fbaf8f3915035bf0131b9634b271
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 24.0MB
        • SHA256 e22c349b06399856d36cb60110dda38d16541e81e6842f7371e4e107d0962cdc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 27.7MB
        • SHA256 7d75ea881184074f150d4237ea5c14f39bef97dac4f5890a22a68a53c497bd67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 23.2MB
        • SHA256 f40aec3d30165e9f8bf430b7c04141fd23b1ca2f061b8249abdfbc1e214f2822
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 26.8MB
        • SHA256 d5805cfa461c8ccb396c9bfc39ed8edec075ee4dfbae36f8b7e7a28380a8786b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 24.6MB
        • SHA256 765abbc9224914721d8c12817c5b8f7b02960ae4fce8766f08e14a88f01feac3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 24.2MB
        • SHA256 f6f54d8bec3058b23a2bc044b9fd3f9b91cb5244e4b2d9229b9f768a3482f194
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 23.9MB
        • SHA256 39b9b1a55eb56f277059f3ef47673d083ed33caa0e9a15866c96a854e1a59f65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 23.8MB
        • SHA256 706a9fe4774dcde4028acb51ba3192089719ca9ba6521e568b80cd9679005717
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 23.1MB
        • SHA256 2f02e9b3340896ecc97d57985067405ccc8dc278b0c98329e1125872695e68d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 64KB
        • SHA256 79a0b1f3b0958e830806c9254c2ba2af079ac99713004febcc3610200c9f504e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 76.4MB
        • SHA256 d92291affcd3ede48f29d5ee88afa113f77e7fd2b54b08a77e8e0e2c4e32c8dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 69.6MB
        • SHA256 be8326e202d82b8df94ad5222c245b35d62ee1f24674a9c746bd9e1c13f4dc4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 73.6MB
        • SHA256 609bb12ee824266c33e2f0bbf5e568a65306c7e58da7a3ac15cf551ab3458ce7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 68.9MB
        • SHA256 68283c964c0a5847d07c32646e27a8df17528c488440247da248643515f9e6c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download