Overview

overview

8

Static

static

3

2026-08-08...r_.exe

windows10-2004-x64

8

2026-08-08...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    42s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 17:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-08_bfe017feffc206a6fd7c9efb07d0532f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 38.6MB
  • Sample260808-vv3gsavydw
  • SHA256 5f8d56a2c2b57e0538abc4425eb7e51d24ba36f66a711ac8a7d37fa3442a0c6f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_bfe017feffc206a6fd7c9efb07d0532f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_bfe017feffc206a6fd7c9efb07d0532f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1172
  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_bfe017feffc206a6fd7c9efb07d0532f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-08_bfe017feffc206a6fd7c9efb07d0532f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4516

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 38.9MB
        • SHA256 dcdce2fe87c14090bd0550399da7c0ecfb2df9a1b9ad22e816d465876428133f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 77.2MB
        • SHA256 9aab817474273f0c8e4e6931f33e70e464aa65a8d2671c41dfcbcea70733298c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 80.1MB
        • SHA256 e82d0c78df427d9ffee8d619c52bb6ce241bac8792ed066e0ff9a09685aecaad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 77.5MB
        • SHA256 a270907f368f316a30d1001934d05c1bf52b0cad52a37ca31df4b49a64990474
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 40.7MB
        • SHA256 b305e3f7ca3e0321056695604bb720c62ba8d536e4e8e159dff788f8d63972be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 74.4MB
        • SHA256 1794933c43895e4788b04d32fd9c171a484fa16af281751dba8ca409edb1e8e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 64.8MB
        • SHA256 d4c10b439aa043dc9b3a7cd3aa225fbaae73587b2163cb6db407e0bdb97886ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 63.5MB
        • SHA256 eb37c580c236e91e93cdc0c0d48a58b99eb67a9055be01dce22375aaccb2f3a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 67.9MB
        • SHA256 1a8ce8eda0de5ca0df27d37da4d657ecb69ae0d27bc4f3c274ed0d43d7dfcd07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 67.3MB
        • SHA256 3e27ad03441a50a5e78c3e256339b89cc54df08c796d095cb9506baccaf76b8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 65.2MB
        • SHA256 fb67d7f837f5aaa1b22137a2a5bfd5f02ed9fdb1a709422acbeb94835d895d5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 63.1MB
        • SHA256 b29fb7f79f913eb008b1d5204f37c1be13c1ea4dbbd9617e76e26043aceff17a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 62.6MB
        • SHA256 472025f23fe1b4d3d02fb50a3389a3636e9dea2667772ee022f17f61d492d84d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 61.2MB
        • SHA256 50c1c1665ee426b0dc0209f0e72aa989ed047dd6b65b0de5fd43de28a49fbc6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 58.8MB
        • SHA256 4f6884151ef9eab5d08b9556eb099560a8ce88d0b3b5b8aabddb4e71e56cd423
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 57.9MB
        • SHA256 a587a67fc02b9bf15e4cd75db4d315247f1067aea6d364383362aaf58f48ecc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 55.0MB
        • SHA256 ef0d289fd2b3154000f8a4a85830f53abc09092e1ee6ea5eb87a4c4612ddbff2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 54.1MB
        • SHA256 8219e19b6a02df99b2e2035cf5360f89eb808604e935d3cd4f68e3de3d780e84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 52.9MB
        • SHA256 fd2bb7c0852402776f08731a9507af6c620302460d01fd8e60c08484a2467320
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 51.6MB
        • SHA256 639fd0462ce3bc87bbe0d51f57cf2c45b602110f165b3a21114d9530f90871e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 50.3MB
        • SHA256 8abcccbd58dc5cd0edfd4e32c8eaf627597fd737b0ba171478a6a3cbf7a4ac8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 48.9MB
        • SHA256 d8c24d33809ce22bcf57a3044f7baeb954c330aa28c6a3b9bb51c66054fb336f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 47.8MB
        • SHA256 bf4f322d303868f5db61c04353faf6d881f4ec4b7d669b7a5e91ca00610496dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 45.4MB
        • SHA256 438717b1f260faabdd409b9e9c1538e87cd6863e21e9769bac42b2b4e768453f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 43.7MB
        • SHA256 547ce2543dff5f2fe4262d3b2a36e20da559047b8ec7b03734e5fbca5a864e5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 42.6MB
        • SHA256 fd897a527495e7252aceb33ea4658048e5626ef7cfd6495b61ac4f9262a62839
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 41.5MB
        • SHA256 f4a60fb58eae7e83c8801d7af49af437dbbacfbf78e670150e9e825d5566bdf2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 41.1MB
        • SHA256 56c20b16944a3338dca37811000421bc09de6cd017d397e0867bd96d99b09ff5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 39.1MB
        • SHA256 0459fb0241a7f5a1fbad005ec85a0279c37d826912a6a79f30aad5aa1dfef9db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 38.6MB
        • SHA256 28bc70eea8b2109aa3d90613521a20a99d913ee7700b3b6c6b54ed4340667703
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 38.1MB
        • SHA256 74e67323e4fa150b022426fc886e8c38c786391010a9515de630e8bc10f83761
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 37.6MB
        • SHA256 75f551f123091057f8c2add0a492476059deb3054b1aa80e65307cd2acff00b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 37.4MB
        • SHA256 5a5e6acbb5fd3e54929fadafef17f441bd154bf62f4cbacd2ee5b185017b32d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 37.1MB
        • SHA256 ea5f35586c91fd083a25dc58f77fbb5f32024cc63c27c6c908bbbf4244b797c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 73.0MB
        • SHA256 74e93efb67dfc2db5ad99231110455f0480d73518a76155140c20f2774ccc950
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 73.6MB
        • SHA256 dd0b419cfada26e71ccea639e848495b39af33ec013d3425307527a6710ec4fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 71.2MB
        • SHA256 eb16d0165557fcff84fc8c01d14d0c0be7c56242794aa0c7b1ca23f183ba9d0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 69.8MB
        • SHA256 a131d9e652776d13adf3a50879776650e8d163efbc72029dcf30c8b5c8095d09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download