Overview

overview

8

Static

static

3

2026-08-08...r_.exe

windows10-2004-x64

8

2026-08-08...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    08/08/2026, 17:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-08_4cec96a43bd9466d244386685fda94f2_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 41.2MB
  • Sample260808-wjpl8abl41
  • SHA256 af63f7fa4703d3a88766e6c206d8166beb0c5b065ea3c15f6f35f1396d2e5364
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_4cec96a43bd9466d244386685fda94f2_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_4cec96a43bd9466d244386685fda94f2_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:6116
  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_4cec96a43bd9466d244386685fda94f2_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-08_4cec96a43bd9466d244386685fda94f2_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4884

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 41.9MB
        • SHA256 caee2a914ed612e56ccda87d2e1c57fa5f9d185a9fb48bb096159ba22f2c61c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 41.2MB
        • SHA256 b04b95cec599919aa678c15f388465c8bfbba0d3ef79a6a741fb0d63206c038f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 82.5MB
        • SHA256 20b59bde7178d3ee2d3bd3797cf332d87adfc9c5c377861e9c9ccdd8e3f5b805
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 82.5MB
        • SHA256 796f6b382e35a955739ed9229116210a929dcaffeb0f5c1e52a5c1aeb06d8f04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 82.5MB
        • SHA256 be37df7d7d27f0e0b0ef0698c01a0f1735485eed7d35ebb412af1452b702a042
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 82.5MB
        • SHA256 1d525c402e58667aed7e5d5c03dcd18d2bc75b0d6cf52e5812e15385448e8f76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 82.5MB
        • SHA256 74c1a654200e1470000711eaf88126049fd07bc374a1950d72a6afe9d4c08a6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 82.7MB
        • SHA256 f144534d5c17eceda62cdb76bcf01a8eb4b32c6719c0c5cea81f5c690eba4d4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 82.5MB
        • SHA256 6935db2082964f8b07d859e2a6a5aea0080264830189b8c5af9e4898e04aa083
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 82.5MB
        • SHA256 c32976d07552cbc95bd2fec768043fc291b423236c1b55210cd1bd97340ff62d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 82.6MB
        • SHA256 bfbd6624a92117551b9e376fb729d79b196843e0545b5508dd4cfcfd3a6dda86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 82.5MB
        • SHA256 1118a1c484a1f5545275559323270d291792881108de2de97fe42d19977233b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 82.5MB
        • SHA256 4c9a88827c3af7b4bd58521918a83a11c64c3ef7ae240612921392a22216ed60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 82.6MB
        • SHA256 6f5f106faa207cf3b383f5d3afde8e6bb1bb215506b3a91087b0a7a65ea515b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 82.7MB
        • SHA256 fa48f75f75e6cb929b86d4cc2b89616c167d1d68531a49035ca2a4a6368833f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 82.9MB
        • SHA256 4f372dea26eeef8e7f2c6f00a0572803c35c5700e57d95f562420928f2881fef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 76.2MB
        • SHA256 df0767f9e32c5d4418e167b9f7e6d3f02ee7163c46c64965e7486c5daff6776b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 79.7MB
        • SHA256 4e2c8c4d98171febad53956e509eba115b9625df51ff9eebc2b21fa87cfd0cbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 72.7MB
        • SHA256 ebe3e44b936c0fac833c2dedc4b7fc13f6f77a9dc8e6ed47d957e1abc26fd590
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 19.1MB
        • SHA256 09a7dbbdeafcd0313b3f1c5ef1b9914881a6f70b9e24341720243e2c3deafbb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 14.8MB
        • SHA256 01f833e9607f0f6e6056204f9ea4431aed6e47e1f9dc6785dc0ffa4653a8b7bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 17.1MB
        • SHA256 887cb7c8af295caa9bfc17af0f3dfc90a0777a8b0ff6eba2f2ac8156213c358c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 512KB
        • SHA256 fded04c6d782f8085d397cfe282605c1f1fba531c6920ee79072db343ae14316
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 41.3MB
        • SHA256 2559e775a51a393712cb1854029b838ca3db2b14e937895930fffacce905ea29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 41.2MB
        • SHA256 af63f7fa4703d3a88766e6c206d8166beb0c5b065ea3c15f6f35f1396d2e5364
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download