Overview

overview

8

Static

static

3

2026-08-08...r_.exe

windows10-2004-x64

8

2026-08-08...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    9s
  • max time network
    135s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 17:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-08_4cec96a43bd9466d244386685fda94f2_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 41.2MB
  • Sample260808-wjpl8abl41
  • SHA256 af63f7fa4703d3a88766e6c206d8166beb0c5b065ea3c15f6f35f1396d2e5364
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_4cec96a43bd9466d244386685fda94f2_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_4cec96a43bd9466d244386685fda94f2_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1812
  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_4cec96a43bd9466d244386685fda94f2_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-08_4cec96a43bd9466d244386685fda94f2_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4108

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 24.2MB
        • SHA256 9f333bab53994f448371fbd8bbae578c9889ccbb58b6d8f46e9d1a32403ef454
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 24.4MB
        • SHA256 766c12109da65473e0020c41e2c5b1fdd0e6b7292be41a2ea19a0d8315c5a623
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ApproveRestart.exe
        • Path C:\Program Files\ApproveRestart.exe
        • Size 24.9MB
        • SHA256 51d89d68e4663e07148790ce5dae532a2c338022adb627404a66592d7ebbe4b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 26.9MB
        • SHA256 1537977013ced782696850b47277a1cfabdf08300ae7b5e9b23172b20abab07e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 23.7MB
        • SHA256 050fc6cc587509397c62e7ad5bfea71eb1486ad4fae8dc1de0ac6445b9d329f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 26.2MB
        • SHA256 5141488122b4cd95ce6ec2d4b89921f86e8890af660ba89d261c9e648269e608
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 26.9MB
        • SHA256 ef8604fd8cbe05bfd14942abdd656dea0b0312106add8d353ff041e145da06b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 26.6MB
        • SHA256 f4c0ecff94c225f760b91fcfe098def4dd3a1ac462ce29cfa7cc19b59af64b98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 23.6MB
        • SHA256 db798ba8d8197569ed949f6dcd27603e9b0379a7c29c4474f9c3822aa57980fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InitializeRestart.exe
        • Path C:\Program Files\InitializeRestart.exe
        • Size 22.8MB
        • SHA256 59a89bff5ef16c2aab20efa90ab3a92950ff8c413f0b5296cdfad217cb897210
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 25.1MB
        • SHA256 59f96b0af27206c94ff6222369880c9b7679640b31b5e24821e06834e05386d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 22.9MB
        • SHA256 6f1f69e3c578acd9fcf32e66192ac5635c44fafe0707797fa3c6d8abd7e4a096
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 22.1MB
        • SHA256 03fa218cf114b9a69d61512dc1fbfde4a4343bf5fb9a9f920ce4d3d7d4b7bb97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 25.6MB
        • SHA256 54dba7fe743d30321f73a1786ca8619fbca9e4e3e64340946ba44fb3def63190
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 25.4MB
        • SHA256 b329cb1710fea54daff5d6279f6ae0a51dab0829a4d6e24fac8eb0a56a04e912
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 26.1MB
        • SHA256 61e7799175a6879d7b37069f529d63a609461bb15a97521cdfa41cc345e7a1b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 26.1MB
        • SHA256 c6298ebded6a1aa67cc16564b63b83d9c6f4f29321b6026271876a0168078b32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 21.9MB
        • SHA256 42fbde6225983f2ce0922fbe89a68eebd0831f4302cd84ff03f0a2cda5ff4fc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 24.1MB
        • SHA256 2c32d75f0de9043f661f26966af0d8354c7651db69a3659a81f6fc8555dd600d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 24.8MB
        • SHA256 822327c9fcc46a831c58e4feef65855d5507607149a19aa49d502b59134e9f5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 22.6MB
        • SHA256 2ea8f5387f83246385c77af32bcfc7c9ccd540b3b40e5c35b76771da8c32af0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 24.2MB
        • SHA256 6e274c8e7084c8b0bed772e355f8192646be8a5ba86520fa24a9159344859c29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 25.2MB
        • SHA256 60636816e83bbbccac0cffe6ab9b46424f1a7276be9a1da6688e0349ae9dc53e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 24.0MB
        • SHA256 e86afbabbc402fb6a78a2d568e240708689d9f7de32e1cb9826a630ed96c27ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 23.8MB
        • SHA256 ac17270b8766ca002bcc99f2a3ae83e39a68dab1b6bbf25897c405d13eb30492
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 23.4MB
        • SHA256 6606652759dcd3a8c9e3fafe77db37b1ab7f634804b0dbf8a9b0980addd910f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 24.4MB
        • SHA256 f67f070778f56dd9c7c1c718f247db0dfd9a6d0023cf96286e7b051930d85d0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 22.0MB
        • SHA256 9d963aa480716e39ff15d96b852cd3e80c26c8400a295d302312b327581d317e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 24.3MB
        • SHA256 1a33c950393059aeb3be64c12328eb2aa29e7c01b703dc8c586e1bbf880943bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 21.4MB
        • SHA256 8afa28f21908487df900f917957d326b3d08fa88878b87510883dd1722d25bdc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 23.2MB
        • SHA256 4431b30e3628a8859cd7ab11b32cad9107d72a3b58ab83df7e0b302555c96369
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 24.6MB
        • SHA256 de62e9b109ea3510e5a1dd16394f34da58ed4dba10b5cef35e9e54666cb34bd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 23.5MB
        • SHA256 f52e3b44df7828f67d1f9f7febe7213bf8a29df693082b12735386312dd4a651
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 24.1MB
        • SHA256 f3fe7c1e7aa63368146d488c24b3ec7c461de336feb15735b68904a0735fd47f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 23.2MB
        • SHA256 68535455bdeac4112472331d84ead5be22489291d9548a0740e41ab01a1f4f69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 21.4MB
        • SHA256 e42416e2525e590399963cab3a08dc39fcdc73fc9d585b0ce4cf913b796ea5b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 23.4MB
        • SHA256 d2b1ff057e59c38d0b3e16115b950de3701b109efb512011b2d63f19d9d9d0ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 20.6MB
        • SHA256 56800594d65594a66655206202a3ce308fd79ec205f354d8f05cb256b0877a2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 23.1MB
        • SHA256 78177207cb8387490ecdb41c271387b1246e966b8ae5162c369a7aa193dfdc32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 23.3MB
        • SHA256 d57db5916b0ef76d63b58c3ad7ba779226847e6f36e78c5645de0dabedfdb0aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 20.5MB
        • SHA256 d2a87e6ecf21bbd16c7052d5e13e901bc6604bfe1515da864ab4ab4903b4cc5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 23.0MB
        • SHA256 d2d8233557460833af2c2cf22dc1db8832070407ecd2c394500ba870d21c1e49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 23.1MB
        • SHA256 57cb225301b287d69fa169135499b4d7a097fd2cbba0643635cfcf799ed2be3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 19.8MB
        • SHA256 068f0bf547de42e4d3cf870bf4e1d171e39053191a2772ab317ba828129a76a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 19.2MB
        • SHA256 77b96727447728e00458613a33dab8ff86452e865d8a5ecc759ec2cb65b6c794
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 19.9MB
        • SHA256 6a63ff68936892a302c6a231c592ff523bfac9e67bfc290c4b1d66eff16ec505
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 20.2MB
        • SHA256 0d95578f705539798902040fcb36a1f6a5339a8b57df94f7c0bd208a9fac82ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download