Overview

overview

8

Static

static

3

2026-08-08...r_.exe

windows10-2004-x64

8

2026-08-08...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    66s
  • max time network
    117s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 18:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-08_1bdbccbc1c38ffc47271c6d8c6913498_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 48.9MB
  • Sample260808-wspnkssdkd
  • SHA256 3e815d0d4b0a664ebbcf1930c1f81e63ea655556e17518c26a1b7105585b153a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_1bdbccbc1c38ffc47271c6d8c6913498_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_1bdbccbc1c38ffc47271c6d8c6913498_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4056
  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_1bdbccbc1c38ffc47271c6d8c6913498_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-08_1bdbccbc1c38ffc47271c6d8c6913498_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4292

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 48.9MB
        • SHA256 3e815d0d4b0a664ebbcf1930c1f81e63ea655556e17518c26a1b7105585b153a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 90.6MB
        • SHA256 e4583dc0901a1fec6066a0ca7999824d43072778bb8d184a27641580b867a9e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 89.1MB
        • SHA256 96f65a18c49703b0fc54aeae2a5e557ab173b83ae4cfefd6a3b051655ee1a791
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CheckpointRegister.htm
        • Path C:\Program Files\CheckpointRegister.htm
        • Size 83.0MB
        • SHA256 5af4d3595c67b8856527203c0db2ee909f04c99dd57dffce4cba166bf3f3353c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 80.9MB
        • SHA256 66216a3aee2b8b01256ee87e2cecc35a3606a824faabee0c382e1454f2f4e717
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 75.4MB
        • SHA256 678a6d996bb28cb47f2b34db342bed19ba853f74f6c4bfe3249d8a7dd9e6cbd5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 70.7MB
        • SHA256 ef4b3025cabe6922cc76001a177c4349ee00c3cc517f535b315f9ce7680a557a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 68.6MB
        • SHA256 f92c0ad151f4a8e783a4606ff19bf63591bdddf4bd24b6e2985cb7fafceb6af0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 54.6MB
        • SHA256 9a83b29ab288a85a3ecd7dfd9a419fbb763ac01fc309a3a60b9809978896b842
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 52.7MB
        • SHA256 1e79ca585670599b69857efc64245df3cd47ab0f39999c5a27307d230e691233
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 53.4MB
        • SHA256 8a6ada816893122531f9d2da9a20dd4c1e6dc14f2f9b8a63b57e1ff10341eeac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 53.4MB
        • SHA256 8c91c29f142cb69a8a66f3e7daf9a7117f0e22f91c2ad0a07621ba0fd917c5f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 50.4MB
        • SHA256 a90c5b150a1d997adccdcb668939dc476d6e427bae0252cf23bff30e3b66a6d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 50.6MB
        • SHA256 b12645d95b3b498ab80185f57eb628e1fdc0f8b4386eff251baee15bb055cefb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 49.7MB
        • SHA256 d036d18455b1747144214c9761088552c42bf819fa6d90eb65613a9c7ab2e0c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 384KB
        • SHA256 3e4e65210d0ce663e458df3dc7915e7345a65463edc2c4781b0feb1a0cd3389a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 48.4MB
        • SHA256 3742363b794db7729bfb8104240f6e22db0bda7803b45c4dd7e7648b68b59ac0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 46.8MB
        • SHA256 754923e3c93f74ea85ce15dd598098e37449a11821f9b956e6eb7bfba25e3065
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 46.6MB
        • SHA256 249046f4efc23f502f136e988041d1805a6e55b675d8f259d11411e224ebc739
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 44.9MB
        • SHA256 4757f10d95a37c72a1870a71edfab2e35c059414659959dccfaa3ef20ab2f658
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 44.9MB
        • SHA256 d4f80daacccccde544e5ba3876d3169dfc460d1d75b9e49421d669a41dba781f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 43.6MB
        • SHA256 9bc467d2d1b2980ce65c664478a79ae48f094fd64e0b0d7f6ab9b3728995e604
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 42.0MB
        • SHA256 adcb06612f43e2dfb473e14948a22d76d7546c267fc35c06d2b1fd03fda8af39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 41.1MB
        • SHA256 22bd0fe9c4d251314d479a7543c90d702c34b7f0526dd7ac111dece2ce0429f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 38.3MB
        • SHA256 a618811510da811a5242e59dca841c1b7b447bf2e650a9e65575ad85ed3cf7f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 38.8MB
        • SHA256 8b58e2df2df680b4bf7c44496119e4614675a4bc78d333ef9f22b1ad47f785a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 37.3MB
        • SHA256 e81ae55c68ef20d659cc9b85b0d0f869b16deb2508fe54ed86b05f67915ba45d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 36.1MB
        • SHA256 aa903288120722c87bcba26d11ef23a7e2b99190c1ed7465ffdc33253db7d06d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 33.6MB
        • SHA256 e68e2f44000237e9502e678e36c5255e1565f56165a31d7f549304781c9c6039
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 35.0MB
        • SHA256 9be90377dd0ffc601e837ba9c770422c88e22e19ca7ad8616944b044aa7291e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 34.7MB
        • SHA256 d89a87ddaf48bc5b4efad7a06c4031283ea6562c2601d53fbb873d980178f94d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 33.7MB
        • SHA256 fea91cd6f1dbd8e91a19093f2f3bbd8edb50893afb9cf1dda12f56e0e1d08d60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 33.4MB
        • SHA256 b00a2d625c218bddfed9968d4f0576bca1b7062d2f8241d9f7371348a35b8d67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 33.1MB
        • SHA256 0b8a919b2f5a7a1fe5698e36a37e30c5311885733b8184ab50627cee5ed51c3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 31.7MB
        • SHA256 29afd70c17ef31a5acaf30d363c7c2cbefb96ee3ea5c82060a780ea06db5c1e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 31.2MB
        • SHA256 33a487517607928cc0c58909a23e8c71969f5370d79b894597bc801206eecb20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 31.1MB
        • SHA256 7def3249afc7badcde5b01057f3944161a2a00209bfc8fdb0f4ae112648225c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 30.7MB
        • SHA256 30d01fb32f7c02849a822cc1b34c1db9e1bcddc2ab3e02ad72bf8a2742bfa4d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 30.4MB
        • SHA256 41f35aed37bbc6b9c3c528291c11eb9cce545328a055493fcb8c75a6ad48f9af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 30.1MB
        • SHA256 ca5783ab4e68da4281b9ef56cbdc526f2b18b2df3834c4ebb539def5771f7e1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 29.9MB
        • SHA256 6734a8878a66666b0f309252b8014471457eefbcd60b232a06885f68a5d40950
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 28.6MB
        • SHA256 43c8b291249122baf239abbac82ec053fe105535e74e6d04473be66500117927
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 27.6MB
        • SHA256 ea4d39c7b6d737d3450f9e35b2746d730d94ac7c1e56c06f40a1c30009016cb8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 25.5MB
        • SHA256 ab8723e89cff73a3266c04d864ab84dc0e22d299ad640e568fa7239ee69b5b08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 66.9MB
        • SHA256 c5179acfa8de250af306960950dc58aa05ecf74c941758054ddfcd70557e8c6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 62.8MB
        • SHA256 4592eb8d7aaa204cc243b9711dd2c3d9bdee11e2f4e306fcf310e4ad82b0d300
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 65.8MB
        • SHA256 93601dec2c80c4cde17ea1cd803020921163afc61b1846454db87f0bd1317de4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 61.6MB
        • SHA256 530e92a19b6b04d746c105f43ab883d6c55a54f9bd4914f287cfb3b4628903dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download