Overview

overview

8

Static

static

3

2026-08-09...r_.exe

windows10-2004-x64

8

2026-08-09...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    57s
  • max time network
    114s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    09/08/2026, 16:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-09_9996af6f54592049ebea2a09e1ccf351_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 15.8MB
  • Sample260809-tsmswahr2w
  • SHA256 f546a1ada9027232ac69826728877f0d5f0d426034f830ae7573d1db8e610276
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_9996af6f54592049ebea2a09e1ccf351_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_9996af6f54592049ebea2a09e1ccf351_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:728
  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_9996af6f54592049ebea2a09e1ccf351_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-09_9996af6f54592049ebea2a09e1ccf351_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4712

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 16.5MB
        • SHA256 17891f4e3bef113243e26a35a54e6e9b0ddd366c82d4145297e3a5b2e15b5507
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 15.8MB
        • SHA256 d237804bdb440d274daa368132753cb7178b6165c195c9241386498149ff6dbe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 21.9MB
        • SHA256 8af91e8970490a99d58efc3e32d8c99273aeda60ac7a9eaa15412baf9aa97cdc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 17.5MB
        • SHA256 78bdbfd8d798b72880c4f37e1ef3274bfae8ffbd12eecb6e1ec8dda27afb6ba5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 18.1MB
        • SHA256 d8b74aac0dfeed3f3640dc44648b9f78a8967dbffcf65ef46de81642b9ec0017
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 17.5MB
        • SHA256 d0cbc2153b7dc8fe28c31495bb8a813e36bd3e0a0aaa9240e99e70a8480a5c07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 18.9MB
        • SHA256 e03378606f24bbe26d0d2984da90aaefa71f928bcbb6e7abb85ebbc696c1bbb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 33.1MB
        • SHA256 02951123ebf22d0252991a0e3d43a439e0359e7c089e716c534383aec936d660
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 31.7MB
        • SHA256 ba29764022bde9286aecae1c1b1873e03f34c2d96d74539bf15cf76036840e25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 31.7MB
        • SHA256 79f9209f379d3e189f187b174a8a51627b1d59e0fdcaddcbe2a15254839fe18a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 31.7MB
        • SHA256 4300827c9386192b3f9f57dd0f30e27ced62616c952305a763db19a54d00cbe6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 31.7MB
        • SHA256 8e48dba4985785b2f64fe021a046603dc4a19675ba2f506c48802f3ae3592641
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 31.9MB
        • SHA256 1773a0a2fd6fa34f96a5146f099e97b8f97047eaf215590a6afb988d8aab67e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 31.7MB
        • SHA256 2a2b733f0cf49c041d1e98745b9b12d7f8dd575475b610fbcfcf9bf534ede1e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 31.7MB
        • SHA256 eb06062e45f1728447ee19077f9f6a1046afae8f1929d1b5422e9c8080de3a2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 31.8MB
        • SHA256 6535aabb338ff4d02d0f3b31e78c22c008ec85d1511de1c33a21278ecae5e5ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 31.7MB
        • SHA256 d57c9dab2c746f40d49460ece91628bee3da8cd107ed1725deb38f2f78e6cb73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 31.7MB
        • SHA256 560ef0319f0324a2fe0bf5daeec587885aee52a1c893e283a936a51be9ca0abc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 32.1MB
        • SHA256 8d1fe97691178430c32f2f8e6a5fb162a3654c5b2c0d56fb98a96ebdfd073069
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 31.7MB
        • SHA256 76d3c0abdaca249d0e250d371e65fa2052352a4d765d5de3a6c7b175355a7e10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 31.3MB
        • SHA256 fed29519e1b26bce9e08387d976fdec47138f933001e0b0072e39fcbb1023ce8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 31.7MB
        • SHA256 28714f702e07f44db275711dd9651b098487215e166f1773dc08c5e6110b3006
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 17.3MB
        • SHA256 d42d0961250ab89147e8a1b4915ee0a062c6323a55a26c81e03c946e18b7753e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 31.7MB
        • SHA256 6d537a7e62db41b5328a1c1347a34f145cba224495265daf734bf6377e7d05e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 30.4MB
        • SHA256 d0d160ddff74a67d90c70dd44822db942853b521350e2e8675248d63a45b4aa0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 30.4MB
        • SHA256 d2c627931e634723b1394dfaf28e2e270245cae3870489c2e42146ee56578265
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 31.7MB
        • SHA256 c9c8fe23d698da90f1e7d01f539d7b31fad110c3d0da7b094ff69a2f8cfee39f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 31.7MB
        • SHA256 013dc7901a4353c595f85665d88f5f5f121caf5b5b6935bcfaee81dd76cd731c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 31.7MB
        • SHA256 c9851a57a9f67568ac29923188b080102fb365b95210824e7f9c5a5776b8e6ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 31.7MB
        • SHA256 55c155005279b28a1cc63764dca1d87124542d0f1953a24529eef218c34107ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 31.7MB
        • SHA256 cbdfcc6882b891f97380ff42244c5df6cfc2ff10024fb954fe4e30d0d1eb1edb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 31.7MB
        • SHA256 0ab11eb93c3155143e90be0ce2d3fe407bafda5299abc292e12d282e6f8a4247
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 31.7MB
        • SHA256 655d8db983459a899120d4b98d4d2bd3f9d730d7a4db290d738f238d4c8e552b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 31.7MB
        • SHA256 a2cad3d170f1ea85b10d2fd5c2293945bd30b34d9b48cde4be9f10625bccc336
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 31.4MB
        • SHA256 99d19c810dd547ea93e54ef794756aafc687f9c97d31809a30bbf985ba97d5a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 31.7MB
        • SHA256 42af8e021d51ad27ec2523c1316d7274a2f9fe65e009bf03b44246ea82b52aaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 31.7MB
        • SHA256 5ba3785b0ab699a8a828ced268288258b6efec6860e42aee1cb31962a09faf29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 15.9MB
        • SHA256 e724221063e8e7d9997c706647475304caa136a15fe3bc7e9ea1a5f949b59bdb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 15.9MB
        • SHA256 bc59a96a756f329493f42efd28f66f4be5edfe1c7f19151d210a6657848e9f08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 15.9MB
        • SHA256 d58ca07230b4975c271f0468cdcf0fb63d9bfcfbde72644b1609c3aa231ba7ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 31.2MB
        • SHA256 5e8922f73c948736877340cb5f9354ca5211e1620e5fb83871f08232b21c332e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 31.7MB
        • SHA256 0ac961fee86b5316e59fec8995b895136573cc2bc97d2de0acee64bdc42098c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 31.7MB
        • SHA256 bc21b44c648067bf058d29614545420dc383c09985aa088e8d91e0d2858ef690
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 31.7MB
        • SHA256 0e067f3e43d9e4e43eb591cff8f04be0b6388151beaa0873e71a61ca831f78f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 31.7MB
        • SHA256 39ab25f0d7cba2a517c9e1f39e0333c1489c5ba47608d8339151c95fa4a9667b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 31.7MB
        • SHA256 e51421f6b866b585a00ce69e1d01713da804bd3ee991ee8ca6aa35091ac0eac9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 31.9MB
        • SHA256 dadb40fd30b59942b2309a5bc44f332bc4e9b4e9be44cee64f39b537c4911e30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 31.7MB
        • SHA256 f88c1bbc32ebc67b0c83d329a592e4e67cc3abadc4fdc4fd97ff035accd02716
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 31.7MB
        • SHA256 c67fdd8a9d89432739aeba96f9347ae28a068a7b9936a1817ab3f728a727c939
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 31.7MB
        • SHA256 90f3a6a59bf801c7ca6c34ff64d3c75eb655b68a28d5befb84bebb03fc5e204e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 31.7MB
        • SHA256 6af317b45d47553dfecdd8bc38d1bf750e63614bd06d9f117ddf4183cdafa6b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 29.8MB
        • SHA256 ec629a48d064816e4b4f2c45e889bafd7107e2a74681ab12a70dc0e85289ba99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 31.9MB
        • SHA256 f5fbd94b7d896727d3eaa6df163225fc5e7d07c77795bb3e9de778ec96a0b34a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 31.8MB
        • SHA256 a847b7b93ff1e45d98f0938fa0d383c3c22d08ef125a409717a9fe5dbaeaf0c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 29.5MB
        • SHA256 4445617e56a7334d889021fcc0874ca0ff2b8cdc1bc2ae6e769a0993b5394114
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 31.9MB
        • SHA256 da387ed76c0ee706f0d5561ab4160ca2f5b64b236c231a2a2e26f2a3cc14e55c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
        • Size 31.7MB
        • SHA256 8eec1af53893a911dcac10b55dff6c41ef121e6a32b417ad8ee1f3526671f43f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
        • Size 31.8MB
        • SHA256 3942d1dcefeb296648ad454cada606def06aa84017f24fa79611a9762a341a90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 15.8MB
        • SHA256 f546a1ada9027232ac69826728877f0d5f0d426034f830ae7573d1db8e610276
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/728-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/728-4-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4712-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download