Overview

overview

8

Static

static

3

2026-08-10...r_.exe

windows10-2004-x64

8

2026-08-10...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    26s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/08/2026, 06:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-10_47944867454dfa07f586bd57d62d8068_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 28.2MB
  • Sample260810-hb3xzsshkg
  • SHA256 cd2e24475071793770ab4c03bbdf3d92655ece9007a4798a2a79867914f307ce
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_47944867454dfa07f586bd57d62d8068_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_47944867454dfa07f586bd57d62d8068_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4488
  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_47944867454dfa07f586bd57d62d8068_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-10_47944867454dfa07f586bd57d62d8068_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1240

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 28.2MB
        • SHA256 3d7b42852efa3be1e8d0ee3710c9118537fedf4915a36971a21a327a3733b651
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 32.3MB
        • SHA256 9fe489cc8c9ca275489fb7735515b1d5a7a64420bb3b5f461b4a3f69567aa264
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 56.7MB
        • SHA256 2db7613bda67a1d23880f6c39f239c9ace33f48f86de7f5768f1939a46dba314
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 30.3MB
        • SHA256 8dbf54a5c563840f69576b6c7deb8b2b9454c38a87a3f1aab952bf09db9a8997
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 56.5MB
        • SHA256 399db5a5bfec2761d77407251dad2ddc8312bc2e4d683ab3545813fe5f3810ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 58.0MB
        • SHA256 1184feae51def8bee0fd65d8e1ef3ce0aaa2e841d16aba01b3342f06c336e81e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 55.6MB
        • SHA256 2cc1d0051b3f88b130c8f9e8dd015a26fc3b199462e1d23a1be4b8d074b41c6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 58.1MB
        • SHA256 a2295b7d75f96efee03dd0af37a7343a318a93470b6026887584a7ac48b1c14d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 59.8MB
        • SHA256 a458af267ecce8b6c9c914e81ddcad625cc3c46ce38f404e950fc7dcbb1617cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 52.2MB
        • SHA256 46fb6ba6e6f5ec7d87632de005e1e34d9bd32969f0324fc2359c0da977e45a16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InstallApprove.exe
        • Path C:\Program Files\InstallApprove.exe
        • Size 53.7MB
        • SHA256 77bf648943a44108d1463eda9f3c64e87464e1883f01ba629cbe222a675ec861
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 54.9MB
        • SHA256 cce15c8b3e3a07ceee6182c35eeb7b889124cf9b8bfc02bc38e0e1c7b8d1b9f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 51.2MB
        • SHA256 18fafe9aebf18f1488dd97e3a9875a715bfebffd04d1c7c3fa78253d2c91b3b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 50.9MB
        • SHA256 3899e78feb499926b1b112f1691ef2ca8e3d1cec2fc6bada729edc0179551cda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 48.0MB
        • SHA256 83829d5bce4406516cdcd9bd3c2af137a3216ccc16bf1956782cd81f4ded7681
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 48.0MB
        • SHA256 00503d2c690977865258c4cce5ef7cc85b4e311798ff0ce53107c4b45fc10f97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 48.1MB
        • SHA256 d2fe8c703fa54615ae9ad6e0e06c71a396a34b48a9e6b3fc4c670ba44e5329c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 47.4MB
        • SHA256 d0e975903aeff19cc3ce7afbd7e7db6c18914e90f19820d433eb739c001a468e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 45.9MB
        • SHA256 f2ddb33aac97012cc0dfe530c340b90cc443ce9eb723a4e8e9ec589f5b04b4b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 45.1MB
        • SHA256 5564d328808d86bf49a6dbf56ca2add5c9b56aeffc1d78ddc4b3af4fa839281f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 44.2MB
        • SHA256 036cf202fbebbbe99264d24b271974df88c5d07e5363a16197790cd148bd2ebd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 44.1MB
        • SHA256 94b68b1e2e7ac3d7132dff5c150d228500946bf915a03321a4a026cfba8fda7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 43.6MB
        • SHA256 4f99e0f4be276423dfeb9328cb448013cff06deac384f0db7bc04ca463773e52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 43.9MB
        • SHA256 fa756a94821f26caf091a70ec252c75f18aa43838e38818bb6619ba80d7cd41e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 43.0MB
        • SHA256 6689adf9a6d5090066fd49067c19e591ee46166c1cf30d0e38667dcddd8417cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 43.1MB
        • SHA256 c18cbc3e4982cfd288f5a3014e8a6ede16674396adbef9f94f63fe103ff8ba83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 43.5MB
        • SHA256 88003111fb46ed199c0c1a43a8fe9b247186d21468a52ebe6f9cadd079a2bb1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 37.1MB
        • SHA256 2ecccb8401c84a2699f1c53d76849b674cc25b31727834f53b8884c6bdddc06d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 41.6MB
        • SHA256 cc0908ba4bb17aaab65c2798bb4071df4c98349a7a8f3a0307e827e37bde1bcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 41.3MB
        • SHA256 b36a6ff49ec1d2f78559e1d1ffd9673f2bde604f69e31e756b2c6fca44701a8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 40.8MB
        • SHA256 0b285329372529882bcfa9caead88de9e574799e2548a15787677ded2a6dcc04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 40.6MB
        • SHA256 67629d005f7f582df7eed2ebf76393807817fd851f6dc7c901ca336def4cd581
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 39.9MB
        • SHA256 b3037212b7df39ccf94ec0e2312785958b5360e4551c0c2258c70225d07f67eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 39.9MB
        • SHA256 d711db9a80ebd315a9c4fc85acff86f4686033e8f292fc913ba762d6e5c7602a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 40.2MB
        • SHA256 c767375662f90c32ef016869551ec62a2801184cc56ddda2078fc198600e63b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 39.8MB
        • SHA256 5f3f0a3b882299c584b91ca748865afed99823c93e34beb6c647e39ed5cb8f19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 38.2MB
        • SHA256 8d50d4d8c7a71f95f1f676ce08f129784c5f34a61e089df3dfd0146d30302b76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 38.4MB
        • SHA256 6109c4998c758b0a76c0952f7c524f87a0d0100eb632cf370ba9f0e4429a0e15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 38.6MB
        • SHA256 edce0be6553074bc028f91982bf95fd080d3c32551e174e493b8e1f06aa0a05c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 37.2MB
        • SHA256 e0e60bc471a47e62bb842cdd1e3c8dfc9f4276f8f74de166d52b0c9ad96fc828
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 37.8MB
        • SHA256 f09309eacc0dad7167dd2559f1a84df9df0e83e0952e0d96f8f590f065d6645e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 37.4MB
        • SHA256 3c2482c07cc11d76ba782b63f1642eea08344205cb0b057f33e2d11bd3a67392
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 33.6MB
        • SHA256 e288d11d1c0d851b07db54580d8aee11b5b19c1aeb283d0b12cad4f03088dd55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 56.5MB
        • SHA256 ff8a83477661d65c143848279a98ef4c54753fead9d96538a1b39393b7fc42c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 56.4MB
        • SHA256 3165ce7e736b05249bbc6527ec15e965e56d0b6c2372f0fbee271585563bf472
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 56.4MB
        • SHA256 b08fe1843c393ea010821fde9a1eb01223f43d03af9535ef65a711947121cf4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 56.4MB
        • SHA256 b1a53fca17620ce43f1eca060242103def1fb21f89d3dde3519da5b36df34d92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1240-29-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4488-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4488-16-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download