Overview

overview

8

Static

static

3

2026-08-10...r_.exe

windows10-2004-x64

8

2026-08-10...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/08/2026, 06:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-10_48ae310af77fb508d4179c67d527ef06_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 29.5MB
  • Sample260810-hbx2qsshke
  • SHA256 79ef2c1b828b6c3aeedad99b5e4c8802b953072dc6b7cfdd6b982f87a609d31d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_48ae310af77fb508d4179c67d527ef06_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_48ae310af77fb508d4179c67d527ef06_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4872
  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_48ae310af77fb508d4179c67d527ef06_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-10_48ae310af77fb508d4179c67d527ef06_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1872

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 30.1MB
        • SHA256 faf0ce7c8910264dcebbd28d655c42fc53e40bf4846ca0e83a71c399bc9d878b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 65.0MB
        • SHA256 705e75144cb3ff5475a0e8daa6b1af0af33dc70d2569dd54e04dcb87e6cc6730
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 65.0MB
        • SHA256 ddaaaa9f01f8a95498aab7ec0d40c29d0f07adc20a15f1fffa1fb9ff5ccf9487
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 32.9MB
        • SHA256 1f241042f6fb414f12dc742b6ba6727ca714d95f90dbdf66cb6f219a2055ec17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 31.7MB
        • SHA256 ead0b6d11f04bd600601e87165373b40ed478ebdb9970d7de4fc278a23be639d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 60.8MB
        • SHA256 5f6e27b3dadfb0077343a8ddc3c02c616ebc08d97d63636df30a1f6c3047e84d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 62.0MB
        • SHA256 66d1b45549f8591b65d4a4c15020a12cb7873bdb1f90460047adedc2404118d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 60.3MB
        • SHA256 c104518d53300b308fb68f0cf2a528d7a1444d50eb3080f553f3ccaae6e0f86f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 58.9MB
        • SHA256 4da0cb6c8e658abf314896dbe990b9eb8b68207320365792b4c5d85193250521
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 58.9MB
        • SHA256 363f570913440ab87a2bba725ffd4524ceab206572a5843c316f6b7147768ca6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 58.9MB
        • SHA256 61b87ca557e1b06a4e3724ec1c06dc4cea9979c87068852309bca82d649427e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 58.9MB
        • SHA256 41592bd692a9a9e24e0504b2a3b1c98fad294483effae11c21a64a451a40c9e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 58.9MB
        • SHA256 e87b681ef5726ed64243c1a5d3d0b5c6f61bbbb776dffeaa7d3caa2a9ddc72fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 58.9MB
        • SHA256 b5ef9aadd65316fb07888af0b01448b1500e628b4b0fa9189f1d928417647900
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 58.9MB
        • SHA256 52929a1a1191ad22cf70c5889a871ae8c57ec28c2a1e67a93bb9e5e15964102c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 59.2MB
        • SHA256 e8fbcb4f6317402399d63f626279b1d7cc51aa823dd29a69c3ae5f622db8b7fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 58.9MB
        • SHA256 aea906c598ef2a26c71b49a7132cb7cc2ddaed1370c900bfd9c38f4f705f4cd1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 58.9MB
        • SHA256 d947e726edbebd2b7eeaed8badba0e62d51cdf89476f41d3ff128cd94382a517
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 58.9MB
        • SHA256 a4b1d52884255166a6cd08b1c3a34132525a41f94fcba8ee5695d2a96aa42f3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 58.9MB
        • SHA256 197c22dc5a65b096cdfcf4922d66e76223c950664fa5fe2adb1ffbe0ff78ab39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 59.1MB
        • SHA256 8ae0d89caabc78587c0fcc910d5d3b7cf934726cf9400ff2bb6fa6f92a40f9c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 59.2MB
        • SHA256 42dc4dca773df51608e4387cc20f91d80ae997afef829ccab0ce92a5a03a9cdb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 59.4MB
        • SHA256 08b04096757629b3976507f77b184e435efb2862de253bb3562e53d767eb51b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 58.9MB
        • SHA256 27b690c996c622814b65d7083c47284633ad90ff8624f3631c6455b19a066633
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 58.9MB
        • SHA256 6f58f1dba1d339d5d07ec24e414ce8ec8facb8f2b3a125f31ea2de4069e836c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 58.9MB
        • SHA256 4863fc33b6b362dac6a78d209a1c485dff56756f5230d02b265f49cd9f835570
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 58.9MB
        • SHA256 b7abd0a1fb4275ec7044a9c8a47da9f30f80e55c132083313754e7d6837e7367
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 58.9MB
        • SHA256 ad77831a1729db4c1985127d9ee02719e9293743be1860b9a22974564fbab779
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 58.9MB
        • SHA256 ede0d8d0d3e38d9ed53e278cae5a14c31cdbf6ccd6bce62ced9cc77eb1d49b18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 29.5MB
        • SHA256 f64dd01d974d6667b7d5378e54e0421b111aa220c5093caa5ddfd2d5bba02649
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 29.5MB
        • SHA256 0b99882d153d2e2018a0e64b6f32595fcfbb5e6709616fe65a67520773540140
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 29.5MB
        • SHA256 92a51e2474d11db09b01815631acf6a3642c90ffbdb7c844ba3d25b47ddbba9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 29.5MB
        • SHA256 7fa7d6c35a26041f030123ec5e87ebd9ce2ad552a201bb2d22d4d463c09bac62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 9.0MB
        • SHA256 9b208467c680a6ecb931984ed3c5f1bd32b24fec5ad255ab79a00ef685ea67b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 29.5MB
        • SHA256 79ef2c1b828b6c3aeedad99b5e4c8802b953072dc6b7cfdd6b982f87a609d31d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1872-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4872-4-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4872-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download