Overview

overview

8

Static

static

3

2026-08-10...r_.exe

windows10-2004-x64

8

2026-08-10...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    57s
  • max time network
    157s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/08/2026, 14:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-10_c6102e2a18549de1b1e439d02c9d5a03_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 36.6MB
  • Sample260810-sbgpvs1emg
  • SHA256 9ec99439f8e350abe698680a569fe4f80a619ca2be52dbef35b6587eb9adf8f8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_c6102e2a18549de1b1e439d02c9d5a03_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_c6102e2a18549de1b1e439d02c9d5a03_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3304
  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_c6102e2a18549de1b1e439d02c9d5a03_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-10_c6102e2a18549de1b1e439d02c9d5a03_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4308

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 37.1MB
        • SHA256 bda5ffc1655f4d3f7e37ac5adfda01529f2756cca4112fabe8c0acda65250c37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 36.6MB
        • SHA256 9ec99439f8e350abe698680a569fe4f80a619ca2be52dbef35b6587eb9adf8f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 37.3MB
        • SHA256 f61c5b691e9868cf4bc20042271aba7ad14198891bf1fe11ba7414f1bae98492
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 73.2MB
        • SHA256 de00b50eb81e9ffb5fa1c1ea52d160393c75c6dd8dee8e300f7b6f1a96fb2096
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 73.2MB
        • SHA256 0841c04971d3dffc7fcce99260ba7dd27c47adc1d7aa128cb16316e6c386f89e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 77.3MB
        • SHA256 45c227a42862d61ab12553c2f69667acac877c8018cb3fc37469d04ba6b03340
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 73.5MB
        • SHA256 867b02c0aa05f7be63f5388dd54c704ff9c73f7205e55621089fabfcbe6b0678
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 60.1MB
        • SHA256 8c4ee301e2cb34da39e320dad64f159be50b543f54ba1aade9af0ef4cb4ca89c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 75.3MB
        • SHA256 a9efafe533145107e3034c9db3c654fd4d64bb62bf6f6afe478167d9077e4e1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 59.2MB
        • SHA256 4d89be445dbb4ff4649c5f74500aa445925a4b6ee83c8641836fc28658b44a5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 58.2MB
        • SHA256 2a2286e952f570694086f42072a7bbe30f1e320bd13aee8e01081d9f5c35763c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 61.5MB
        • SHA256 6b84f8b1abf58e999395f424b4baa961f152d482f0a8f17731d23c03289b486a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 59.5MB
        • SHA256 3da224f53facd77dbc8b9c2911ad899e3618f87c0213875b2c7e2c81dab1cb59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 59.9MB
        • SHA256 793c408e4fd2a26becea860e68a089363d0ca75207cc22b6998f1813b60e24d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 54.6MB
        • SHA256 6f766db8c2575454f1ea6caca905790b49815395c74023a1af969f150de96e63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 51.7MB
        • SHA256 034c7249a274d5e07af205b089dae8b5a7dd0548362fc7904e53aed0981fc9bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 49.7MB
        • SHA256 9d6255a30c3b79c2ce1955652e5500e0f36db322e4e6df4a05f276557ce66b64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 49.2MB
        • SHA256 9400fe56ceeb285aaed1bb422c12a478058e136a0a2453923ed764fb1aaa8ab3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 48.2MB
        • SHA256 73d7c0588485e8075d8517136db24a64bdec396b204fa61a5d0fd2cb0ff697d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 46.9MB
        • SHA256 5faaf0e1bd80012789fb4a7a4e04e4903686b05b46a31588c36e6a359231c6c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 45.7MB
        • SHA256 4cc9ce198771f6904e303ca53fa91b3a57752060b51d1a00e0fd4e64e2be6901
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 43.5MB
        • SHA256 015425008fa22db0bb0e2c01c9731358046c2428721ce42c9077e6b31e817585
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 42.1MB
        • SHA256 3b0d522ae3e468b851e212ffb6a7ffc57c499d4b2594aa8bc7d6f727276593fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 40.6MB
        • SHA256 83eb96d1010228ae50add0fc1931363430a259e4a0cb7fdedf4fd5734434bc02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 39.9MB
        • SHA256 41690713773708990c2cc136f3e515265d537271bf5a7019a0efa27830352f84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 38.6MB
        • SHA256 71df9bdaaf5a87a1533dd64a42fc1dcb6e5c132345931b135977d381ae1a86a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 38.1MB
        • SHA256 50746ffc3243a468f272053a82ab3fc0ab8ac1103aa0fdc208467ac4c11f7a64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 37.8MB
        • SHA256 2151f1c103ae09519da9a859205cce411c6e5fee39dcc308f02dcd99b286e0a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 37.4MB
        • SHA256 a8ecf7088848ed128a7b35d54055ba969ab4143c6171555c7e20db2119bdbfa9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 36.9MB
        • SHA256 6a2a05f1232f4da33b64eef05032e102148b5dd95265c6be845c35c58c583a01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 36.5MB
        • SHA256 9de3355ec3ce0933d017f2c376d0ebc1aa13996c84aefa4d502761808218368a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 36.1MB
        • SHA256 9adee1523a06d94577bb3d9eef66113ae6e3da81d71b7a980653e43946bd349e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 35.5MB
        • SHA256 7264b33e500c3acbfcda3c75498879d5cacc85817d9ee3a648997f6b19cf1047
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 34.4MB
        • SHA256 bdf622ae77a93ecd5ce0aa884b86a579d67d152f75907633f660ef1a37b17896
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 32.8MB
        • SHA256 dad13f88feccda7cd76e788574816421b9bdf9cef2c1be7f85a03e3f1868e707
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 32.1MB
        • SHA256 021901052341b001ce8b8e19aa3e7e36a93dd6510d33689b2229363a17090c0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 62.4MB
        • SHA256 9057448de1230d01f93bc28a7c9219b883dec204f8fdd17cf3a7a0335af08c5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 60.9MB
        • SHA256 e0d8e2af70437c93de6429c3563185d2830fc20f5980000bafd4c197b90853a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download