Overview

overview

8

Static

static

3

2026-08-10...r_.exe

windows10-2004-x64

8

2026-08-10...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    25s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/08/2026, 16:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-10_4e7ed0e6a4260816e3f73c11592f90e1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 16.1MB
  • Sample260810-txm97sdj2x
  • SHA256 a0f0044f5e4023fc7622facf205535ad2b2e855378ae09a4afe150a5b0417df8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_4e7ed0e6a4260816e3f73c11592f90e1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_4e7ed0e6a4260816e3f73c11592f90e1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5272
  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_4e7ed0e6a4260816e3f73c11592f90e1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-10_4e7ed0e6a4260816e3f73c11592f90e1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4956

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 16.7MB
        • SHA256 d0dd8d39f782724245fa37da726746977a6f12e00ee9f8bcf6916cca27e977fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 17.1MB
        • SHA256 c6cf7768122a0c2bda394a3ba11f9df81a688ba4f446a0d5a98ffd31f3bddad7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 32.3MB
        • SHA256 8a33fb6b782bc1cc8f167946a8468212a27fddcdb3bbd4e645a2a4ef33016e3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 32.5MB
        • SHA256 10dad7e52379314130f623c4bf2cdb0894e338cc0d909a80c0cc43cca73b514c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 32.3MB
        • SHA256 8069f2b444ce21ffd9316f5c7cd7cfd17e59c1058b29211504023b5a2645f367
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 36.4MB
        • SHA256 9a5b3758d42e2a844a41984bd10efc22f7e7eeecd3e22da36781edefdcc07ddd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 32.6MB
        • SHA256 3e6eace2902d04c4d852b024bf1848a3643ab08e63b31b1c26222e38c59c9b7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 34.4MB
        • SHA256 0612e6654d8fecf2681423fd93ca085dd1fd37e8b6c1c31bb3f94128fadb5432
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 32.4MB
        • SHA256 876df9b764dd8546f83b5b2723c25f72e428cba2865c3d0d8ee9f84e41cce2d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DebugUnprotect.htm
        • Path C:\Program Files\DebugUnprotect.htm
        • Size 32.7MB
        • SHA256 a80d45530796d850bc34cb6232e17e477fe0d3a25bd8ac9da0a2a7513350b383
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 37.6MB
        • SHA256 6c1156d0289f4bbc58933164f7806520b88a4dbf96eb31c88e345841bc773477
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 31.4MB
        • SHA256 c0cac6f266900971b567aac9c661cc1d4d2a63a2314c1e35724796a5067acd15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 34.0MB
        • SHA256 5b70a54e5a244be6020ad9b732d7ed8a4d1539972a22979eb8c082d97201561d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 33.0MB
        • SHA256 8a3ab40aed143404609afb1b6abe63884ce3fa145d38096d84692658911d6175
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 34.5MB
        • SHA256 17065350db7ad56f020c91f483841f40ed1427fb6399310e4e0d08241aee2dac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 33.9MB
        • SHA256 7e77fdabf9dddc78763b9eb44a3ee35068eac0eb1412f5a331d07b035a825e1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 34.1MB
        • SHA256 6283067294371dce4318c34641eda9adf03a2be7c822af17ddf3ed19a19159dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 34.1MB
        • SHA256 272b52c1f557b42022b0e9ad3421c0c845cf7b013e2103c0765b86a6b2dc3814
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 33.7MB
        • SHA256 36348da2cdea029636102137be0658b2028e2c2810925943abe2a87c8f93aba2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 32.3MB
        • SHA256 7704313ad0e2d05e004125c3a20dc0bd462dfd292edff81eb482efaa7a6e3584
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 32.3MB
        • SHA256 d772895acb491f5755b8e3c6a0494034ec581c6fa2279f6280a04faaf071b642
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 32.3MB
        • SHA256 4ba1d4d625872147066769ee20ce22b6f97cd75825f07a85d4eb959af1b64154
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 32.3MB
        • SHA256 fbe4c69065a7eafc932b296070364fc65fcfca62ea2e4c164b4bcab407f8e493
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 32.3MB
        • SHA256 4888bf8f73e1311f9e69689b4688d914abb1b972e9f618a0ce8f46e3cefb2dc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 32.3MB
        • SHA256 b22fe9cfbb5fda6b3e78a9b539a85ca125a40b067457b4e025f66c0d58dcbea9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 32.3MB
        • SHA256 73efb226d6cdb7a19279d8d6b1f86aa43f8042989f9caa2b79c957274e0d1875
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 30.2MB
        • SHA256 10e6a7e7e3642c40949d05bbae87582dfb8123983fb58e8a593efaf9a8aa2c31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 31.1MB
        • SHA256 d4f21d1f966476bfd11e629eead2d7c308f089327e3d04b7a896620bb1fd31d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 32.3MB
        • SHA256 b7c410e6a6e7cc95e4c28f5a1b309fb9da2447fc1d39b0c52dcc044221e03567
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 28.2MB
        • SHA256 ba990660824745f7b57f405b0f746fb9b03d8232d2ffc43e8c5a922422febb7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 32.3MB
        • SHA256 8b8a4f2f5ca94ec28df2597069716e8cdf47e9bc7b0f79c143d706d1d3d023e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 30.3MB
        • SHA256 4e2a84b6db2ebd91abd6c83600c92d5716b62608db1c3756140752f32221d658
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 32.2MB
        • SHA256 72129275d632f73a5feaa886d1e99447939ac58b8ebe60efc207798ffbd52670
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 32.4MB
        • SHA256 9c26c72fc127b07ebaec8e52704555f1241e384c51831f5d868e0f5338158a66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 31.8MB
        • SHA256 a1ec913c54b208a08059a95c4248b2331568f670f22140ea3be5d67f070cfb4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 31.0MB
        • SHA256 fb280db31205de5dcd684329f43153e7123b1309733118ada2714d420d5c76e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 31.7MB
        • SHA256 dba1385021b797911eb2f58365df97cd4fd32441c3a7f90d695da3c698944692
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 30.9MB
        • SHA256 ba62458434f3d017a223006eddd3b4f088c882f8d202cb049bef2aef4d7d5b81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 27.8MB
        • SHA256 d3f16215f5f4dbc8d0630eecac8b9db499a76198851866ff0ae75a504f7870c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 31.7MB
        • SHA256 ed23630b44711c7988e83af7c1c7bce7da2908b014954c8a59e6a8cb0ba97bb9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 29.7MB
        • SHA256 98770b764390fe95c1e7a5eef369e0abf35b5b40aca8bc5b0e6ee0a7a80d995e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 32.3MB
        • SHA256 abe4033a612561dd193e37aac57c85c7ec699054f5806ae883ae908f54667fa5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 31.4MB
        • SHA256 350fe166a8031d357ab2378830b4e06df5ca7c16765b9a2f8a90f2dcf45d53cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 31.3MB
        • SHA256 62da32a64c30ebee04a87b4109376e0d992d98661d66079f1baa94252e03789c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 29.3MB
        • SHA256 eecf96bebc81ad004a8509f8e77ae0eb1a35c1d594da4d48b17ef3e4eb78809e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 28.0MB
        • SHA256 e264629851319cd2b1798b42df6fd8c002999373d28b205ee48d34992651b694
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 31.6MB
        • SHA256 bfd2b92bbdcecacc8752ec5feef15b325eb85a7a0f5ed008ceabe36d607b3bd6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 29.1MB
        • SHA256 30bdb0a63071c61e42d166fa0da1fdf0f1f6d010d17cb2674efedca46c0eae2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 29.2MB
        • SHA256 1591637324c0f7c7b55e003cce6caa48ab814217556e1b73b1f753580d5f76e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 31.5MB
        • SHA256 2ade604fff7e1d84c6dff7557311ee1a4ece615a340c0cd76000d3c223def63d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 29.1MB
        • SHA256 1123295237b13f82970f14601c6d302da96638efdf537125b0c4638e27942df9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 31.2MB
        • SHA256 75d80dc7c632586b898374300dfe96dc250e3b5bb25732902b8e651b213a71ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 28.1MB
        • SHA256 ff258203fc224e8a8c7fbf501ffe2828727e733e56dbfb6d1de7d9379ad7236c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 30.9MB
        • SHA256 204492be5b366989d4f550557e50750f878a7563b74150a1c9fe9f66aec164c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 31.2MB
        • SHA256 53afe226e574126b00866b2f2726debfd750f5fdfd829867051d1c35697ee125
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 32.4MB
        • SHA256 de2441322e09c8670f6e7b306af220e796e3cb45310f51794ba160acb04bc2dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 32.3MB
        • SHA256 2b5b24d9f3fb7f9f2f5e3715a2f1c357f0e5a1647893bf9b27e1376e4ae43d15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 32.3MB
        • SHA256 1a4e948d19cda21cdc730343b85e376d26d6548aecad67a5f50b8e3cea8a9fbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 32.3MB
        • SHA256 464879bf6e05d0d21e6f25555b24d03d6c05965877d4b534729e98b73a4b7c1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download