Overview

overview

8

Static

static

3

2026-08-11...r_.exe

windows10-2004-x64

2026-08-11...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    25s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/08/2026, 03:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-11_1697a76d0fa4fe77d2f1f5456e1f8a26_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 27.1MB
  • Sample260811-ec3rtscd23
  • SHA256 5a246b378bbbea744e29a1604f6ba92d86bb2d5f6af83ac118764b6230f72abf
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-11_1697a76d0fa4fe77d2f1f5456e1f8a26_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-11_1697a76d0fa4fe77d2f1f5456e1f8a26_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:6072
  • C:\Users\Admin\AppData\Local\Temp\2026-08-11_1697a76d0fa4fe77d2f1f5456e1f8a26_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-11_1697a76d0fa4fe77d2f1f5456e1f8a26_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5264

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        BackupSave.htm
        • Path C:\Program Files\BackupSave.htm
        • Size 27.4MB
        • SHA256 e2d36773192a61c85612d2c0db595a3df7e383b962a9081f73edabc243bc66e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 54.5MB
        • SHA256 5be5c85ae5134cce769a2539f4931d90bb0340f4f0e2a370657522be2a40131a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 54.3MB
        • SHA256 507406b537d5c57f4212f8ca6dcc25099b68eb6372d19846fbb5b84ceb2ab26f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 58.3MB
        • SHA256 fc9b6fd573e58822b22b6b5bedebcc8229ca4735a0edb1cd0fd90866939c9a91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 54.6MB
        • SHA256 ca6b8f1df8624fa5e7fe83d45c8023c3c749acb6b43eda299952590c0ee71a1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 29.2MB
        • SHA256 c0fca3214497eff650a3611cf230d683030b8f5250a0cae3778cdb07b75d38c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 54.3MB
        • SHA256 580d84eabb2633b13cbe410c346d3e09fccdd5d9eb388788639b463986a45157
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 46.2MB
        • SHA256 dc0a266ba5341dbe44bcf06c07683dac1e19ec5bcb8f6845490fa89d65cfa113
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 45.1MB
        • SHA256 245141fb740d91c5776a8f60809980cedb7bfec9c5e22a3a6d2744eb1dad97c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 47.1MB
        • SHA256 a19a4646406d5879c71100e7ddd3042d676ef681e21138163cd68b6b863e0f20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 47.6MB
        • SHA256 6e68c9bcfd0be26db045846c577495b56bf39109d1596964736c6ce61bd15818
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 43.4MB
        • SHA256 ef986eefe9d7cff8ac2958e74047157350044381ed129ce1a53a471414900ee9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 43.5MB
        • SHA256 3a2e4b2a843066779db4b124f5231984ffab0e7340ace2f0f905c88a7fbf0228
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 43.0MB
        • SHA256 794136718dfecc74824b11525c924dadfda073a10e62a206bc831086af0d8336
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 41.8MB
        • SHA256 76c32f7f23b392f08f606318764fd28ade89327b9dabf56b8f7d52a445056757
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 41.6MB
        • SHA256 113f058c5884b485b60efa6496fdcd0ebbb501bfe067c0640b45c4882d4c3c78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 41.1MB
        • SHA256 62ef7b7b35f631cdc1b65775663219782b33c71923fca0872cbe3875c9f80659
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 40.4MB
        • SHA256 4a7eab88a7116053bd49cefef4cc6351f989e93bf4db9445a5e1c357ce8d71da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 39.1MB
        • SHA256 50ae0c923a2ca22ceceeee01955ef170fc38bc717a1bafe515c272154d374b95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 38.7MB
        • SHA256 050a4861173b9065b2fc4dc382194a337ff51f2b6ec4de4519225481f69beccc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 640KB
        • SHA256 8fe8c9833760a8bd2f527537fe17d0772f31ab61d2cd9bf30c370f983807b607
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 34.9MB
        • SHA256 43c031027e16d5205729ebd484e1bce3d512ceba4e4382ee0836303bad53b3d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 34.2MB
        • SHA256 e29c0736e8291b04b451078f76cf1daebad8fae9e84852e725c65b1a3d8b6edc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 33.5MB
        • SHA256 2ee637532c568cd9a1963602bd11b45cc4b86d8fde938982094549f7c8adbcc2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 33.4MB
        • SHA256 eff16e706e5277095dfb4d5f0e58d1d9cb06674f76c98a182db216fabf99dc7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 33.1MB
        • SHA256 9d0bd595dbbf223fe0042cb27bc88cba4098aaff7b243f15e567b9fed397c33d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 32.6MB
        • SHA256 60fb083a4c9b0b0d0206d681ea02158d0688280771edefbc77214a70d6971435
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 31.9MB
        • SHA256 635fbf7e3a0e24eba2f5fd4f89ea261df2eedcf5d0d87afcbfce901ec5da57ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 31.4MB
        • SHA256 1f28d9dbeb0705890506ffb5065e0c9cd88fcef6314707a3c1776d32073cc53a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 31.2MB
        • SHA256 391397bd9df76657e323a8c2c8725d28fb08bfa02b32170562e1a1d6e39c8af5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 30.9MB
        • SHA256 5cd8d96bf7623d2e38d7b10c65029a4c65d6670fa964129d2b6dd169ffc4d07f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 29.2MB
        • SHA256 dd4f263c04416501c6e95551ac6379ca3159b90825ed2dfb8ae89e54fc52327f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 29.7MB
        • SHA256 02436f3296dc74b5ad81e23b67cebe07db8a3565280e053da0ebc093c0387e9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 29.1MB
        • SHA256 a51bb2f5f105c01f0109636ddd51ca627f11753bce6f97042071be11ac1ba6ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 28.5MB
        • SHA256 c29e3635b66eead68d1f93eac6e95d4c17709fd5317399ad6de0dfb9b477357e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 28.2MB
        • SHA256 4e1a613769cbf6973b57035462d4d12b6ca1ab5fa9c0fa7f8c10f1a8419c4257
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 54.3MB
        • SHA256 b5cc24d8f5399378d9d283dae69437e76a5c8692eb1ce5e2fdc0023ee1e5fbc1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 52.5MB
        • SHA256 d02a42e335dd7a6b0ccba33ddbaaa41a88f1696d7144a9f014fd2baa44b579a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 51.4MB
        • SHA256 b04177ec328558c414185476494541ea6ae4c309d37c7a5f6ed2e8492fbea9bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 51.5MB
        • SHA256 26ff5937b92d96f1f8c27a9d536f75c040f95fd98f3bc7521ac800e9c0e39693
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/5264-25-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/6072-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/6072-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download