Overview

overview

8

Static

static

3

2026-08-13...r_.exe

windows10-2004-x64

8

2026-08-13...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    21s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/08/2026, 03:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-13_bc5bd48067c333fd39ab91ba1f362227_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 19.9MB
  • Sample260813-d9j6ba1cpg
  • SHA256 02646654e6ef4c8f6cd82dea11419a02147328548736ffb33850295d167a9353
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_bc5bd48067c333fd39ab91ba1f362227_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_bc5bd48067c333fd39ab91ba1f362227_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4228
  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_bc5bd48067c333fd39ab91ba1f362227_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-13_bc5bd48067c333fd39ab91ba1f362227_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1788

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 40.1MB
        • SHA256 f2042d3c19078b30ae8326dc73ec631ca1704a1da8d110c1ecd9bd9fc3e4794a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 39.9MB
        • SHA256 dd2b1ae73e6cc4fecddb0f6d753d6c6087acccda3a09f5f762a1ec7e95a1a73a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 43.9MB
        • SHA256 596da6fc4a6cf784de9c9a025768cb6e8ade9681997b0bc5978f783d75d0ef0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 40.2MB
        • SHA256 97034830a236e39a6e38f433766e8d6a1971e4595622a2c55510751da1aae927
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 43.4MB
        • SHA256 84e284a74e3f24aa7a8620f32cdf917193c0e35093f3b75beeb8367060255627
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 22.1MB
        • SHA256 c25af8c1014813f400b7f411a781aa2571d1ff4ba53e5033c72dbc33bdb1f232
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 37.2MB
        • SHA256 59eb59932e6d06787c16d6e76290944b9c1049cba7bf697ee94d3d4702c0d865
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 37.0MB
        • SHA256 122fda009ba60f76a3316540b949a8ca13e6042ee194df1d368bef9f74ffc11a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 41.6MB
        • SHA256 3292a5d1814a5c3f3de85ac9c714c0b93c8df33246041b8e6edbc982e2a9ef45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 43.3MB
        • SHA256 a939e5fdde040bb3a75d33d2bc62c525520ac231e457ac9d78daa2b2c70c09f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 39.7MB
        • SHA256 738a31f8d1fb63e27c41de25502da186de25b8c36724154b42dff7b021168809
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 41.7MB
        • SHA256 cb4cc6d946366e6f8ee4e65e5afc8ee1137d06b11fb4ae2cc52c2607dfc7a493
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 42.9MB
        • SHA256 bb22d6bbff1dddd592c7496f06dfde6c597a1372f51c785dd22691c3b23b1e2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 41.2MB
        • SHA256 bc7f01dbafeab5ba8bd55319aaaa9e079cd11d0110a64d527454709a1da99a4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 38.2MB
        • SHA256 e072c9c0bd4049f442a016b5b99217572c1d30326469ec3d26a5ed75245aea1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 39.9MB
        • SHA256 6b5cf9e026c82c42b97226c66654d3518c1125a6d944c75856470e478fd2701f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 37.8MB
        • SHA256 2e3bc035c55e3ae5981ce6e3541abb2437ce23c483f64ff8958c37c504bc36fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 36.4MB
        • SHA256 9523372144d097c44756f147b3a9f3c8a0a455c9302799c1e6b233e4206acb44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 38.9MB
        • SHA256 37a26c63cd05ec5489949a9bf9c023aa605f32b3bbb0cbee2d2cf6b4f7c7343e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 37.4MB
        • SHA256 0e32546a753409ebb1c31e2e6da35b9388b7c4d1703ac3bc1133b732fc104563
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 37.8MB
        • SHA256 f177ac9da687ee3660f565eefd8e577a6b0b7da1266faaf678e777cca51acb7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 34.3MB
        • SHA256 17cbd5b4cebc5402079e9b4343af4b8f48ab87d619acd144c0c6972dc518f668
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 38.1MB
        • SHA256 5b41c5c502e694f7ced8f0a7c72666d40807ca5e887ec143b4ecedeb710d860d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 36.7MB
        • SHA256 e96cc7b7047c199becaa5e84da3793e6900e9a7c6176b5a29f83f1ece7526948
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 33.8MB
        • SHA256 af76714a8cbc6bcfb32a5831739e64609c5724844b010ff3a5f976cc80762e7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 37.9MB
        • SHA256 f29a69c2c28251d5e6e81dd0c81d9a304e8f6a6d2c7d59dd89eaf61478aafbed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 38.0MB
        • SHA256 52fdc48410bb5b3d6dfb2ad20e7effa8eae057dffe9c0497c60587ca0284d431
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 37.6MB
        • SHA256 ea8e4038e333eedcb0e32e911295f2397b681655e60279d3221e72eb58ab8c39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 38.8MB
        • SHA256 80c1e20395d9ac0ab5604d43a2d73c774f49d40270cca95d06efff6bc660f050
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 36.8MB
        • SHA256 ed11b48b0f5bced28da99f27bf8aac008077909b3600becc7a8c4394c4978dfa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 37.3MB
        • SHA256 d397e663b4322c45edd76c06937a00fbf7bbac204a05789f24187ce130996941
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 38.4MB
        • SHA256 30fc1fd8089b35deb2c35d4e3d202be6d158974a0857817c1c19125fff0909c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 37.5MB
        • SHA256 e66c58aadc12751073c6b80eb52fd8025835c73ec9f39b6635b87352c8415c20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 36.6MB
        • SHA256 0474478949496d1e95b97b74de7e52618a0cb63af8d83d3c8450bfc119ad2b16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 36.9MB
        • SHA256 79a0eabaf2a5b2fbaa122b471be697e31bd97fa9f8bd2e1154df3c9e97787f28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 19.9MB
        • SHA256 0bef06a8e7f30fbdb08078c7b4c5b93572b1e1ef1ef59a8a32076d0bec34911c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 36.6MB
        • SHA256 f40ff5247b89fff90bbbafe2c79118ef26ad9eb34904128def68681f4b66f869
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 36.4MB
        • SHA256 fa06952f18c4c0f1cb3228bfad347179d0e446763b45069d48daee3fa8d2ef71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 35.9MB
        • SHA256 3e7b94935c558b060429739e04937d67ad55ff899e481ec09f7c38449cda9d91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 34.4MB
        • SHA256 e72aff4983928ec8f9a6338aa79b70f0735dbff9ab77ff69e27aa4623f37e869
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 32.4MB
        • SHA256 3194a9c08c56081d702438a9c002fdcf19faeca9b83c0e475445847d550a2cd3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 36.0MB
        • SHA256 3eebda6484e782c13760a18e29f787a46a3506c930cb739d1d4703f63c54c6c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 32.4MB
        • SHA256 ef5dc14088451d5d8dbb8b05d79982765e48976191bd742ae17debf6a929613a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 35.2MB
        • SHA256 629a827cdc732ead3796d789d656bdf5bea64e0f985ea13178411caaf7bea0fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 32.2MB
        • SHA256 54c578bd438f59a57905cf49f6671fc2768f15a140bd67e08d4a22f64f037aab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 30.8MB
        • SHA256 010146dff9eb2551823a2a3ee415f4a45d386e646c14e957dbf2a3bc328002a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 35.1MB
        • SHA256 d60317b172b6c53e44d690ba78ed5d66c5accb42759830d6fbc395326aa6300b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 39.9MB
        • SHA256 fe1c9606010dba70fb67a450d7a57c94cf2f48bf31b6cac8b94d6f8204956ced
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 39.9MB
        • SHA256 ca5679cab40dbf16b89b8a5c62b2d5d247b5ce584c655d6b496cd9a147b32766
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download