Overview

overview

8

Static

static

3

2026-08-13...r_.exe

windows10-2004-x64

8

2026-08-13...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    47s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/08/2026, 02:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-13_f72ec2e83c2e6e2d29ab7b5edb42223f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 43.1MB
  • Sample260813-dafnvazflg
  • SHA256 d29786f0f4e0225529c2a8ee4e2a10085bc227d35ba949008e5ae7e07304afa5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f72ec2e83c2e6e2d29ab7b5edb42223f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f72ec2e83c2e6e2d29ab7b5edb42223f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3676
  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f72ec2e83c2e6e2d29ab7b5edb42223f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-13_f72ec2e83c2e6e2d29ab7b5edb42223f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2540

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ApproveRequest.htm
        • Path C:\Program Files\ApproveRequest.htm
        • Size 43.7MB
        • SHA256 ba997aa2eccd17d65acb4ce2f8bf4344e7bbd7f4ad036ecafcde73b17be78ec2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 3.2MB
        • SHA256 73a2b93199a1cdefcb919a73430e2a046b465aa297831837463549dec37948ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 86.2MB
        • SHA256 af7a326497316501648f9e1690abee3056b5b07097fac38f57f3eb48a876b0ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 90.3MB
        • SHA256 86ff5c194c1dccefa45e402c880ad9bfd6888e31e16b86b395c790960a628d15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 86.5MB
        • SHA256 b57ff39fc44ff71c51765b8f1a449915dce6acc51d35785191295c41583794e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 45.2MB
        • SHA256 5ec0e724197f47dd515249867f3613014b2e062ccadfd69f30a61501c5ef4a8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 86.3MB
        • SHA256 29839c31e85b1dc31a5b0d714d339e36bd46ae5519bb60b3ec4aac23e52b5b32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 78.1MB
        • SHA256 34d0941b16351d70870ed6cab94b28fe863203f74751666686c0eea6c62272e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 75.7MB
        • SHA256 712cc15a5d5c287a0db622c9ce31d8bd4f1659ac04bf2edd3baddcaa4cea3b42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 80.0MB
        • SHA256 1d41b1fcefb68a5058bd85003749c0838a45c7bc40231615c968b2cef5478573
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 77.8MB
        • SHA256 ee3b0acca92ac0b56b8653828d8eac94f6587db72f6a571e79d6cd518bc97c82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 78.2MB
        • SHA256 ab46046faf4a2d458053705dcd5b3d393266e2323e87e1b8674b77cf7d095cd6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 74.7MB
        • SHA256 84ac4ae2469f917c583a38a1cb15e40dd1ba7fd68ce8e0d6bbf4e14351959f7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 73.1MB
        • SHA256 e2c2451f1262af1cdbd1d9c9d679e1979f8347ba694efc91daca5bb2a3b041a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 66.8MB
        • SHA256 c048351caeda81e772aab40f74ca0f1d546d4d509053776e1a05c8b3b0e70131
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 65.8MB
        • SHA256 65f026f1e80488ea7fef2c26b05137ce58747676a4d7d7034dfdb2f9db6a520b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 64.0MB
        • SHA256 badba42d7802500e90794d37ab25723a3c24b8a5cf10019e36b8365ff21e2e84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 63.4MB
        • SHA256 f91e1000e0a885240e602aa3bd8482a2b4638a7db89aeaf04696184963153ac2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 61.6MB
        • SHA256 02321844b9073c59fd2460757db6a63dcd4d8b534d639bbec912dc426ea78dcf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 60.9MB
        • SHA256 88815e7ced150c1ae1529fee0c20d5e4798112502d23ec6b311c8213f6fb1ee5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 58.0MB
        • SHA256 01e2b86f4e17f568109ef53d3fc6d13f50786b47e8aab7db454114af0bf1700f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 55.3MB
        • SHA256 569cc28848240fbe096eea9e4ac8cec43e53851fcf7651067d7108d3a7fd4755
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 54.4MB
        • SHA256 025b7e68d00507a6ded8f616ce9369bd61220b72d031351915fe23018a508d2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 53.2MB
        • SHA256 cdcf19d744ee11a4ca0aefdf20474cdf24e3012328e2867219fc9e77eaba2360
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 51.2MB
        • SHA256 602c4a265db6ef63b7d423aef63d4fb188c1f6a1394dae70766a9bdfcf61609f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 47.9MB
        • SHA256 987225491d0e252a8a51eeb1aa43ad89c3752d6e0a4656dd36f0e12419d8965e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 47.4MB
        • SHA256 06c73ca354d63570f45352bc02e458c724e9dfe3803e9cca447ee76c2e7c5110
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 46.8MB
        • SHA256 b0cd48c6ff34f7da50e83719a020ed68175d1406d3def869eea0dac96e2439a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 45.9MB
        • SHA256 502bb9e10390c22c8cd9eaafbcb4da9ce8e7d8579ea07ae4d1b9a01918487806
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 45.2MB
        • SHA256 fe6c73d3587ae83cebccd8b83212c1f2e44cb065e917fb1e8b1a53de531c828e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 45.1MB
        • SHA256 ad86163a9cc3bb0a8481ebc25839d15da689bd00e32b4fabea4c39d0bf9e2c80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 43.1MB
        • SHA256 f06ad01fa8c8b63f7b38707813403fc0d43d5de38b0a8267d2e41a7936f95224
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 716KB
        • SHA256 db7f96f3cf0845fa13d7209b39f0edbd4a7775b9ee61bb0b706aa12946a2168d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 85.0MB
        • SHA256 118f3cf257508d854a0939004ff084e5fa65eb93a472bb418a8ca2d0b45a5339
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 84.4MB
        • SHA256 40121a369a3035d7368d2ea25a17bfe5bcf33a38b8e665ea887188122ee05ded
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 82.9MB
        • SHA256 2c7d97b39881723101f1f835f7a4b0643059727b8787e1c0832640ab0a7b51cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 81.3MB
        • SHA256 04472e4bb1e63c63854cdddd7821926d53f54d614cde742ee78051dc59417b3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download