Overview

overview

8

Static

static

3

2026-08-13...r_.exe

windows10-2004-x64

8

2026-08-13...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    71s
  • max time network
    138s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/08/2026, 03:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-13_dcd696df92289ba858c626e5839bf556_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 35.3MB
  • Sample260813-dn17psyxdt
  • SHA256 c554f642b559ffb7a7755a369f00c8cb4ac4b93971a9704259ee7cf538c6fe18
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_dcd696df92289ba858c626e5839bf556_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_dcd696df92289ba858c626e5839bf556_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5476
  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_dcd696df92289ba858c626e5839bf556_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-13_dcd696df92289ba858c626e5839bf556_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4556

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 70.7MB
        • SHA256 cab840ddab4272244c40ce4fa2850c63ac7eee5b686cc4fd7fb5f47c2a027939
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 74.7MB
        • SHA256 87933a34952bc87bdb3b5ea45f096116bfbc91f87a0c9546b293f556b0be45ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 71.0MB
        • SHA256 0e3e732e04c42f495ab6706f3372e07a4be1f6ef098032213ff5945ca3f1f19a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 37.4MB
        • SHA256 6923f7f976059e2611d48407969c2087b9c85676570935a36fe4f123357c8269
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 70.7MB
        • SHA256 4b7d4a5c0595eeff57fef058d104871281533f6a53ebca004b4947afa4878f61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 70.2MB
        • SHA256 2360bc470fb59ead9d4a63c05f54f18ee4e32f957c625298069488e6cb6dd010
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 72.3MB
        • SHA256 c7b99d4dcdabb792e3b9ff17aa60d472fb77926899bed25ef159e00bdb624959
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 74.1MB
        • SHA256 70cd90dc8ebf6f6ba9dad37c1b90cf2b615732f3ab67ba501c7cc1a06456672b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 72.9MB
        • SHA256 bf1e9284694765181b892ffafc0426ec8e768d9160f9e35bb1cf5d2e12da3d11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 70.4MB
        • SHA256 a60919dee950abdab17b0af9f7f23f1d24154c42c5c9dff848d4d0f43606b59a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 71.9MB
        • SHA256 5ea8ebf13e7bcfee5885bb9c158ef90a84296521228948607d9f888d1b5c9b3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 68.9MB
        • SHA256 909ff24292f6879f64e86f4a3f6f1cbed602fa753eb58022ffa6267fd8110fcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 69.0MB
        • SHA256 0329e1c820da09764a1a2f0121c644d1eabdb4fdb4d88a69a65d2c7666f874a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 68.5MB
        • SHA256 414eafea8a3a6858b8306506ae2bc3c48db4ff690c74e7fcfa27b44910deb8e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 69.5MB
        • SHA256 bc3e27092f37e00cf55a05a3b65921512bbfcee0553cae0df91d62932b5e6e8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 65.2MB
        • SHA256 97b184567e4f2b9d0c1fdd29acd9775f31597b3daee2c933f4f8d09eccbdff13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 66.1MB
        • SHA256 c4a754bdc141a84b9d40dbb66f9c5ddb00862ad21e87b4d882b56f7372987f1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 63.8MB
        • SHA256 8d60dacae588e3407178f5e90d63754870381c755e7e8bea8db21f055b1c832a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 63.3MB
        • SHA256 a3f0baf37d2870d6926dcac5e4d21f39df00eea1be3e5272eddac607a483431c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 62.0MB
        • SHA256 042b6e6585c6d36f3192cf9e9dbcf339299faed4f3694f602bc144c3fc83a9fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 58.7MB
        • SHA256 b88d32c83be2017ea16b7f31f1c9b0a5faab8937064c1620e805b2ea48beda37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 59.7MB
        • SHA256 498ee0ec7858d2a5a6ca8dd887afc134f0fe55cd002a1159282e9408e4964372
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 55.8MB
        • SHA256 929ee997da512894260e7661435f7800ba6f824b1f1602de49c4738d12e27a54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 56.1MB
        • SHA256 928d7666057d788b3bcadc761e53cc92e69eb94c50f88f803d946d9824ebeb2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 55.4MB
        • SHA256 e641825635718ca02b83961ae0dcae417c98621bb1b48ad659fdcbd30ab473ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 52.8MB
        • SHA256 d596e9790fe28a982a1ceb14ef754e035fccc3d406cbc60d79871339d6308519
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 55.3MB
        • SHA256 52bb4c11f5fdb4b96ddbdb5926f44a433a02914ee29545080133065e171a5385
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 56.2MB
        • SHA256 a2179b1bdfb2a4069f6b46ac1c87914320d9d85ab3f090f5da615223b680787f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 54.4MB
        • SHA256 e063db6495dc99fbd9da8988e7687b44743bcf8d5dee8e05da3d0cdf45e59bc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 55.9MB
        • SHA256 cc38daaa262d3bbb76a03e74cf5b11bb62bbe0f58d9610c8f28f233d95293362
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 54.3MB
        • SHA256 d7a8997d4f3071ebf8b2c5904defbabc3e2a7ce3c4a5cdd5622a756992a0e9ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 54.6MB
        • SHA256 4e7345d3eef1856971fb64ff489e7dbff3c74db175140715348964400541754d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 54.8MB
        • SHA256 fa5a6e88bd6cec77c304adffa7c59781abcaba6dcba0a61f4c345b4303654bb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 53.1MB
        • SHA256 c87adda2c44daede4e21c9c49c47f507cea6e0d13b190cf6784575f96727b33a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 52.1MB
        • SHA256 0bdfc35f98f30fb97bd5c7a19da39a4acaacc93cf167f5457c3439022b7a065f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 53.1MB
        • SHA256 82a7f9c542d0c160fdadff887f71f8babb0ba5aabdf970c33f253282d908ab14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 70.7MB
        • SHA256 0babfbf280084bd85475571b55835d330760f6f3b68c7aa9d08172a909fdf777
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 70.7MB
        • SHA256 002f1b371fe637cf03fe861b9384353a81d983f69e734ffaab35f4cd17d5b50b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 70.7MB
        • SHA256 e5a540425df64bfde78c5bab86146c8b8c300adfe6d903138131bdef77508b2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 70.7MB
        • SHA256 ff415f60173d96ad704c5c5e8f845898c774feee6a8e83f3d1dafd98a48fe1df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download