Overview

overview

8

Static

static

3

2026-08-13...r_.exe

windows10-2004-x64

8

2026-08-13...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    16s
  • max time network
    146s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/08/2026, 04:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-13_6fd357cfcea95d549b2eeffe7f56a26f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 19.3MB
  • Sample260813-e9qtjasakh
  • SHA256 d53b5959e15fb1017635496cf8d21e3f2b96f182334e7219e38038dd0c4c413d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_6fd357cfcea95d549b2eeffe7f56a26f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_6fd357cfcea95d549b2eeffe7f56a26f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:964
  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_6fd357cfcea95d549b2eeffe7f56a26f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-13_6fd357cfcea95d549b2eeffe7f56a26f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3080

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        CloseDismount.asp
        • Path C:\Program Files\CloseDismount.asp
        • Size 20.1MB
        • SHA256 83ce3ce039ac6d48474f475824f233e4cbc3171ddcd96c8777d4eb91377a3481
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 42.7MB
        • SHA256 f0094dcfbb3e13950e56df8c64cdf043ae16b4337cda66642ddfc19a243151c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 39.0MB
        • SHA256 877d3668c2aa87e0e510d44cb8e18176fd0981c60c8e75f479f9010d64de4bc1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 19.3MB
        • SHA256 d53b5959e15fb1017635496cf8d21e3f2b96f182334e7219e38038dd0c4c413d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 21.4MB
        • SHA256 5573e03d2e1b5d5a5b7c20ff18e980a0a360c4a15cad1ce353deb120db2c4be2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 38.7MB
        • SHA256 0b020955bd8036fea45d690f56c13c6d36cf9bddaf3aa471a52429f468328082
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 37.2MB
        • SHA256 85b6b37e88996dd55a5ea11d717aa9f8aea57b6b27626747dbdef837bfd5999c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 38.5MB
        • SHA256 39920d377aed6124c798c45ad125b8bffe04f2573cf19c601670df89bc9c98f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 40.3MB
        • SHA256 f16eea5aac5a53048982a274ded230163e32824db953a340997a5c99bab0b8e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 41.5MB
        • SHA256 d613a83be16f8c3021399f062641605e61154fbc3a5bb539c1a19075994e1501
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 40.8MB
        • SHA256 850a19b55b00b73370bb88c1648bfb588106855ca52ae092d01d299593ec18e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 38.1MB
        • SHA256 a8571b826616f2c0253f61e5bb4f1bf0a27063bab5c04efec5d7b8b9775e9ff2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 36.1MB
        • SHA256 824ce8cff6bdedbfb0b8976331f4c74afbe4d5bc7dea37a5ad78378d36540d6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 39.8MB
        • SHA256 8abf6f53c5eb1517fa793a19a4e312f88e2f981a9a8748fe04292780fa90dcda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 36.2MB
        • SHA256 30c5903773bc2bf7a68cd2cdbbfbfeeaee469ac0248256a5f77ce28de02ed09e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 37.5MB
        • SHA256 3bcc4aa6757281ce8c9083410b6e4d4d057641f9e1d4849504206e72b2352086
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 38.6MB
        • SHA256 c2afce6a5caff3030fe223ff08f7407b399424a26f3a1323664cc6cc89b41d68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 37.6MB
        • SHA256 39c96f74ef5f250f1b0e4085dbc6cbd966f1ed13c897a1ec925e6e30869c7576
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 35.4MB
        • SHA256 6ee839804f9e4149cc7dedaee40ea0a7de96f2c0d8f1bacbb37bd76e036afbae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 38.6MB
        • SHA256 5796847406697290e0a51e424b2b5e9d382e106cbb60bc4350c3b659adad6561
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 34.8MB
        • SHA256 bb6e17d455631ec9d1bd5678238bb438c85a1d42deb8e8bc127b418a7292ba71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 36.6MB
        • SHA256 88b149fdbf0c3cd92193f150652daa7dae96f9e3091fbc7afb36f97e9cf7db72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 19.3MB
        • SHA256 14d00dd950f0651c50f1bbc1c3c8a7424b2fccac99f9024733a3fdc9cdd73736
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 33.4MB
        • SHA256 d8e18e859f4f098b6981026e28f04fa99ad5ee0dde45b0f4d8304a596f100195
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 36.9MB
        • SHA256 4e8a3ad07baf264368d45acadd847fe1011e3677cabda1003db72975da665367
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 19.3MB
        • SHA256 4c1f041dd563e8309d21b8da4697180023c48dd6403b33d900733550e9e55657
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 30.9MB
        • SHA256 66382909301a602c024c8a16b5748a72b32664fcd590f4f0123fc7ea6d903abe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 36.0MB
        • SHA256 39215544188f39bdf204736213e1b5a07841453bd6060630bd5f3d8ec072cc10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 32.4MB
        • SHA256 4ae48c792446d0659b165d057d45901254c225ed77fb37e6100a329137eb8fba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 32.7MB
        • SHA256 86372f87f7517702b0d9da1b28a3beea19b357f32e1e4f548e8a50ec310b89ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 31.8MB
        • SHA256 f7aed72671b767d5b515f907f2a45a13c1f092b441fc0ca5cfcd86a7b3bc29b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 33.8MB
        • SHA256 192d06d844a446c72ce20339b5818985585fcc11a39ca6533ada0cd29746d873
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 36.5MB
        • SHA256 4fb661ac2b8ed6b5f32a16211e5ee2eff9e847921ada1f8dbfda09c7aed644fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 31.9MB
        • SHA256 ec1852f2b01b0914b9a7d3437d88bf5b5e73c5160404f89b09e18e19fe4456ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 35.1MB
        • SHA256 1b1787a2658e9d3fdf13b36a3daf67160f149f8a960511a3a6d4477984c82c18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 35.9MB
        • SHA256 99831944ec824c5c8aa7ec97e853b0b87c7b0982b649278e1457ed22e47f959b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 34.1MB
        • SHA256 934c5a314d926ebfb6c41095f5c2bb24a49540f5a9375e866f3e8c2d7db2901c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 35.2MB
        • SHA256 d71498b7c2be453a6ebf7c87cc193608ac8390c6f97c147241c162a0459721c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 31.4MB
        • SHA256 0318c9f75dc271c7be87cc78dc3f26f99af5a97ead255e5ace1ab6777db12bb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 31.3MB
        • SHA256 7172270f1bf73c1e6bfe6ea294af8a029b962bbdd3ec01a095ee4791b1f77499
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 28.4MB
        • SHA256 02c1aa50a798249802419d3855d370e9b4ce5f6e6b427fd56e599ca2d516e091
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 30.6MB
        • SHA256 4306002c01a392e9381335b2d07ce97e43f8d074127236faf036d8ee027c3ed1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 34.4MB
        • SHA256 ad4cea6fe8f6bce7b7cac5b607973dd43738b4a6c7653d2b87986859a8130f32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 32.6MB
        • SHA256 93dfebd6c8062c966d7964d2443c8da9db20efcb53bcb21e5097a1d74b2736d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 28.1MB
        • SHA256 48c7cbcd93f0b67619aa2ba07d1c12727f8db57c3e536ab104c08250d2d9d8e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 34.5MB
        • SHA256 b3a99bcd85eaf8e57de032ceb9236509a1065d216122b8749c51c7512734fd36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 38.8MB
        • SHA256 d5c13a4a103ade0928f2c1bd4533e398808bcca803d146c60b9fea75ec3d6069
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 38.7MB
        • SHA256 c2e911078f644ba3d63aa2ecd68058a27337c29b3ba23ea3b199821f414612cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 38.7MB
        • SHA256 b1740c53e91db742d4f8709df1f987ae3dfb4db310292983a2f3915648821c50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 38.7MB
        • SHA256 0408525e27a4f9bff8df428c3a760c58ab866641efb991946c329e7be4483160
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download