Overview

overview

8

Static

static

3

2026-08-13...r_.exe

windows10-2004-x64

8

2026-08-13...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    13/08/2026, 08:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-13_a97d38372db873723ede5742db031840_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 20.0MB
  • Sample260813-kdhe6sdq21
  • SHA256 2ba8a23add8b4e4dd579dedc5019403665df5d6b9e3252ea16a71e7ce574ae81
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_a97d38372db873723ede5742db031840_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_a97d38372db873723ede5742db031840_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:312
  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_a97d38372db873723ede5742db031840_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-13_a97d38372db873723ede5742db031840_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3756

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 20.7MB
        • SHA256 a35179f895b5ab8b20d3c3bda55282e8d6097922580f1db3ef45d40ef8987038
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 24.1MB
        • SHA256 592ef73e87a01a87fce0062cc6cd456fe80b4142c0a89ed0d5c707fc26f464cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 22.2MB
        • SHA256 5bd8317d7faa7e9a50c202b32c570b2a0fda4620909ac1d4af8906e5f8599884
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 40.1MB
        • SHA256 eb874f6e93f1ddefbe03a796750341e61f5693795b01ccd7ece97a57871dfb43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 46.1MB
        • SHA256 1ec59e601b047fe14c7c5752d51e12b9219d2349f5a5efb17b6077af5a1bce3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 41.8MB
        • SHA256 c9e64cbc57df9707338ee501909e33154a04fde6a5a4143240560c0b2b91c9e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 43.5MB
        • SHA256 5615ae05cafc31bc3bb270054415093dd0571810af15bafa735110298ff03711
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 42.3MB
        • SHA256 34853a1ade2b72d5f813a04743c6afa2f27402b91d6d331176f6ebc3289f4768
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 41.7MB
        • SHA256 0d35d6a99e438d4ddbf391fffa31893f259075a06743b7274703f7b9c1274153
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 41.9MB
        • SHA256 7cc69f34bef570670d4592563cafba2e0bff168dc1678e540f64797bf8900b46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 43.1MB
        • SHA256 837178bd1e971b5628e532671462da50fea31d1ebe18ff2c423ded4ae2e1a9ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 41.5MB
        • SHA256 bc1087d6f6b35ee8197d0946bfc9603dbf855164bc4d53f3d1e2a4d250d9443a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 40.1MB
        • SHA256 e6a13bf289fad23cae23806d466ca1f15c506f500278150d063ef04b49b83975
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 40.1MB
        • SHA256 4748eef735b4ace12640ba274896e9d28355da53b30eb493afa785d325453135
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 40.1MB
        • SHA256 691117f1fa215913511316c83e8bd71679877d62e9c08431d3c18317ec954c9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 40.1MB
        • SHA256 6274fcc6388fb13d9bc435051e7adaba27cb0227f1951a60c514bef6ab45f4aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 40.1MB
        • SHA256 248a8291c31b3b4bb195f27349278fdca449499f49223988e99678eaaea39a90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 40.1MB
        • SHA256 5fa0b94f0a8e32555a3aabad61dbb320de519f96e55d28ed719148f4ada46490
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 40.1MB
        • SHA256 4cd5f80ec4cddfb30f272c0af9fa21ef46a0b7c2560c7e475af5bc3993d3e9e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 40.2MB
        • SHA256 7ec6ccea21a6816eb0aa75ee618323f1eb8ecde280c7520a41bbbfc19fb24619
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 40.1MB
        • SHA256 9d2cc1be0018368305a00ae1573a015cfca6cb32775796396578def453312a04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 40.1MB
        • SHA256 400a1acbcd42957acf3467d84d332946ac0fd249f2a172823c6a702ff8b8a8e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 40.2MB
        • SHA256 7968ddbc88384abe1b9f1821ecd9aa770a83dc144d356264696eb4743eaaedd8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 40.5MB
        • SHA256 732fe74e908cd80581cad9b4f7900a97c28c4a428b11691d956837672917ac4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 40.1MB
        • SHA256 a90097922f3ee3df6dd742b0a0ee2d1471c13d76820bc8f0f21840200037f219
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 20.1MB
        • SHA256 4f61443bfd610e394d840d56727e8dc7fa07f3fcc8d63cb9cb12f92b3aa8a529
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 40.1MB
        • SHA256 f824e636b6a621e03963b3ba38ae84b46e028cec84874a5b74ad3eb9474863a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 40.1MB
        • SHA256 4eb903f83b1f9bf66a3a0f6c1ca5f0ea20517e14df7d46502fa358ba4346c6f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 40.1MB
        • SHA256 c732dec5a88ff8222b51b91b0367bf20ee945b45ff9336a85b24051adaebcb3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 40.1MB
        • SHA256 c1a86872ae30d36e7c865c37ae1e7dab87c83266bba2d85f344e234b8f63103c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 40.1MB
        • SHA256 07dc11909a3f353dbc441a3eedbcbb46e6c2e942c2c2ff016706e61e42f8b079
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 40.1MB
        • SHA256 c7e1331c8845031032f80a437d947fbc3271015fa374d3527f6acc6e808600d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 40.1MB
        • SHA256 7f1e802a5f2ad6bd816b0be00af99fd9f2da25805aa8df767728f73084dc390b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 40.1MB
        • SHA256 74965f8fe987eb6e974dd500001763306c435983dd2933a11693aa97f16142f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 40.1MB
        • SHA256 5731248b246cf96d99865ffa6b1f0d65f59ad53b9ddf78fd9e9f3a8bef8a7b86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 40.1MB
        • SHA256 56121923a47dfeceb818522521fba533b32d333f77b39e03c6dffeb7b61abfab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 40.1MB
        • SHA256 7e1bcdf70e0ea4f7ebfde32594e534127fc176037c52fd50d9c7d3fb232349aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 40.1MB
        • SHA256 ffefc12e98530a2a0f6b725b684597f7598e274c6bd9f5f7326c3db6d71816c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 40.1MB
        • SHA256 49b04847e84da996f1482566bba0ab422c61ad59752d0fd5575f5fbd879fc2a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 40.1MB
        • SHA256 4ac47141f257e6a5f0c823a1ad72c560a2651fd34eee8c3af6f23263ac17102d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 40.1MB
        • SHA256 82771df509494334a324a91edbd5c472ae3f5a0ccf841f3e9a9614a4e45cdd72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 40.1MB
        • SHA256 f627f298adcedb24460c1efb3810a3d522ee00849bdb4bd6c4d1f4581ed5828e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 40.1MB
        • SHA256 2b5a798c998dec898595aa4be7e79a8bc1504a4e55279447ac98a99b03188c32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 27.0MB
        • SHA256 d5a86d104946c3bb35dd58c97d4dd6e15efcef89546cbd54d6aa221de17f4faa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 16.3MB
        • SHA256 258a8ce8ac3172be204e477c855e56054c228ead1b6dfaa3fdfad4410ce82418
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 16.6MB
        • SHA256 dcc0386567b1cb76257b31bf1741e88314b793da1174d2ecffd5fbc7e4ae7a74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 15.0MB
        • SHA256 801f96e2d5cfa6202ee84e614d1a9afeff7562d12b52e2de8af238b2d50d9afe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 40.2MB
        • SHA256 21a75da3863cc900d0dd8ec96b23399c88f30a04b64c9737844118a84e0575fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 40.1MB
        • SHA256 0e5bc2507b4414e8b4f25af9b66137d5d9a61216a959ea549d64ec36cc52b394
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 40.1MB
        • SHA256 083e3b565de4492de20817e99f89fbc1823e45b21853e40276de9309f04e54f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 20.0MB
        • SHA256 2ba8a23add8b4e4dd579dedc5019403665df5d6b9e3252ea16a71e7ce574ae81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download