Overview

overview

8

Static

static

3

2026-08-13...r_.exe

windows10-2004-x64

8

2026-08-13...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    26s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/08/2026, 10:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-13_2320d13734db123aed7ecb2fe345bfbd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 21.1MB
  • Sample260813-mbemlsxcle
  • SHA256 47090a8a6fdf0d7fbb8cbce305b80f44961c0d45d9f261c192ad4466a79519da
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_2320d13734db123aed7ecb2fe345bfbd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_2320d13734db123aed7ecb2fe345bfbd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4720
  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_2320d13734db123aed7ecb2fe345bfbd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-13_2320d13734db123aed7ecb2fe345bfbd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4788

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 21.6MB
        • SHA256 d5a75ef6b124f8af8b6ad14f0517e35ce3c192cb0c91e308eda8127f9bdfa1dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 21.1MB
        • SHA256 47090a8a6fdf0d7fbb8cbce305b80f44961c0d45d9f261c192ad4466a79519da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 42.8MB
        • SHA256 f5879d4bc0882ab45ce1c43b2a0b453139611ac308d521026ea1f830cdc99eef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 42.2MB
        • SHA256 ff4e692d2d322396bd0af54272b9727920f8430117a41cd714bd9a9b5c16db65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 46.3MB
        • SHA256 3e2c5561a42369822762aa4c16fc0622868215f2f7fcc73327d5d7f5383e859d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 44.6MB
        • SHA256 5ddacb30f2fe054e77fa6a318d44de9944d0666ff95381797f5a453c9ee884c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 44.3MB
        • SHA256 a71684747c1cfd2b917148d280efe2a65df12f9f1b26a29ff5dc08c29937aedd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 42.3MB
        • SHA256 4f314a104f9a0f265338fb3a382eb040b3b312a70f0f86664095156b14ae659a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 48.2MB
        • SHA256 faff135f6dc21b15f26f006c686eecfeacbb30de94769360b43862ec7ca767a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 43.9MB
        • SHA256 afa80594c10529e1c4647d4dc52517fa51b4dcb85b2cae50146b45d073908d6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 43.9MB
        • SHA256 3999c32b420fedd43928bbf21f1eaa2dd25d25575531bad33c72cb9dd6300ca7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 45.6MB
        • SHA256 e195c284aad92fc750a6f0051250c3b01b6261dc08c842a9a3063cc0e75cfef7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 44.4MB
        • SHA256 1336b285d6377be697035704c4e3a0b34a12bf6d082b7a561e850488dc220db9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 44.0MB
        • SHA256 3b39f556ad18a0c63a5c2cf449d182d1dfe7f9f2212b0ed62b02eb8176d2d725
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 45.2MB
        • SHA256 5320e01a23d45c0f600e7543367fe2920ebb757d62cb140a376fe81e18d54ebf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 42.2MB
        • SHA256 424aee695349f55f82c1a690750daaa629a8c98e4c56f1035d2fdd8ff54df0e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 42.2MB
        • SHA256 679bbd283fd4592c080094a58ca24da76fbbaa911e8c4330fff6a72e89310fa9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 42.2MB
        • SHA256 9d9f8795c89cfa3fcc53897a603786840f6ffc90115034681412cce70e0bb964
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 38.6MB
        • SHA256 d00af1ed2b32e5db75437e1d6509ca63aa5df051a3e846f2bb73c5a99035931f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 38.7MB
        • SHA256 f649c9810a363f161890244c67c973597645b959489c4091cbdc5cc5ee460561
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 38.2MB
        • SHA256 7b256c84c412c875136698f590e58d7d05cf9d87c17fec7425bd872f824d1a2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 39.1MB
        • SHA256 17b5e0240db815371ab9074cb601d9bd6653d4f1585aaed006501f60fde6a00f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 41.9MB
        • SHA256 bddc4ca7fcee29e3ed167a88a6e016d7363ca98ed1a6326c3cf3f12e443b5f76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 41.9MB
        • SHA256 55d0eac73023a88b85158321e47811e68e723058dc37bf618a4ef2aaf56940bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 41.8MB
        • SHA256 7ac5a2b632f4bf45f225f3d948aaf2c0a3d06aa6eca79621f7b6811d7515cb69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 41.6MB
        • SHA256 b3bcc7f589480d4ba64acef8d57f7eb1103303c9e26147dd84e02663e6bdde07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 41.4MB
        • SHA256 7575b5ef6047c95bd15c6bd76923d289cd6eabcf8978b94c33dcdd4e17399aff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 37.4MB
        • SHA256 d71d9d79e3a61698b644cbc1b3d2e526fbec0ff88f9244f941f229ea9d5bac3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 41.2MB
        • SHA256 072ba367dd3ebd23b7889182d7e3f7ea5e3668da5c1af93e73d8b060c2e153f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 40.6MB
        • SHA256 e50b65f61bd6406e62f6dea28e4ede62bfcfdbfd240393c383679d3220ba831d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 40.1MB
        • SHA256 8c8bd39a676dc794abd02e8bb40286dda811356823f07aca3484a8bd6a28d43f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 40.6MB
        • SHA256 060b8734807f2692f55e038cc9e233d1dd151841e5b8ed368ab2ad5766e1cd58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 39.9MB
        • SHA256 b2b362dbc3ccd7d82fdd67b12a0ae4e591bdb776a9e440446be257d9a6cb49f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 39.8MB
        • SHA256 92a121f606837c3026b13311d580a15b5f267daea40d55fe8c30763a6fbf2216
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 35.6MB
        • SHA256 e7d4e9ebdad0463ac3efaa9248604d7a1a6ccfc5cb92046ef6feedbc1d64e3e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 39.7MB
        • SHA256 e38cde1011fd951a2fc87a13e98c970696e6ac420205df80be62c466fe8b04b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 35.9MB
        • SHA256 792bee78e6ab8993feafa638501aab38b8bae6878f59ee444226e71f744b3c6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 39.4MB
        • SHA256 5f19f508b3454496fbff1a51fa42dbcf843ec36385484f4a398452079484c196
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 39.3MB
        • SHA256 5e99990793e78a4e3230cc0d5b4d44eb525a3e104514b39c6cbc2f1f643cc9fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 39.3MB
        • SHA256 7699a2625cfa9e01d0b38b87c4a7b3b20c107a607662d42c61223945f73ac4c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 39.2MB
        • SHA256 196f121236e11459b41a6629a25d1edb81de87b96fb7afdac4d69d8617fa2275
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 39.2MB
        • SHA256 9cd7c59f296fe1f620622ba8e21fac037fb61dfeeda3339c0bfd58704d41f48a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 38.9MB
        • SHA256 46d4d8ad2cc8ebe1481dc12ec7e416f7a5014750e2ad25acdcf71f575c287fa5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 39.0MB
        • SHA256 0eb7743f082f1b36f88667de47f26bb96bbb56d640d1aae3e09b287b83b920f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 34.4MB
        • SHA256 728900e204794ac276b1f2d42c14f85f2a3632c52a824d0556cda74a09b7c866
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 38.3MB
        • SHA256 6e9f50c62a875f59d751ca15c96d8088135bab2ea1f6e4518e8c224b7d9ab074
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 42.3MB
        • SHA256 678ddc3a5fda983e290bb4a5468703151c11dd1c5327076983faf05c8dabf74c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 42.2MB
        • SHA256 5f0e8f63253ec1514bd38d0e79f7e39f05367adfb1873730d552fb8896a645d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download