Overview

overview

8

Static

static

3

2026-08-15...r_.exe

windows10-2004-x64

8

2026-08-15...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    145s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    15/08/2026, 23:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-15_e8a0a7039a8e6e51a2a717779d8a96b6_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 31.2MB
  • Sample260815-3sraqshr3y
  • SHA256 1d16dc77c0276f65dbb8de598b5b1cfa8bd6141f2496c2a4bdd4ca2e25e64552
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-15_e8a0a7039a8e6e51a2a717779d8a96b6_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-15_e8a0a7039a8e6e51a2a717779d8a96b6_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2544
  • C:\Users\Admin\AppData\Local\Temp\2026-08-15_e8a0a7039a8e6e51a2a717779d8a96b6_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-15_e8a0a7039a8e6e51a2a717779d8a96b6_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2088

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 31.8MB
        • SHA256 8d108786c99a4a9fd0093a02614182fa5a568cd4c3e7699677c86b6c27c4c57d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 54.6MB
        • SHA256 5d36c0ea3482b1bc066b94ac491415a288be17b29105d0d4e6fc48982c13bb57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 37.2MB
        • SHA256 35c8cd2247edae8f99a9939a3e5801ac216fa1c1f03d7b730cd6342ff7da3c6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 34.6MB
        • SHA256 e741960badd238d1944b28ec6b1381ab7991481d6d0cff9c1606849d1fb60602
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 65.4MB
        • SHA256 a86ac42b8fc238c9d2f0b9ef344cd23218c345b302b9d29e138cd156f04584b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 63.8MB
        • SHA256 96bcf5994dcc0090e9763e3a5d290f10a4daf0159da1566c09fe5c71e9563122
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 62.4MB
        • SHA256 c2b02997ae12f19d032813149bb4556810bc82afb8ae33ae3e7d23fc1523e1ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 62.4MB
        • SHA256 2a3c015d33ef4be669a19978ed40488a6d0762d2d5dff1f28dc361e983694660
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 62.4MB
        • SHA256 3f3273a0dbb9fc926151f5ce3f59928702997f34b6ce89c93b15825b4644b6d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 62.4MB
        • SHA256 6a2195dc55a7a782846b13435a5d483dbc5b4a2385f23544140a35de62a5c13e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 62.4MB
        • SHA256 d150bd921e8f69370110266389d080f70d9ee76b0083af3f503ab31cb110730f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 62.4MB
        • SHA256 26f0f7d41eb0d20972502da3a19363f320de96fec2059941df22751904adae4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 62.6MB
        • SHA256 1886bf80df878cc66fa2f294bd079dbffefd9d2c783a8f81a4176b0ca8c2b97a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 62.4MB
        • SHA256 6b00ed46dc846ab79a00c8da549e788aee8dd5d7d7859310fafaeb28a80d8dca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 62.5MB
        • SHA256 4fada9e0b38d406650d3c4eae4c64a1751579ff9748cd8ed84f76a20c7616ab7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 62.4MB
        • SHA256 16d0f1f0a886557be5bcb9b8aa64e588abb4a3cdc3d2adf7c898f2cd83dffe2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 62.4MB
        • SHA256 954ed3851bcece509848a13214edf314c471c688fce1b322af8bf3f03c03c5a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 62.5MB
        • SHA256 702af1047312363442a2d9d771f701373c578939cc184c6fe013e7ee2dbe0790
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 62.6MB
        • SHA256 1fe3986773ddb823dd85098962096281d4d39172c217f2f9942292b93aad7607
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 62.8MB
        • SHA256 c54ae039c9d652ab9145a13a54768c3f692f2af87a51557934e00b7d912906b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 62.4MB
        • SHA256 373af66b3d345d7b01ef73dbe1c80f18fddfc93e49c3b197a71a885f76525f9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 62.4MB
        • SHA256 aad94db08e48ab1b3c5878201b98a62282ef5903cb16dd9f54faaf7b7cc5d902
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 62.4MB
        • SHA256 8247ee652aadfbaec2bf850370bc6190e65de0967cba78f46fb56ac81e7177eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 62.4MB
        • SHA256 04f49f309e0eaeac97713bff6a225515de73c9b359ffbb46f8f3019851931aae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 31.2MB
        • SHA256 7fb421618551a4ec2d3dfcabd1bf2cfb0089324c174f30bd50dd80ea28231aa5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 62.4MB
        • SHA256 cc4f59389785ca0d4be714c73514db8b70cfef9c06aa37da15b293996da17ee0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 62.4MB
        • SHA256 40c3724a70fe73868d5d5ea36b059d6d7412eae1b984250d9b8054480efccc98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 62.4MB
        • SHA256 88fd1dae83c98e19df5529e73f291c7f6aec21d5bd4b83076ddf1b10d8240ac0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 61.6MB
        • SHA256 dd17eba15f6140e799a20cced7c4e2fc45daf956d38a4ef67b3dd17605ce00bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 58.9MB
        • SHA256 3afdbc90e978eebf932cdc888a222cbb4d4092827f6973d8b730db0cfb212f25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 54.4MB
        • SHA256 579eeec02068df70f2552de0c61ac4969d043c60cc77b86935d00418c7b9fdf6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 31.2MB
        • SHA256 18afafd0b8b829e024f594b3772a41ee5dd76c396826f338b0b07409c8982cd6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 31.2MB
        • SHA256 1d16dc77c0276f65dbb8de598b5b1cfa8bd6141f2496c2a4bdd4ca2e25e64552
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2088-6-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2088-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2544-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2544-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download