Overview

overview

8

Static

static

3

2026-08-15...r_.exe

windows10-2004-x64

8

2026-08-15...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    34s
  • max time network
    156s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    15/08/2026, 23:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-15_e8a0a7039a8e6e51a2a717779d8a96b6_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 31.2MB
  • Sample260815-3sraqshr3y
  • SHA256 1d16dc77c0276f65dbb8de598b5b1cfa8bd6141f2496c2a4bdd4ca2e25e64552
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-15_e8a0a7039a8e6e51a2a717779d8a96b6_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-15_e8a0a7039a8e6e51a2a717779d8a96b6_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4200
  • C:\Users\Admin\AppData\Local\Temp\2026-08-15_e8a0a7039a8e6e51a2a717779d8a96b6_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-15_e8a0a7039a8e6e51a2a717779d8a96b6_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4640

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 32.1MB
        • SHA256 55dd88fcc47e1ec2c4d934e943676f600025372d00fe6649511872fb3607a897
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 31.8MB
        • SHA256 8d108786c99a4a9fd0093a02614182fa5a568cd4c3e7699677c86b6c27c4c57d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 31.2MB
        • SHA256 1d16dc77c0276f65dbb8de598b5b1cfa8bd6141f2496c2a4bdd4ca2e25e64552
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 62.6MB
        • SHA256 5b9f4c8e591e28f60e8515142d3cd3df60b4595060513c59ec57aa7faa24b88f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 62.4MB
        • SHA256 4c0bb50e247b61883fa4d5a797fbc14e41889cbca1059d9bdef5b501973a6a3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 66.4MB
        • SHA256 e2b7f3826f8de29202cd2bc583df065d80fbf402a7d845d7d0287fa87d62c962
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 62.7MB
        • SHA256 90707fe1152e24c34ef7e276e8f7163deb314da7409020715d082e41b811b46d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 64.5MB
        • SHA256 d76a2f1b9392926fa501b7e5d4a7947f21461cfdf8c87f04326892d055cf12b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 62.4MB
        • SHA256 be9914a3671ae0511599fbfb604b4185dc5f3ede2746ee097934e64494d11335
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 68.4MB
        • SHA256 104e95a9076ad9d323223b8405305676add4cf405c1f2098ca0d33597690cdb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 65.8MB
        • SHA256 62c018f3ffc112d4e7180e64f67e07ec27b404ec174479f8136c52fa2f99ac77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 64.6MB
        • SHA256 0cd9904708581b73cfeb48f915c0ec8859ec29edddfa20c704b8189a5101e8f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 64.2MB
        • SHA256 3267072de683cc46a5101206ac842b7877c3cdac845b45168192a7aa5a1ba506
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 65.4MB
        • SHA256 a86ac42b8fc238c9d2f0b9ef344cd23218c345b302b9d29e138cd156f04584b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 63.8MB
        • SHA256 96bcf5994dcc0090e9763e3a5d290f10a4daf0159da1566c09fe5c71e9563122
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 62.4MB
        • SHA256 c2b02997ae12f19d032813149bb4556810bc82afb8ae33ae3e7d23fc1523e1ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 62.6MB
        • SHA256 1886bf80df878cc66fa2f294bd079dbffefd9d2c783a8f81a4176b0ca8c2b97a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 62.2MB
        • SHA256 b1ce968aa318daec1042b6c73e3cce7d0ebba3d338e17e2f56289c8e7a1fdda3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 62.5MB
        • SHA256 702af1047312363442a2d9d771f701373c578939cc184c6fe013e7ee2dbe0790
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 62.4MB
        • SHA256 46d947f20b236291579ad5d7d699df26c1a0db4cbe28ba73c436d3e6778573fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 60.8MB
        • SHA256 b72d48fc5a723bde9e5e078f58ce77287bcd890a06b73fabf7f3093920416304
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 59.5MB
        • SHA256 43b214b5ca8ab38c8b868d1793ff232164a297129e44b3e8e245a4a77b8ed92c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 57.9MB
        • SHA256 29217922e5e9213e6f17daf2b5964306f2532c1c464ab4c57036b3c174d01c42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 56.4MB
        • SHA256 f79e165edbda3cf5a3dd61b1509c6273b9f7c5598724b0a7b2d0f97bcb05cb89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 55.9MB
        • SHA256 b085f49060d99ae06290de010499c776820ecc27a5f5f37aa492edd591d04f7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 55.1MB
        • SHA256 0bfec2bfa2ffb883ac510dac802e01aba170b0b0739c46d8e69550e238fd3193
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 55.6MB
        • SHA256 6fa14d03ab738c41a4309fca9c36827ae6a485f73d89df5368336064dfc5535e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 56.3MB
        • SHA256 a163c73471a40d84b60a11d4aad15288e18cff0e23fdc0fded715ae4f48466aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 56.0MB
        • SHA256 09edd6464dd62fd0a4667995f1d38c07aead0adcc3de752317202109048cdaa9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 55.4MB
        • SHA256 97f7399894fede90e6fc0da3164f7afc9ef2e66837a3e11927e5f9dea596c5cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 55.8MB
        • SHA256 ae013dff1f4a91c533ea7047535e84c576d59fd407ce8dc71a534b2997e260f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 53.6MB
        • SHA256 17897d74910c5f5d693f90dd32281d007144379efd745643d1dc384a817a1214
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 53.8MB
        • SHA256 b5ed24055db4dd4e609c23521ea529e28a7d16da239ddbdd9da3bf6e27ce47ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 53.4MB
        • SHA256 6af19f710fbe5b2e4f187cb5c4d30ea0c1e2b5e58df976790dfb32c027b5a197
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 53.6MB
        • SHA256 dbef660306d61a712f55a86c524e1675f08c251a9e3ec5e1219da08df0af8286
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 53.1MB
        • SHA256 a600b66c8f1dd753f0b5aae522b93021cede9cbfb2d4a8f7a279c5fe0809ce5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 62.4MB
        • SHA256 68ba6f4fef819880856e75c349f75eb0dd16a38e83f7cfac66b36be43e9c15f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 62.4MB
        • SHA256 7ef5677fd627dd051ba306595e310745da617c019aefb819e2583c4e1eacfb8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4200-23-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4200-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4640-41-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download