Overview

overview

8

Static

static

3

2026-08-15...r_.exe

windows10-2004-x64

8

2026-08-15...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    35s
  • max time network
    113s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    15/08/2026, 03:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-15_7400aaf10d5941f6598aaa8642945d3b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 38.4MB
  • Sample260815-d8sq3ayaph
  • SHA256 e0c0cc122e0d1264ef4e658f478662fc0e7b66f4dccfd9a5766bd6f818807ac9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-15_7400aaf10d5941f6598aaa8642945d3b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-15_7400aaf10d5941f6598aaa8642945d3b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4892
  • C:\Users\Admin\AppData\Local\Temp\2026-08-15_7400aaf10d5941f6598aaa8642945d3b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-15_7400aaf10d5941f6598aaa8642945d3b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5384

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 38.4MB
        • SHA256 e0c0cc122e0d1264ef4e658f478662fc0e7b66f4dccfd9a5766bd6f818807ac9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 76.9MB
        • SHA256 8488dc4380ccd6e77f7d7856f8174fe9daef9793a3c611442aedbd40c0e3cac6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 75.7MB
        • SHA256 14207dccfd5c4e3fc6a70441c58b765275e259d27a8b8700af34a8b9dac1d16b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 74.1MB
        • SHA256 1e38e50f3e22664bab82b5a6ab797f269a1f52a145b5508bebbff4b8c53b34e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 72.2MB
        • SHA256 cd3122eefbb62d96ac98351f8acbe7435d337f67ba701c21faef91f4dea3b0fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 71.7MB
        • SHA256 ae8c3523469c1d5c7282aad1055f1a03a47798e4cbc28d8ea61103c90664a44b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 76.4MB
        • SHA256 638da0846c0e1460d737dca79b7bbbb2d7f711d8d1a527b8393bcc81b332160e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 68.9MB
        • SHA256 5e7edc3f59fb62062eba8ac43bf6560b1c087f9e33f15d0ec8c1e5a157a1641e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 59.9MB
        • SHA256 8314f497dc744d64e73d6ec7b1883cbf32ff0adca3653d39f866d3bd9226dd81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 59.5MB
        • SHA256 7ba8fc28661599003c1e4ef042e6fd2fec1045fcd5650cb8c07016888ac1ef50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 62.6MB
        • SHA256 c92778731a8d479f2be88849a575c3eb05091bcb1e5ed65ee6ef439473f0df4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 61.2MB
        • SHA256 5b5df848247bafe35a8d3bd9e40511f804c8ef02bbf1e006c51b42e44a8521f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 62.1MB
        • SHA256 6b82ba4fbb81b3655f035ba786dd6a62c0c44885051a71a485613316ebdbab8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 58.3MB
        • SHA256 f1562f82430e2d8efa81d642259b9446275d61e89026551c1b41e79d9a59cd7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 56.2MB
        • SHA256 00c5005f00a79f7c80981ed08a520f7844669f6ed8f00ad19ac9af1de5755f86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 54.8MB
        • SHA256 49e8736765654189603f4a6b1d8becbfe156dadcb2688382b0c0f4f490e49b89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 54.1MB
        • SHA256 15f7ef604188072dc99ee2c362ca4644b938f5dde829d0f970f0f4397b65bc5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 52.5MB
        • SHA256 26063c55329d2053d58b12e2e8ed555c700f5c22f6bfee7c5d729224d9786919
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 51.9MB
        • SHA256 0dc3d595fd25a9b0b74fd4e817b62999f973608f0b5ac477e283272c336c98f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 51.4MB
        • SHA256 df99ca3dc8849ee54e231945abf24a2a64e2b69b16d241110a90d8a6d84954cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 50.1MB
        • SHA256 6ab2c472012045c2e2db153b978253a8e919bc2ded0f03effbcc811d1e3c2e9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 47.9MB
        • SHA256 64fe6ee74f2f959edb313993dd4db399d945e1584c953da5323865d92167f449
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 47.5MB
        • SHA256 d7f67e8c0bbd03265733e94a788441a6a450c1f5aad8ed7ec05aad1ef0f5cd94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 47.1MB
        • SHA256 26f17db2ca65b4bfa02f22da000a52c66193adc9129f117211da7baa03eb627a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 46.1MB
        • SHA256 0cabfc049778302f05300e469a0e80c5ba097fe7f298bc255af50616a5dc1c80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 45.8MB
        • SHA256 9167ca6816c2ca69bc8b2402749f13afaf41ef68d425688d2f482558e60582b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 45.2MB
        • SHA256 88044671b4d4bca7f5ef7c18b881e31ee2acdf93d6d49d5e72a16c2d61ddec8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 44.2MB
        • SHA256 3e27beafb200e469011a9883cb2d321a0675fd53573e82192d9510611add00c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 40.2MB
        • SHA256 02dc2844f01d09ab9c3279519a4c03ae7438e5711da60840b88c3f8f69c73cb1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 39.7MB
        • SHA256 0b2b5de475aecf36188035b8ced0befa3d3ae0bff14572156bf6160dae272064
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 38.9MB
        • SHA256 45d5ae78c6bb8c47174d56230336e7de20fc3baa6e1069f5258f058b4dfee42e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 38.0MB
        • SHA256 dd6b5395cc84d7075481feb7aa3d2a846df7993517fc36dbe71af0db10b5d3b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 66.7MB
        • SHA256 80be2ff8892e97a876791fe7543b64660396659debe051006dfa82594a6b8599
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 65.8MB
        • SHA256 ee5f405d812a74c576a24fbb01ade2356fd10f030282afa0d27096a7f9f9a1a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 65.6MB
        • SHA256 2d196aba95dcbec6bf9d954ff327da991361b5cecd9668b62d1da7bb8d672787
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 64.1MB
        • SHA256 f60a8bca9b0bfe636bb983788c465ebae7eca95c6eaa6021e069198e2b046d73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download