Overview

overview

8

Static

static

3

2026-08-16...r_.exe

windows10-2004-x64

8

2026-08-16...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    46s
  • max time network
    155s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/08/2026, 12:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-16_d4f7d95150b117be83d3285145627815_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 42.0MB
  • Sample260816-p298babl4x
  • SHA256 a464ff5cd93c2707109206bf50aced8c227502a041056c39ecf10688aeb1dd09
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_d4f7d95150b117be83d3285145627815_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-16_d4f7d95150b117be83d3285145627815_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1860
  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_d4f7d95150b117be83d3285145627815_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-16_d4f7d95150b117be83d3285145627815_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2156

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 42.3MB
        • SHA256 42cf965bdf05a66ec0a407fc6d02fd1b72165fcfaaf9ddfab1f6d1bcfb87d249
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 81.4MB
        • SHA256 4db3ecba1684ee5c5446c9f2fa325ad8a066d3b0e0f4a6fa2ce4cfbaaf36be0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 80.1MB
        • SHA256 afe9fd57976aaf137794b268ba11d365961dca7e616fbbfadfaa3ea404893e6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 74.1MB
        • SHA256 71812cca1e60a029da828ac6c68c3821d9ad5541e5cef59047545f4609bdd261
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 44.1MB
        • SHA256 bc7026801f3a6fec9e68b1f39255ae1c9e1f5ee597bfe5b40ab718b6d6e531a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 67.4MB
        • SHA256 10fee1f3d95982ae858807760eb92d5cf5f2a8099bca1070b43d2f7624d986d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 57.9MB
        • SHA256 09851eac93abfae410604333df5538d5627fa0af50d3fe996c302919d38ef09b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 57.4MB
        • SHA256 ada816711429be5267c98cc2b2707129267a6154887592a5b4bd14e9abba210d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 60.1MB
        • SHA256 b49f9b2e1aaef64478b0000b1e396925fd066733dee9d6fabab72203a03d1120
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 59.4MB
        • SHA256 7ca20f0faa3192e70e8afc0e2a720afcad4609a4d23f4c5cbe8da980bce81f7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 56.2MB
        • SHA256 c735bc6de7ddb7938519ca6a0e4584ec19c99708ccdf7bbafbe7ce914ff82b2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 54.7MB
        • SHA256 4176f50967785857af89f3c4f165750e45641d79bfc16c40ce05bad91df62634
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 53.6MB
        • SHA256 b7a7fa102862d61c51d70ac81969a92f7a3d00c38b780586edf1d5a3d1cb2a69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 51.8MB
        • SHA256 19d6911739b68ad5da58837e22da285f6e6445b581ba396ebec2c4e23be32e30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 51.0MB
        • SHA256 b3724d3ead1a6fa4d4d814d33f92ea99f561315ca136f86def8ce458dadb57a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 50.1MB
        • SHA256 c525d5344e179f8b141678fd25e3416cbe4532681f79c5f9606084fd688a8f83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 48.9MB
        • SHA256 d773c8bcbc03d4a7f8d6760025389b765f48dbd394c5a84bbf8b2dbd2a9316a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 47.8MB
        • SHA256 3ef04ffc750eef723e1b615d7e709ea0720a0442f367ae738ba0cdb927bb82a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 47.6MB
        • SHA256 7ecd880884ef3000e3c71148863b217d2da7a5be7ee90073246955b70d66c68f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 47.4MB
        • SHA256 c4524c901c81550322eef14e618077bb7e3778acdfd78be70d51d1b8d44ac698
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 46.9MB
        • SHA256 c19295bec31177217f6c12041c88b02dfa12be70a059166839c4be89dc8ac3f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 44.3MB
        • SHA256 e83dfad6eef1ab16198c005f848edfe0e388ea81760c0de7bf85bdd5550c3e04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 43.4MB
        • SHA256 b924790139af94e17cca06a1b7ced33b1c0b7d4b3a26ae5cf00ca010a1dbe074
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 42.4MB
        • SHA256 28d7ba8a86b65df39a6639d473103bcb04eb8afc32560025950754bd72ae08e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 42.2MB
        • SHA256 668ef14ac065c1d94315ccc4a27b6a3bd38e6392198ecd70999921a164f78b40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 41.0MB
        • SHA256 68bdbf8252b10ce90fb3bed48fcde729cf2679ad2e82dda3210634eb922bc4f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 40.4MB
        • SHA256 8394c21731717a80b201f80e0582f9be2f44141a65f55f1ff5fa95b619cc3931
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 39.6MB
        • SHA256 91d6805336d1e4102b23a6e859416dcf40b91eb107f95d8003d708b89c36c222
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 38.1MB
        • SHA256 acc31d5b5e1ace3bae0d85bfddf0bea049732e5bbfc0cec9ec167aa914af1487
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 34.7MB
        • SHA256 38d7cd23175c8bb07df3780b6fcab243467af41f39e3c5c60660c1dd02714f4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 33.8MB
        • SHA256 765a5beb933946071bf2b74c21bbdb8d3d31cc038517fb51dad91a9af09689a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 33.1MB
        • SHA256 42d9b991d211f5cfcd3be00236f62138a22b839458c69c889c7aa1ceb6f6dbd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 32.5MB
        • SHA256 bbb71b148b3b16b1bb5ac2d2f620a0434dc318b75c8ed0da224d5bae3de62ce0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 30.9MB
        • SHA256 a033bc049aba71e1d667b8bc1ca44e31b3d35750e217534de15790745acba08a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 29.7MB
        • SHA256 45c2bfe71af166ad7e4be1b6e0ac90e654f7fad53c2cc6ec6363de05423c6684
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 29.2MB
        • SHA256 2f1c4f2b1197b62690a8a6f3c25f6dfe160e0f7ef3fa1954b40fd2c2e316372a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 28.5MB
        • SHA256 1e6b6b588f690152f6403af77f6ba8c7e24e64781a40366dc5d3a5bf7dc6bd65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 28.1MB
        • SHA256 4680154ee1cc1ade27451728ea954dce142882a25195a28d5bbffc5f04ef7d65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 27.8MB
        • SHA256 e900ba0a8ce09cc2e5a023bc1e133be796eb95709a8401807768c959800865e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 27.2MB
        • SHA256 7536904ecfa9a2332677bddb20b332be9472b93e716d0a92ce06ccaf48924ba6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 65.2MB
        • SHA256 f36ff9fdfa9017dec931942fc30d125674a83e0b4daf2de26d15d777008ff913
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 64.8MB
        • SHA256 3bc25f8b5046ce72866787df5c0031621faba74ffae91f96de69d19468115a6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 63.2MB
        • SHA256 01dc01db2de9f8f42d7f16eeb27108c65fd20aeb204fbc1934bdfa7d3d66ec5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 61.4MB
        • SHA256 d1b27c50e800d426c0f39847e047be00bb56e972c903932be711f7f66cc474a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1860-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/1860-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2156-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download