Overview

overview

8

Static

static

3

2026-08-17...r_.exe

windows10-2004-x64

8

2026-08-17...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    55s
  • max time network
    134s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    17/08/2026, 01:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-17_9e2da25ab448cab496e336a4714989bb_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 34.5MB
  • Sample260817-ceernsdl3t
  • SHA256 a01222abdda3198b7af4ad545f06f2e1e8e64cedb76ae3814e99b4618d7e763c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-17_9e2da25ab448cab496e336a4714989bb_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9e2da25ab448cab496e336a4714989bb_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2500
  • C:\Users\Admin\AppData\Local\Temp\2026-08-17_9e2da25ab448cab496e336a4714989bb_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-17_9e2da25ab448cab496e336a4714989bb_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2324

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        BackupSave.htm
        • Path C:\Program Files\BackupSave.htm
        • Size 34.8MB
        • SHA256 9e13a8a6eb3049e25899c0f1ada0b8135df10e081a977f4855cf2de9ffa52614
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 69.3MB
        • SHA256 ad86c2cce9e5ffa53e75e0db012946112d05658ca4f9f201fbde7c51d40de06c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 69.0MB
        • SHA256 33d04b8c635e200e9afe02597c0247ed8223d1f32671b6a3e1b748d992ab7a80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 73.1MB
        • SHA256 91ee35e7340eb62c3481a82ed6f05099ddd67f2ed3ac7cf8432e1f2dec5f607e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 69.4MB
        • SHA256 1f97be67d1bc00719a0507ead729402f2530c6c5bff379f5d195cb4b732d7fe2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 36.6MB
        • SHA256 3f9bbd55eb0e8ae665ec41f9b4d0ed38436019e73dce06abe728f5a0d6cbed57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 69.1MB
        • SHA256 27b673f6f0c4fd6e0d40441b4effc42cc4c849cccc6d9399c7cf80deead4efbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 68.8MB
        • SHA256 6c8835d7d24f2ff80389a0a1354b647533f67763244fabf791f6a54eaa45f6c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 66.8MB
        • SHA256 1edb9d4f42a35805b4a6b8f3bcd4799ebfd46cb5cf6b1bac98a6321c78e5fe8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 2.1MB
        • SHA256 d26cda9fa56b27d0a29279e6f9a3ba69399a614f8b7b20639155876a2ff62daa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 70.8MB
        • SHA256 65d30a44132f9243dbc0d695ce7ce91a4c483ceeb97a03045d5356812b282b9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 68.9MB
        • SHA256 9eed8b0ec55b6468d595045ea4b7ad6d8648ccabff6c207fd8459740b611f5c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 67.4MB
        • SHA256 3b9083aa255ae2968a7343da63ace44e28b00aee253a03f68445ea55af98f0d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 66.9MB
        • SHA256 e84dee8be4a4c54e77921d993ef3a77acae85596d295b5815b9b13b0a0f9fa53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 64.6MB
        • SHA256 e983bc782f48264c79046f33310fe03315f62590fce196ec00d56e15baefa7e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 63.8MB
        • SHA256 10d98704a99a4256c90dde3c0da9c33863e0bf9ed8c147a2fbf4bbe44482f657
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 64.0MB
        • SHA256 3be4656cd82e112a504f9f5c0e1fa88d8590826fa4d1d85052e464e518654787
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 61.2MB
        • SHA256 8a86998d32eae54c1db38626f67f0e3e81289305070c80f74987d3cb2e92336f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 59.4MB
        • SHA256 c933832f114e07bd7c1d02bb2e0e3c09a8dcd595e68047699b03fbe3956a8e7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 53.6MB
        • SHA256 08df0477bb170162c589b5b1d7ee9a5e5434536fe988d1d6ce316aeeef455890
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 53.4MB
        • SHA256 7e4b56ba2768c8d52b3079cb4189f1f90880fd3cc8435d7c13b806627697cfeb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 52.4MB
        • SHA256 6720c29186fbe631bf7e2cb9ddf332788eb2ed48870f056730347a3dbe07a4a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 50.4MB
        • SHA256 a84e316ef75980c0532ef5c14b0f518a59c4c2c499b2e189df12fd4f8f69a44f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 48.8MB
        • SHA256 fe378c2a317007d89a0e1c769d8cc150ef94f351118fc537da6926a80c90f282
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 47.8MB
        • SHA256 618358a3f97563e7c5d931bcd004a79b11a94ba37558990e667e8bdc1ebf419e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 47.4MB
        • SHA256 f8a4451d6e3cbeb69efa09349c26ae1b1753f6459550ce7afa829b6e24cd3ab6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 46.7MB
        • SHA256 3c9817e08a19060b020a7487945254ed00c25438cf06a50cb64bcb5daf73ab4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 46.4MB
        • SHA256 0d89e97af1933dd2174d03b03c3de7fa25a2ad2c2bab5e3f8ae759c805271910
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 45.9MB
        • SHA256 e6a75f94d12fe3b35780d5f1be5fe5c1d4b6cdc688c79083a91ae5a14dde9e24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 45.6MB
        • SHA256 ed97bfaae3889219c83e77c60446e6c671a5faa267c7bb967e2ad428c7bb6e1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 44.6MB
        • SHA256 6e6f32ed147f7e424a4a7167d65db5be2b4f8162a242cc61e7db8b9164f795ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 44.1MB
        • SHA256 a942f0ec8ae9249f03745aeb7345acf2874edc0c41384a5ed56b6ba6a940e81a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 42.1MB
        • SHA256 87e208f7cd3492e897d8699914647ff4decf5fcff8591f555d4b5f77cf0ee26d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 39.8MB
        • SHA256 07bd0e4c5558efdc3f3e6aee9fc297ed8888849585a4afd175ff46d8453d700b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 69.1MB
        • SHA256 67e7421fc0b9968404990f52cbfc5ddee077ce167419aa42e8fb3458ab787937
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 69.1MB
        • SHA256 69f667a04302273433d677e00c9bc37182ebc21adc491fdae5120447d187cd12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 69.1MB
        • SHA256 37674f77691295f8ec07c5c32503cebd66423b69b45e6bc99b9444739cbf97e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 69.1MB
        • SHA256 f64bb889a649d5f0c621eb65add2f918e25f1ffd5f1e8e476d8f7dac65aba590
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2324-21-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2500-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2500-3-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download