Analysis

  • max time kernel
    150s
  • max time network
    131s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    18/08/2026, 23:13

General

  • Target
    2026-08-18_a746580e12574b919ff959a5df022d69_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 7.1MB
  • Sample260818-27ls5atzct
  • SHA256 d6405bf2c2586958970da689e4523dd48992a594678873f5f424878d1480bcf2
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Control Panel 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-18_a746580e12574b919ff959a5df022d69_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-18_a746580e12574b919ff959a5df022d69_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4464
  • C:\Users\Admin\AppData\Local\Temp\2026-08-18_a746580e12574b919ff959a5df022d69_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-18_a746580e12574b919ff959a5df022d69_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4276

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 14.5MB
        • SHA256 e08004cc2ea9314fe9756a06990f80b689c71d5051a490f114e2c5a12047add8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InspectorOfficeGadget.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 7.2MB
        • SHA256 765e4261e14807f6f903279e6ae3f6ae8e8afe12d394c470a59942f9a01f1592
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IntegratedOffice.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 18.4MB
        • SHA256 a6e0243b44a8e386032424654eb9d25a32cd9928f1717a78ffa96d89cfade1d9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MavInject32.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 14.6MB
        • SHA256 8bd5ae25c4807409ab3250ebab2eafc6ad9e068efa16427d26d823fed3d40212
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appvcleaner.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 9.3MB
        • SHA256 fd6c02a3ef7d0f46a001a95d4433e1a3bab7ac627f64ca7d60a5739600784965
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VSTOInstaller.exe

        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 14.4MB
        • SHA256 42bd16802792587d186d14468b2d4ecce15126748866e8ab38ee6b88319a2cf3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrmstp.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 20.3MB
        • SHA256 e377165c711229bbbbc41d5c58490c91a37a87d957c19015c39fb774fca874ad
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_pwa_launcher.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 16.0MB
        • SHA256 f4d37c557aa8faa7fd6b28dce6b8826597e648679c33f6cb07445a2cec1ccbf7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevated_tracing_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 17.7MB
        • SHA256 fe1f2f4caf1893e62ed6d2d581010cc0dc60cdd2ede848a633000bdad9882130
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevation_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 16.5MB
        • SHA256 53055758fc250f9b88a424553ba9cb1b4aabe88a870cc48b4003cd5fd05ee47c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notification_helper.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 15.9MB
        • SHA256 020af06cd3dc12aeb6a0ae7cc54fe6f57b619d7df184c54fe74a4c0be2101c28
        • MD5 SHA1 SHA512 SSDEEP TLSH

        os_update_handler.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 16.1MB
        • SHA256 c8d2c90937278a86fab59b3b9cef4a55d9e2638d0a416a79144b6d8295c2c7ff
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 17.3MB
        • SHA256 7a04ee0c1963e9ef9ce0aebae71906c1b03f1492966afce976111e61570c9a88
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_proxy.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 15.7MB
        • SHA256 f3a862dd4cab7007f194b3d5e96428a260733f9ac42c39ef9bf6bfcaf5390507
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appletviewer.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 14.3MB
        • SHA256 1d54827d89b827301cba678208a454c83dc7e3250031dfa2f2dc54a9b95ccaea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        extcheck.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 14.3MB
        • SHA256 e4a2453f2db9e8b01b2751afc05fc8f58c660f97494f6628f9914cf6025cbd25
        • MD5 SHA1 SHA512 SSDEEP TLSH

        idlj.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 14.3MB
        • SHA256 c000295a96c37a0151348850eb121345c911d11c1cdbff7a9f060f2e6b076b12
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jabswitch.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 14.3MB
        • SHA256 2ae240886d18a4b67d36c7fb6ca8282b222dc55ad21891f1213b9a4eee2d1b45
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jar.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 14.3MB
        • SHA256 edf6c703d9b1b37393f4b93f8eed790bccd96b8903a36c372249d5abd0fcf061
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jarsigner.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 14.3MB
        • SHA256 55571f31b346cf915ff20d88107fb271b30b2f2e25066c871023458781c5bd94
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java-rmi.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 14.3MB
        • SHA256 75fa5c2159de639b27702b0f4acda7ff6873ca9693448f77cc16bd31abc31f63
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 14.5MB
        • SHA256 43d419709a5f48a0454a7b968e424d038249edc517bf88fa2a67ee14900e99bc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javac.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 14.3MB
        • SHA256 b9a60dbf819a1ddd997b43fa706a60f6e74d36fd417bdd77e8fe28c1645f710b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javadoc.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 14.3MB
        • SHA256 90a2745c9fee3ea32bc7f4d1a2cae423bb4a71168809316348d4acb40945356c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javafxpackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 14.4MB
        • SHA256 21d0bf698a8e62429a4497aeb503df1851f8be5df62e7c8a1f42aa5e5a9681ab
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javah.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 14.3MB
        • SHA256 84a0ae9e9d1bd85195592636b59ec042572b12d54c5afdca0486fcbef76ef271
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 14.3MB
        • SHA256 3a218eb877c9fa00722c2f887a0e7a803334bd5a088d279220f055c22e647034
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javapackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 14.4MB
        • SHA256 6c2b958bd4a7a0edc56c69d43b4ddc1d3fcad252df231bcf69ad49b632503d91
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaw.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 14.5MB
        • SHA256 79cb28a53dbc5c6ccff741137e6812d55ecb42afa233ce22fb912a4f53eb5fdf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaws.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 14.7MB
        • SHA256 27f56c27439af4ed270853dccb014e857c941a867dc85f1ebf528335c82cc4d9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jcmd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 14.3MB
        • SHA256 bcb038a94399e3f5a95b2196eae9dcb7811c796a490d4aa58e17efea24bb2b7e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jconsole.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 14.3MB
        • SHA256 4c96dca81bffad1b5af9ca9e29d406b8f76eef5819bf9ccabfad925b19dac22b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdb.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 14.3MB
        • SHA256 1d49cce0678da8ab3644d80b72684458f6bac68789d095ffcc9dc929a196db7e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdeps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 14.3MB
        • SHA256 9940b72bb704e0ae3f7330abf372fdae0d86e0b0cee8183813c5f165a4034960
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jhat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 14.3MB
        • SHA256 92feed55d9da44c840cc38a1ef99d622049e9c49a85e15ee87ff0f33c1aa848f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jinfo.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 14.3MB
        • SHA256 deb3d51ed6198355bd9f9e0daea1e00efac8e754c8ce76fbe052c3b831e3b728
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jjs.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 14.3MB
        • SHA256 25746fdb864206c1be6b643be76856e5c1106699404d38ec6ed9ad4abad2d7f4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jmap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 14.3MB
        • SHA256 4efe05e61a499d8f50ef8269551534bd75a3063443cf0ed410d2c2f17d40cb7d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 14.3MB
        • SHA256 c0def01b6e637bf3b7cf08a3ad6f78debca06be75ddee0f73d66f8f4dcbd55b0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jrunscript.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 14.3MB
        • SHA256 a23032336540a34c6d88c4f09bea1110cf4e31935f375e8ee979e9300b8b230b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jsadebugd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 14.3MB
        • SHA256 10273398e4344c6e736a44e3df938385b415eef4b9e0ea6d1c7acc970ffdd6f1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstack.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 14.3MB
        • SHA256 ef1f8ebf7b524df56fbc47d248aedbe0c57ac931b11d5c6222256642666baedb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 14.3MB
        • SHA256 41974e625d65e76fbfd284babab8898098a02023dbf33e25885574582553c46f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstatd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 14.3MB
        • SHA256 e6d631d64947b434977be17549d996c916d5f69c83957a8e7e52d6150621f908
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 14.3MB
        • SHA256 1d7aaadda580066a35e53a9361daf219072543d62bd4cc81eb8574b41a20bcc3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kinit.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 14.3MB
        • SHA256 89ea3504fd4675c62f660a0f1f6126f446fbc61700b959f6b47bc30351cfa3ec
        • MD5 SHA1 SHA512 SSDEEP TLSH

        klist.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 14.3MB
        • SHA256 05fe37cf504c3d25627b15d0132b023ea83abd59bf9907f3948a132e19aec8af
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ktab.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 14.3MB
        • SHA256 6a5199d239e9d2d9232db6060f5d04c1a6de37532e9a4a124da08c2d3f54516d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        native2ascii.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 14.3MB
        • SHA256 48a30cd06f281a35553e48c5e00e6b172cabc8924d8e3411ca7760ae3e619974
        • MD5 SHA1 SHA512 SSDEEP TLSH

        orbd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 14.3MB
        • SHA256 16624b406c6fac58670bd8d2f37cfd658a209bc7d7acfa3a41e33ca054616770
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pack200.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 14.3MB
        • SHA256 674c638b3573b9dc373bd89fdc49756e3bcd03001e66727e2b922c809fafab7c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        policytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 14.3MB
        • SHA256 5831e23beb8673460db170584d4b45b2937d62de88fa4803fb4a53af3d410f1e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmic.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 14.3MB
        • SHA256 9657ac72b61893250c6e3a4a6dfb054ab47371eb256810b61f7fdbe777d652a5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmid.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 14.3MB
        • SHA256 21e41bdd96ca07ef377c1f0f753b01afc4eefc9e014434463f22c906995c2b9c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmiregistry.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 14.3MB
        • SHA256 0c498b4f4cd706be8f0ebfe287932c2f6dd303c5ce98911895522028d515d4d4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        schemagen.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 14.3MB
        • SHA256 7b441f651451d015f3ccc4c3a43545a35dda8fc9a7331fb692864f4e7b3d8131
        • MD5 SHA1 SHA512 SSDEEP TLSH

        serialver.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 14.3MB
        • SHA256 89de9768856b51a83616ca4e5a3e2cb5c213580230612924135227fa0fdd89d2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        servertool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 14.3MB
        • SHA256 0ac77f00bca249e7f69ab11751780015c4039432d73cd4e3d802188acab50a13
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tnameserv.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 14.3MB
        • SHA256 7fcd4d317427cb72fce7cbec3eb98a9299919d33a171b8df22628ebbc06f3944
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dotnet.exe

        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 14.4MB
        • SHA256 ffd8dfe448c90bbdc3dffad47ab83a6cca19e2328536365f2ee3c53e34267846
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 14.3MB
        • SHA256 bedbd8fd4a37b35887245814a47ea9b30437f06a3198b13cacee3b7ea206ae08
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 14.3MB
        • SHA256 6e686a5d604cf7089d7c957e543c34404e102f05d8e7948bd9360dd968b27725
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 14.3MB
        • SHA256 376bc02fb3cddbc264e4a3573622cd5e10fb904e81945d88fdaab62c18aa1f8d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/4276-37-0x0000000000400000-0x00000000004E4000-memory.dmp

        memory/4464-16-0x0000000000400000-0x00000000004E4000-memory.dmp

        memory/4464-0-0x0000000000400000-0x00000000004E4000-memory.dmp