Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/08/2026, 00:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe
- Size 4.6MB
- Sample260821-a48d6stsdx
- SHA256 d89f0f79d14d27406bed831863c904d4a5554ed94d1012a4ea67bba6f9de0046
- MD5 22b14ffc1c9c2bcab2329087a55bccdb
- SHA1 90a4fb69f1fc47e1b00c95fbb1730f31ed746c3e
- SHA512 cad0186002d170448bfe73f3fa22d603b67a3e2a01c1a5d189cfb66a4eeaf60c41668787fed8c7260c2da7c63cd55d903da30ae115eaca31e6dd355082e2bc90
- SSDEEP 49152:P/aUh2YQT/aUh2YQPzXq5L9uiibpJKQqCbRquA/m2yL5zbfFiV+XenmE3/zD:PN2hN2PiifFoq2Vjnm4
- TLSH T15C367C01F6A48064E5FB82B4C7AA965AF23B78500B7496DF42D4C6BE1F33AE06D75313
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3604 2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_22b14ffc1c9c2bcab2329087a55bccdb_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3604
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 6.8MB
- SHA256 6edf7ab66daca9e0ac8a6b81108041e231b9fdbf0e0379f75fbdf6d59d37d2b8
- MD5 3f7e3f1cc0c95f5c4953b476c35ff251
- SHA1 59cc1835c6c708a4bf0b7cae370eb000a714d7f9
- SHA512 316dee0100404c77f3de960e6d1a0dd0072d9035290d045848a6b5f62f3d497fc80b12507b21800cef221277c2010079ad04dfdd14dcf66ecc2ae397671f587a
- SSDEEP 49152:P/aUh2YQT/aUh2YQPzXq5L9uiibpJKQqCbRquA/m2yL5zbfFiV+XenmE3/zqCbRO:PN2hN2PiifFoq2Vjnm0oq2VjnmA
- TLSH T165667D05F6A481A4E1FBC278C7A68656F33678104B7096EF42D5866E1F33BE05D7A323
- MD5 SHA1 SHA512 SSDEEP TLSH