Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    26/08/2026, 03:26

General

  • Target
    2026-08-25_ed405121436ca3712b661d589fcf4344_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 5.8MB
  • Sample260826-dzd7basakh
  • SHA256 ed2046d5d67a7405bd6c04d40bd88cfa013058686e5e45e25d88faf80cdc8214
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Control Panel 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-25_ed405121436ca3712b661d589fcf4344_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-25_ed405121436ca3712b661d589fcf4344_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4420
  • C:\Users\Admin\AppData\Local\Temp\2026-08-25_ed405121436ca3712b661d589fcf4344_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-25_ed405121436ca3712b661d589fcf4344_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4560

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Uninstall.exe

        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 5.8MB
        • SHA256 6640260fc3facd8a65b5096f9e7e3cb282963affb9508c59e662f84c2a9c9511
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppVShNotify.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 11.8MB
        • SHA256 4132bf118b1ae993fc4c04b7d076197e41fa5d6b90f0769e8d34ce0d4c16cfa3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InspectorOfficeGadget.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 5.8MB
        • SHA256 ed2046d5d67a7405bd6c04d40bd88cfa013058686e5e45e25d88faf80cdc8214
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MavInject32.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 11.9MB
        • SHA256 4532628b95742c9eceb1bdf8dfb1b4277623f9a1928edff39942fe28eba82eff
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OfficeC2RClient.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 29.2MB
        • SHA256 b303df58b88763702b164f269c080351fbaa906ce9d90394e74b93a31281bc7b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appvcleaner.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 13.7MB
        • SHA256 81d0bfcaf232faffd7ebbb76b4a4469208f468b373179c1d8f21871a16032bfe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appvcleaner.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 13.7MB
        • SHA256 efcfa8df8d0cdf9f70e152caa423de96f10afaeda64172ad51854157fea337d3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VSTOInstaller.exe

        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 11.6MB
        • SHA256 ea4ae0938d047c9ec1421647b08402d5fcee548aa0519badd8d4bd70a6a5404d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrmstp.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 17.6MB
        • SHA256 a36f181b2f8f2748ad9955c32457550ec5de073e333d3e6092479b167fcf8c88
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_pwa_launcher.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 13.2MB
        • SHA256 1f39cdbd631e05aa79fe0dd391d0d61b178f50aa2dd35af970fa80ca5c4ad16c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevated_tracing_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 15.0MB
        • SHA256 a06204db7fcf9e6a7339946d87fca09f48dd02c7fedf074ff0b32d039892d101
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevation_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 13.8MB
        • SHA256 a878bdfebc09293623e5a8e4a53195249490462ea6d205666e1e42f15cbabd2c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notification_helper.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 13.2MB
        • SHA256 b83d0f27f33a66f3ed6240f3cf003139eedcc44d033b177604a9cd8481835df4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        os_update_handler.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 13.4MB
        • SHA256 8b633109e05707c49f73bfb1d68465f566dcf7991e9149d0a232b430f05ac006
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 14.6MB
        • SHA256 2e4bf15bf41853088a5a8463b440f440f51b8948ff2c8326aef7d7b6c9de4005
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_proxy.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 13.0MB
        • SHA256 c964f728fb39fc43b27fb7ec2c778469a429d3eb4d0e3f2f39821552de59bcae
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appletviewer.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 11.6MB
        • SHA256 61fdbdf6d1903c2f0464c37b0c3e125e342c40af3e3a0dd81c1794e948c83202
        • MD5 SHA1 SHA512 SSDEEP TLSH

        extcheck.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 11.6MB
        • SHA256 5fcae83329b6febe5e65f8f7be76d2da4910656bc4d6cb99103dcbbfec31bfd2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        idlj.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 11.6MB
        • SHA256 898a38ed3559d0797de191017cd7118b8f7e61009a00b9018c702e767cc995c8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jabswitch.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 11.6MB
        • SHA256 a0dceb0ccedb13a3c32bf0ba2f671c14101e60d892f6fd519ac4d90a299c2f4d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jar.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 11.6MB
        • SHA256 e626eed964e79ecc30766d4d9c7fc0daca7b812c9779764686997d2cbfe9d6c5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jarsigner.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 11.6MB
        • SHA256 33c662801f079d44f597453b1c56526a09a6c5f833013c50626a32b3c6847049
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java-rmi.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 11.6MB
        • SHA256 7bfda7f56460795bcd1abdf3d01c30a2c3135473483d01306b59e503623c57d5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 11.8MB
        • SHA256 2ad45b06cdde0feb7c362f589fe88975d7fa9d7d4bcc0e1082aa3697868d1d0e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javac.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 11.6MB
        • SHA256 94545388156ad9ae5bed40a04ec786691b0453c432752a596fe2ff3812ce29fd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javadoc.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 11.6MB
        • SHA256 b91644dec3832c0ba170e7b089c72ba83396835e13d3fe05a0d9362c1dd4ae97
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javafxpackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 11.7MB
        • SHA256 40d992498cc6b087c89bc1cd7b357d89201469262a02b8bcca320208c9aaaf43
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javah.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 11.6MB
        • SHA256 64ba5ca984401388fe38decbb1f5108cb1f10e7eca01d227005d6c8c2e9f213f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 11.6MB
        • SHA256 3c5f386686cc35ffaefca09f054e5d325e3d23f175df28c5fe0c7ff487333a62
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javapackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 11.7MB
        • SHA256 5c13fb9b6b3577199223e8c6992f07f3fc5e865bd0912caee50abfb293518064
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaw.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 11.8MB
        • SHA256 1bbb3ac1984bbb19b78c893d1e9b183723dd495b49bd0e3a20e6211eb7cb26e6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaws.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 12.0MB
        • SHA256 5af46e56c10f887d839da0efd3cf065a719a55392853f7754021ab07cdfd2ba1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jcmd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 11.6MB
        • SHA256 16e7a0cc95cbd7cf8546b8c279f8b457ff24180d3132a1d0c8a821cd3f60790c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jconsole.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 11.6MB
        • SHA256 42890122f2fe4db80cdaf3c5b390fb1a73a0873d37ce43b7a0930c2eb7de1ea3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdb.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 11.6MB
        • SHA256 9c80dd5bcf4d454dcc779043f3fa107445fc0a970da66846974a632c6135f2ef
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdeps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 11.6MB
        • SHA256 4c7d4e6a7b52fe5d878cf394c8f08a92b531c2a506e6403feeb49fa038490be2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jhat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 11.6MB
        • SHA256 1bded144738d3d38db7e0dea8a57e5d51fb9700281e8aba8ef062d1a3fa703e5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jinfo.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 11.6MB
        • SHA256 bb4d5f9e75393772d99b0df20699c142b868796dbcfd0b376f86f0ed97dc680b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jjs.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 11.6MB
        • SHA256 79d54847dd2a84d42da60e126c53deb4373df8407d9910ae8dd4065782fb8b3f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jmap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 11.6MB
        • SHA256 d0f4aed1cbd1842a4f7931b30a76288b48815a227bb68515de86e3282466d106
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 11.6MB
        • SHA256 a36dbe3d89b460e79f5d7b9a4ecf478a61e934f11b47ef43d5a293d2a48227c3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jrunscript.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 11.6MB
        • SHA256 fe663910dd3be1a2e5c25d1df2fa9bece5ba9c08e3dcefc55c07e9ac251733ad
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jsadebugd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 11.6MB
        • SHA256 120fb1a6bc91ca8b4a63abdee04bef326bb4348c3c1844bf04375940d56141b0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstack.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 11.6MB
        • SHA256 1d551879f34f8b23cf16d47f16ff3e0a544866c8b142e23f8810664bddc51b89
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 11.6MB
        • SHA256 71b8ae7bf4c04cb5b5d992101b1a64dc57a20868ace4a6156d64af8af8467d0f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstatd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 11.6MB
        • SHA256 800215a081851926932e63d574e5ff0424a81ffc6873ee4fbcdd4fbb058fd072
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 11.6MB
        • SHA256 53274337fbc4d1e627d1d3398cc2b20e34f8d9d212cdb24a50442cc38e32c18b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kinit.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 11.6MB
        • SHA256 84fb877f84834450411b296cea975626f7025c1bc827d512046df559dd16d249
        • MD5 SHA1 SHA512 SSDEEP TLSH

        klist.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 11.6MB
        • SHA256 e2601a154a2181163b75207d21fde79aa2c081a092d4893a81e4736a731155eb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ktab.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 11.6MB
        • SHA256 5e2d7cb68b71b8efd1b50e4fc67dd453c403cc7e830dbbf72dbb4f4baf410f96
        • MD5 SHA1 SHA512 SSDEEP TLSH

        native2ascii.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 11.6MB
        • SHA256 364aa9fb416650afb05ec755352487c18a28e5dde92bb8ac2aef8eab1efce86b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        orbd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 11.6MB
        • SHA256 bf57ed8de37750faa4a0e778fce9c55de6de555655b474117dbc06252e062aaf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pack200.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 11.6MB
        • SHA256 c808b983248f0a34d15393551999ace820ee171c398407117d23e8801b336c2c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        policytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 11.6MB
        • SHA256 d2b2e9a4c64e7bef88de866752c8ed2641626e9d546cab9551debf00faf7f073
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmic.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 11.6MB
        • SHA256 5705b83f9533b61b0a696bd291d4f9dce86c755634e5a98e460c22d8addd713b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmid.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 11.6MB
        • SHA256 00185e910fa9fa90672cfebab8b5a2c2f76b387a9bcf419d974921e9562c7c4c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmiregistry.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 11.6MB
        • SHA256 1284cf9383f41fd931edab59b255ef93fe795e7fa6aab3bd5fc4812de603adec
        • MD5 SHA1 SHA512 SSDEEP TLSH

        schemagen.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 11.6MB
        • SHA256 ea01c49c7f6194288311ea9f343516eddfe4e0c8d192da6cf9bcdcb7b2225c27
        • MD5 SHA1 SHA512 SSDEEP TLSH

        serialver.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 11.6MB
        • SHA256 f7fdaa2375626c7cb19ee65206d59af704c4c35c49f9b614331241efdebc757b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        servertool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 11.6MB
        • SHA256 6e43710364f1e147fb6e8b2f64b28c467d6555d90ca297ccbb0117521ab4887e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dotnet.exe

        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 11.7MB
        • SHA256 57575924ed53d26b8765ece0c6d61d5e64ee8a9c8b3b4e926e4654a9291a379a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 11.6MB
        • SHA256 ee4084b73a4a8e26d3bf8bce4acb39596abee5efd87bc15944a4c0fdc74f92e8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 11.6MB
        • SHA256 99375c94b51f600dfe6e0dd2f407ae9c08b33ff1bbb0ca7f610c59aaf20c0db5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 11.6MB
        • SHA256 c8bcf6ca11fc203e218be89c68fc997c99e10c7aa7186da1634b94c9da2920a1
        • MD5 SHA1 SHA512 SSDEEP TLSH