Analysis

  • max time kernel
    148s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    28/08/2026, 05:57

General

  • Target
    2026-08-28_f6ce859ecb3cf06463a0a1c2b5cd515c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 6.2MB
  • Sample260828-gnk29stdkh
  • SHA256 8bb1d35bfcbf0734e6dc9234dadc10b1d8d9e06b669ee6a767915a1912a8bbd0
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Control Panel 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-28_f6ce859ecb3cf06463a0a1c2b5cd515c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-28_f6ce859ecb3cf06463a0a1c2b5cd515c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5060
  • C:\Users\Admin\AppData\Local\Temp\2026-08-28_f6ce859ecb3cf06463a0a1c2b5cd515c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-28_f6ce859ecb3cf06463a0a1c2b5cd515c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1776

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe

        • Path C:\Program Files\7-Zip\7z.exe
        • Size 13.0MB
        • SHA256 5df175fe6301f7f3b537e4696ba9f0523a85191b6f923578b7d5e7b2d3c2620b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7zFM.exe

        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 13.4MB
        • SHA256 f72164504b6f5778fbbcc4ad071950c87ae72fb190719a2fc5ee6f2b502f4d69
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7zG.exe

        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 13.2MB
        • SHA256 81468e89074507e72b1b03b40b8269cdf5b5f909a8b35dbfee7b1e430a83fcab
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7zG.exe

        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 6.9MB
        • SHA256 35a3fc5471de16b9c9e32d3327da4d91e7d7522483bf31bfd63baecc0c3cbc4c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Uninstall.exe

        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 12.5MB
        • SHA256 52b398d1d14ea078c608dee16cb5ec55511037446fdd4a7c0addf3693930d5fe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppVShNotify.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 12.8MB
        • SHA256 8191c4229979d53c1de23989d49682c992bfb2ae6413ac3cf39a3098cf30eff2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InspectorOfficeGadget.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 12.5MB
        • SHA256 1670f9163fa51f2887c3205b102e47442d9bf284cd87812b29f1dd2a957caaf1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IntegratedOffice.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 10.3MB
        • SHA256 0023123395712de1374590ce60224287697200f455924eaf2d7b028368e758d1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MavInject32.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 12.8MB
        • SHA256 39b6bc34f3b921c1ab7c092751578e1137ff6f4815255e6c726967182acec082
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OfficeC2RClient.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 36.0MB
        • SHA256 b2a9ba01e038ad7bbd5f09c644d708300bb10d61bff240a98154d9df8cd581b6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appvcleaner.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 14.6MB
        • SHA256 b8c8eecdd6045e2ca21adea6c96f7fc6e307220b2c47e8461fdb301be1060c88
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VSTOInstaller.exe

        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 12.6MB
        • SHA256 4d25768f9959769b2f8341854aefaf72731fa59703b52c61bc45e6b7e505a983
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrmstp.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 18.6MB
        • SHA256 5e14c94e71363be64520f6a6b2261eac8dc4e0b0728ae9e34c9294d9b7421404
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_pwa_launcher.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 14.2MB
        • SHA256 daeb6775b977ec046ba6a7d1738fd589b546f9c27237ac57d9401cfe81e3760f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevated_tracing_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 16.0MB
        • SHA256 dbc97a2f7ce8a484c358c7b25d293a51d5745fb3645bbca8a1d56319e27265d5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevation_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 14.8MB
        • SHA256 7b0bf3c6505f963fb8f99ae2660733f9199ce41982abd2fc5ce0564dd6148622
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notification_helper.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 14.1MB
        • SHA256 2032bdebcec23f558c038079dd88a2d8a048d4eed7932c7f0d06e92eab0012ec
        • MD5 SHA1 SHA512 SSDEEP TLSH

        os_update_handler.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 14.3MB
        • SHA256 a07fe6af3ea6afe1221ff8bc803412e806e606b6aff0a16622a856574c8b3934
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 9.3MB
        • SHA256 91f9b3e612ded93117a4f6efc6f06bba183a817512194e91a39cf3cd08c91780
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_proxy.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 13.9MB
        • SHA256 a63d0f7617c89f5138f0718a9c4b40dfe93b51681b50c63259d2a37dbc575723
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appletviewer.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 12.5MB
        • SHA256 79154a246035639a10533b3a640b3d8102696b2ec4897870a60b77cafd17652b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        extcheck.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 12.5MB
        • SHA256 c426447c6f6541f008e18a32d392e4f358d57285b2cdcee25a9ebf854ab2c674
        • MD5 SHA1 SHA512 SSDEEP TLSH

        idlj.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 12.5MB
        • SHA256 c384388eccf04a3c81b0e11ba5daa4e6b6579d553a66033aad4b9890aedecde7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jabswitch.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 6.3MB
        • SHA256 5f32c9959f7de7784149ac6cd1b54cf1084eaec652aa2f621b254b0b16234284
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jar.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 12.5MB
        • SHA256 74d4e36c42a26ca8cab4c72a99803974092a1153978e7cebbcdda437c33b27f7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jarsigner.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 12.5MB
        • SHA256 d0a33d7e567e76d49d9ec09d4f3160e00794cc04ce20cab68ea0997621271c29
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java-rmi.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 12.5MB
        • SHA256 7d597895f0d26202d337c6cceabd763773cb912032e6f700f4c8d51de4c64f2f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 12.8MB
        • SHA256 a3c9b559999f63083f1c9b097335acc2585df921daee2577b137365839e30492
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javac.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 12.5MB
        • SHA256 f6075ff653b68ad594403f2b28fae7a23160e688bfef3cc4d3270cd1d4208fb5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javadoc.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 12.5MB
        • SHA256 f17d0b05694b6428b7a7e449f53149c51dd835086ad9bf0cb4bfef686a961486
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javafxpackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 12.7MB
        • SHA256 d142f7fd10c9f504f77cefa907d49f73b0ba59df624a9e606031e390fe112ba6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javah.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 12.5MB
        • SHA256 1f566569f7962ffaa896e5e2930c20d80b88d1559d736a145c306226b8a0eb71
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 12.5MB
        • SHA256 0afa10a13607870060bc05d0fad2ff875c38a412cbf01a29ed03af00381a3ff5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javapackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 12.7MB
        • SHA256 b6d1982ab8462cba6a288f52c0e2c113c09c394d2e3ff766780c276bb9b3e92b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaw.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 12.8MB
        • SHA256 813a8adb8dc70e1143995fca18ab24aa7996f15c468a4e615fbc4170dd31e7b7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaws.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 12.9MB
        • SHA256 814f81ed80cf426ce4ccc391acfbc1ed2be1e34bedfdfdca5f560e2dace8aef0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jcmd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 12.5MB
        • SHA256 82d49b1f7a3e2081a05ecca2fe0609513af4db9b6f835c699a3d424f8b485858
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jconsole.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 12.5MB
        • SHA256 c074f3175c442705baf4aecbbeed1de8d537b6dbee78094861863cac667bd382
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdb.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 12.5MB
        • SHA256 055d015917be787f1f0651225ae64cc39eba5f6cf37a46e53bc9863aebd28db7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdeps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 12.5MB
        • SHA256 99259d71375dba2237a4edb0e49433f7327c8bdc3ee80d3240f543f49eff0bc8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jhat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 12.5MB
        • SHA256 0c119c8a0767377ca4b8dc1aebef99a881bcae234841ae452be42c04068e153b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jinfo.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 12.5MB
        • SHA256 5131e9b423a8ec98a8ca21fc46f6abd3a86fdfbcd4de3abc4401bbb6e98f6426
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jjs.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 12.5MB
        • SHA256 8c7b5724013b121e419a9aa6872302910b8fbba8cc0ec76a34920d22ee7aa5ad
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jmap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 12.5MB
        • SHA256 9d9d217c310638568321b140f60b1ecf9afe7c0fc6281a58ca4e7c1ac4c474f6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 12.5MB
        • SHA256 2c9a1b0578be7b7409e6695f772f9ce747ca0c07458b242459f41dd606822e86
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jrunscript.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 12.5MB
        • SHA256 6ee07dee00a0e97c6979a0bdffdb0cccc0f990db33d8b9cd6f9fdc3bf06c7cc0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jsadebugd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 12.5MB
        • SHA256 57a595cccbbf7375b7211d8c171db4c377d156aee6d3162f0f26940153d67f7f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstack.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 12.5MB
        • SHA256 8348709762b3e9f5549b8e70232beba0ea6326988c431ed18843ae842191a0f2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 12.5MB
        • SHA256 61c646147feabab71edc39b50ed4282a4138e1dcf81b0b974c3b97792b64072e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstatd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 12.5MB
        • SHA256 d6b3a3b6bab66242ce3d197d5c1e99ad5f1d5efd0fcc67da259288cf0d40ca64
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 12.5MB
        • SHA256 278e10a63decef70eeded0aeac5d69ce2dd8610cf214ec231e2496e796209706
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kinit.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 12.5MB
        • SHA256 b280ba8ceaade9ae305f62935cf3afe61fa5adcdae23383766d95ce7a7659e30
        • MD5 SHA1 SHA512 SSDEEP TLSH

        klist.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 12.5MB
        • SHA256 cd277c7173e6eb4d80895b4cb4f20204b0577cb4e35c7501d9484fd592eb9431
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ktab.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 12.5MB
        • SHA256 421a17a5f99b165bad90b2eb6f2b7fd72a597418eb36506e3281a11704ea7a2a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        native2ascii.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 12.5MB
        • SHA256 a9546198992e92c3d5d395bee5bb86414a64babba65efec5e2e997c4674b5ac4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        orbd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 12.5MB
        • SHA256 1d8cf53fd652fca8247fc253c6e9034a7dae0e7d134730b0bcf1b6ca3e3dbce9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pack200.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 12.5MB
        • SHA256 7106177af19aa419b12b7027be1f36cadd879acbea0c92bd4f6b165e14927660
        • MD5 SHA1 SHA512 SSDEEP TLSH

        policytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 12.5MB
        • SHA256 279fdb34f56b144a29921c0438afd96ccd831bd12db6c1e4ce072cbda569ede8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmic.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 12.5MB
        • SHA256 50790c19535b663948c423e5a51b6d3c4ea026206cd0f6025e16d0729f3e8925
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dotnet.exe

        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 12.6MB
        • SHA256 33b1e0ccdebcf646e767a854881fcc60237a864dd217aaee5530ae05bd446b93
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 12.5MB
        • SHA256 a1257644629802a2dd6abd997a48c466d25856531566b30a09fd424a451a4d16
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 12.6MB
        • SHA256 e88aa8573685c1d7232a9f948646666cfe7f526690ef658ac4dcd62490132dd3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 12.6MB
        • SHA256 29e8dbe9612bc7d163a1d7869997e96343e7525853effac51af88510663fd57f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        spo0lve.exe

        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 6.2MB
        • SHA256 8bb1d35bfcbf0734e6dc9234dadc10b1d8d9e06b669ee6a767915a1912a8bbd0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/1776-2-0x0000000000400000-0x00000000004E4000-memory.dmp

        memory/1776-6-0x0000000000400000-0x00000000004E4000-memory.dmp

        memory/5060-0-0x0000000000400000-0x00000000004E4000-memory.dmp

        memory/5060-5-0x0000000000400000-0x00000000004E4000-memory.dmp