Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/09/2026, 23:23

General

  • Target
    2026-09-07_6f953b817e77ed0e10ad55cb6bd74e1f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 9.4MB
  • Sample260908-3ddfbsygrc
  • SHA256 0eccbc54c93d4f48b82eba8566a6c01779403289fa56eb7a7c03c1af214dd52a
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Control Panel 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-07_6f953b817e77ed0e10ad55cb6bd74e1f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-07_6f953b817e77ed0e10ad55cb6bd74e1f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4856
  • C:\Users\Admin\AppData\Local\Temp\2026-09-07_6f953b817e77ed0e10ad55cb6bd74e1f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-09-07_6f953b817e77ed0e10ad55cb6bd74e1f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5764

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 9.7MB
        • SHA256 d67cb1d7c16f9ead4efbbba828192d63bac6769c05ef36f81d090be1d1c94ae0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InspectorOfficeGadget.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 18.9MB
        • SHA256 ba56dc8e7beebaf5f260bad2cdbc7f5e305df7d94b7b43072b406bd8f9a08de6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IntegratedOffice.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 23.0MB
        • SHA256 33665421829b24fd62b003e6c45278e143328a84fe0fd92ba18b1be3dc22381f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MavInject32.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 19.2MB
        • SHA256 9dc53d115f08b4d95d128fa20b2edc3167b1afad846746da7108d08c7b97e224
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OfficeC2RClient.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 42.3MB
        • SHA256 c7118eb4c12641de6cb2423cfd1252b0957faacc002c1352a06b302819ae3550
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appvcleaner.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 11.6MB
        • SHA256 df93d479e3244da10abaf56538870426b816fe6c2426c59912477cf823c9a518
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VSTOInstaller.exe

        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 19.0MB
        • SHA256 63f01aa916d4f5f6d86b758d548ae3c7356edcc26587b902adabbbd865128ae1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrmstp.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 24.9MB
        • SHA256 af842d6a249fed8e1c7af0bff464d2765e6d4ff718445a1ade5ce4c380946fb2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_pwa_launcher.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 20.6MB
        • SHA256 659bdc75662c8eeb5e18c3e577bbafda3825b772f0d0acab2763e038cb017a57
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevated_tracing_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 22.3MB
        • SHA256 2db3f48b8cb6dee5363ff0169ded93a5fca176d5163ccbb24d08f413e2bc63e1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevation_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 21.1MB
        • SHA256 a0bae28729812f7078389dc9253a75bbcabea44f64c73d4b3b11efb9e6638da4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notification_helper.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 20.5MB
        • SHA256 52ad56f04add99b8683389b14df3569d56d5d680d76b68dcb0578b5bedc00bb5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        os_update_handler.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 20.7MB
        • SHA256 231784ec41bd46340e14764384ceadae341a8b36e0d2bbebc79e181bbe9b294e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 21.9MB
        • SHA256 3bd80824cd469e9ab6a57a17c1bed7ed468966bb9c9252d28b0248935cde4705
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_proxy.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 20.3MB
        • SHA256 ebc773bf293ae5f3a0bcb36ba2f3988fe3d190abaac14648518a42e66e96a0d6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appletviewer.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 18.9MB
        • SHA256 4da51d27a772ba15e2470290a789fc64e47b508405353b853e8dac89df23d4fd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        extcheck.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 18.9MB
        • SHA256 5be2772d9b796c4ee405fdae618d4ae27a68d7e53830d587fa19d8c745a6b105
        • MD5 SHA1 SHA512 SSDEEP TLSH

        idlj.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 18.9MB
        • SHA256 fcd8975353ae266d61ce42b0930337b50e8f4e49ece3490226608647968c1065
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jabswitch.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 18.9MB
        • SHA256 490ebffddcea91a778e7a2164cecfbdcb32357552a034e3539ec0aabe9f6cdd2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jar.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 18.9MB
        • SHA256 8cc1a40c53d8489de364f158b7121d5918ba706f59a18d2871ac7e62bbd581f4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java-rmi.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 18.9MB
        • SHA256 3087b46ba34d83e5309b6a370376b3067108035938676e951c5cc89382a7d36e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 19.1MB
        • SHA256 6bee5b9255c9b81e0b87ae94eea1665ed7506ea0d26de1a2f1f4971b637fceb1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javac.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 9.5MB
        • SHA256 5fc142816d43ac35fcaad5eb991a8a027a868907762727aaf9ddab7f7ab24729
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javadoc.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 18.9MB
        • SHA256 b9256e2da00b080f85a1f7ae54373a5b62ac4e778fcedcdf03ad39c9d941572e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javafxpackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 19.0MB
        • SHA256 729c542e22b1d49c536ebef579bc363aec47f122c512e5776e6b359c918fedab
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 18.9MB
        • SHA256 4810a38a7ae35e359cd5daa273d1e22af0914688fb65619527ebfff7720cda7d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javapackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 9.6MB
        • SHA256 0cc56bcc7758a55ce6fbbf152b92b58220644e9e7a10e43343ba0159d15a6d56
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaw.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 19.1MB
        • SHA256 1a6cb9d8234dde34da159e0e8c6591cf3662cc120759baf7dfebc270763af651
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaws.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 19.3MB
        • SHA256 0973c9b98e47583d5d387a47fa3eb007564342c7b1ec04cde47a4b212b80d0d4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jcmd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 18.9MB
        • SHA256 3407ff2339a381b6a6ac1932e6bd2a11ddc833bb39d4f0cbae1a9646a48d8275
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jconsole.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 18.9MB
        • SHA256 67934c3908ef35085d960b5e20461135635dea6cf1a2b72600c8c876a1f51ebd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdb.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 18.9MB
        • SHA256 aeb5466ca0430f2ce0f39ab98f90bfe57dc567c605b2cf05d2474e241037986b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdeps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 18.9MB
        • SHA256 db8e14af4446bd11e2cfde6f78b2e555d05aeeefa731e1eaa52a154324373d8f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jhat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 18.9MB
        • SHA256 4c64c60c6ab0b740951ea66db363b68eb9111003c7676fba1ee53cecec78de6e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jinfo.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 18.9MB
        • SHA256 77c318bb079c97cda3410f619cd51d16410072b2885a13d6b7b34fe44b19dba0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jjs.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 18.9MB
        • SHA256 87f4318b9ccf307c718a312d999f730cec85efa7a981a0751711830f46743652
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jmap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 18.9MB
        • SHA256 47f82e02e649ecdd216418271a8257aa8c96c93bdbe4fdfae1d643e351862204
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 18.9MB
        • SHA256 2dd0f58fc416860a118c14b6b2fad677939032c2f79c81925791f03788773e0f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jrunscript.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 18.9MB
        • SHA256 0ac30d9bb0037e0e058af0874eb786b9825b4c0898ff282711c463951e43b7b0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jsadebugd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 18.9MB
        • SHA256 47746dc74db9f124d9956458bde1b2701258aa30f72ab8698d13f0f685f78145
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstack.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 18.9MB
        • SHA256 2050ac7ca313b893e7470a14b50d86a870f126d496e72f8bc19abcd3aa52d021
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 18.9MB
        • SHA256 e657a62714c050c69e93fe71bbbf329ae24e166eb9b08d8403c87762866e00f0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstatd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 18.9MB
        • SHA256 b91b8c8d28da6413430a49c150571bc90ceaacb321440b4149d9b3634a65b4ea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 18.9MB
        • SHA256 08655d4191f2eeac9fa54374a371b093a013b9b94c26d0c37cec60f464638942
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kinit.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 18.9MB
        • SHA256 8aa25f083cbb304ee497d44525deeaeef209df4cd6c7bc4bbcf32461aa0a179a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        klist.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 18.9MB
        • SHA256 4d92dd0085f833100c96aa438572a32d1edf3130db86b22a58fdd80574c5ae00
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ktab.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 18.9MB
        • SHA256 240f25a18234f46cea629f0664f673ef38d2b6ee16e1574e227361176b50e9c6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        native2ascii.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 18.9MB
        • SHA256 b25512d774d9d4de5dbff67b33823633a95396329106b575771cbebfa9598de5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        orbd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 18.9MB
        • SHA256 11e297395a954bfe2504e8bd10ec7bc6e3808b6f701c66a7bcd11e983cb78ef7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pack200.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 18.9MB
        • SHA256 a4b49c604db1c7ab3c964c063aa4cd131cf77feff466ec6f6ae7360262e8f5d7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        policytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 18.9MB
        • SHA256 e1fe302e2bc6026e9fcef6e18200c4e7d58467678c1f296999ecc8450d159d9d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmic.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 18.9MB
        • SHA256 cb04373f9b771c593b20f7dc69e43dfc1719b298b75a8cc814062633ebe697d2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmid.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 18.9MB
        • SHA256 82c5533bb6bf80d73dbfd780e86389756e42f2fbd49291518f08b4b7745bab12
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmiregistry.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 18.9MB
        • SHA256 b3238e93e5c0b6e4c4849f83957f639f42f0366ac60b66a092e141e04cf62eb0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        schemagen.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 18.9MB
        • SHA256 6f0e17307310801cbb9ed085c8a6c1665154baa284db4e8f0e29de14f61da2a1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        serialver.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 18.9MB
        • SHA256 b4c6742cc252a9bcbe2d143a34d3f2852efa21f3ce3fe4ac6fde39a4be688ecd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        servertool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 18.9MB
        • SHA256 b1f49ff1e0b883999f4e056c915c9af3ddbb2df432be3e1dd005014e97d81572
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tnameserv.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 18.9MB
        • SHA256 142890d82976f9802d7c55d17dbeae6987c41745d4f730451ba1a565eac097cc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        unpack200.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 19.1MB
        • SHA256 5aeca2dfd85f159ba547c3c2e355201762ffae1b6d7d88716f9692e50472ab47
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wsgen.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 18.9MB
        • SHA256 9a4896b088578e3284b8663b9d2afe613d3f7f80538c5fbc55ee256e70e78e9d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dotnet.exe

        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 19.0MB
        • SHA256 4c966e004eed120cc59d94fe8d9a8c30dbdc85a10a1dae73571255538e265ef4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 18.9MB
        • SHA256 db34f85e5be2375ebc0b0ca508249a58ddc931faceb42655c15f04591abece25
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 18.9MB
        • SHA256 25ebb72008c95b8e4231b9e12f4a7a0cb2c6699bb788317e8d90ad3fb36852d3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 18.9MB
        • SHA256 6d45f5ff18cfcbfead50d87b600d34a4d92c539efe49ce94ad43c6d2ed26a9c2
        • MD5 SHA1 SHA512 SSDEEP TLSH