Overview

overview

8

Static

static

3

2026-09-16...r_.exe

windows10-2004-x64

8

2026-09-16...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    23s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/09/2026, 12:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-16_61c601083ea96d4de4ef87b3315d6ccb_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 20.6MB
  • Sample260916-pdhs6abj2t
  • SHA256 aaa977f2f2f24fdece540342b08124b6360230b75174120e939c44c631df8686
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_61c601083ea96d4de4ef87b3315d6ccb_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_61c601083ea96d4de4ef87b3315d6ccb_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5808
  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_61c601083ea96d4de4ef87b3315d6ccb_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-09-16_61c601083ea96d4de4ef87b3315d6ccb_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4892

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 20.6MB
        • SHA256 b594c1e9ac88c4c0b63aa52e795be776081f67d341dac9b9328a55a28f1a48ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 45.2MB
        • SHA256 c6d1bc130617d7574293463c6dd673a4fac800b501ed6774d0ff553572749f06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 41.5MB
        • SHA256 2dee93f8f41051833ea5e6696c7d947fd561a1815b5bd9860b66ad2ce3fb499c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 47.2MB
        • SHA256 320b1d042a53798d21636df7df5c6c2f3bf19a6acbf110cdfba64b15b7828f89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 22.7MB
        • SHA256 95c58410dfd06cb7acc462c34445600c615184e8d16b7c98ce2fa19f2ce96c43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 41.2MB
        • SHA256 fab8666b34db057d444c4d435e86f20862b379bbe7f93bc39f1af5d55d11ce90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 46.9MB
        • SHA256 5ff77845cb89066d7106d7e0deb0033da5430967c351c48b64f0208e6f6ffe44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 46.2MB
        • SHA256 c7c4eaaeffd3e65ceb233dae772704853b4122460cba86f1a96a3ed8f58b1afd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 42.8MB
        • SHA256 01f6c10e4cfc054124f467f2cb631ffa8ad7232d4c94a9a336a9a561c90b7a09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 44.6MB
        • SHA256 322e50ffc503711f3249be84368755f9462d98b2ba14fbde467bab210946c86c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 43.4MB
        • SHA256 fb230fbb444f85a9e268bff4bd11ac40859dad7ba143658b08e953920b9c15f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 42.7MB
        • SHA256 559e03af32ece35176e60e17ae3e5efba065f41c630f0f04adc3f00baf515379
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 43.0MB
        • SHA256 1896ecd209c99eb3f6f8d13640c3deaab20e74f0949c98dbe09bd6fc243fd346
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 40.3MB
        • SHA256 9bf1059df3dcb5f3623e94720fa1c8cd2cf610f53fb8c35704899ebaf52dc9dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 42.5MB
        • SHA256 ade2365e50b3c4c84a54bdac83418b701c43daac80357b81c2f75da36c12d75c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 34.6MB
        • SHA256 a30ead6ae10d675de624dc5fd26dd01ac51be62c7ee30bfe53a27a3bade385bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 41.1MB
        • SHA256 2fda25878091595483db21da3c83e63c4730ec3b57ae5da18991c3518673b7fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 39.6MB
        • SHA256 2b4bbfd5443db8f788ccf2db480e294f740c6e1cbd115a7129d607b3a2ad8996
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 39.9MB
        • SHA256 2c91df84cce498a2bb240a32d01c448238ed02f38236329747978e871313ddd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 33.8MB
        • SHA256 2a44d608b32b5f30f38641046cb2a11330f7d68eeb1710173f3104128272bfe7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 40.8MB
        • SHA256 0b7de1adedb684a7eb051b8e1e0a7a82ec3fe6a85f4295a3d63364e6367c1b93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 39.2MB
        • SHA256 b6bc1f6c555d16fab4cb32727d785bfe6b978d69035b706a7f18a9c11a7232f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 32.4MB
        • SHA256 fc75704865bd46742221cde43663bd1bab5149beafa937405577b276c5e89528
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 39.9MB
        • SHA256 097e290b33c8ac2c466cf6a41d060a9772bcd07b1ba39806d343c01e0a25069c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 40.0MB
        • SHA256 7c281aaae0db7c444a33761e45a9425808410992e22d4c99e4522d277e6eb0e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 36.1MB
        • SHA256 a34c001acd3e8ecd819c0bd42ec0970f478b117cb229f634e1a9d00a9c602edb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 39.1MB
        • SHA256 a3f4506d27348d92824681ef1bb53362c524c8068ecdbd0e487cd94cab107257
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 38.1MB
        • SHA256 be3d066665ee7f8ace9b8f9a10bfdd2e692107f0dc561b415f4d8e3795809c61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 35.8MB
        • SHA256 d13c5ecb64f5487593ef07ea5a44d36fd3aab30b7be51e495ee4d1273904d812
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 34.0MB
        • SHA256 2b6e9af5e24e4f07cb07199d89320e5f75b5478f2829a91be79ee511304c4fdd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 32.8MB
        • SHA256 99d79a1301d3cb6dab6b4ec0f7516587a601e8c5b59c253750a99763d36f9ba9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 32.7MB
        • SHA256 4a76566f51a62120a45d8a0c2fe63385664ec061a3669d421f2179d45ee2bcd7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 33.4MB
        • SHA256 a74cfd3ff0211457eeffa7a062d89faa160637cf77a3a657be9a10f42cf75406
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 33.4MB
        • SHA256 23f97ddf158d623cc822301010b7b62ec6bce8f695d0be51e75843379bc674a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 32.9MB
        • SHA256 28d43cb98a39199203eff9e451f45f5654382161489cff2522d9941ac9754fbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 384KB
        • SHA256 e07c4b11762b0eba9b36b768cc55f5a8d7cd5cfc56661ea29c80135d6e9424c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 31.9MB
        • SHA256 e396549244a1af2abf322233975f3e17a2c7ff2ab47ec9614bec94743e447813
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 28.2MB
        • SHA256 1e38514b70cd5a54fd405a7a7a0b40d0475c17196846afbbca613aeb7539a1bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 31.7MB
        • SHA256 9c39c0cd523c573a9b4e71c67d4193aa62ed1839efae665fac8da06dd18656e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 31.6MB
        • SHA256 29b6f51def339d69f53035349edfd78b0a47a91076d06c9eb7c58e81bade7b21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 31.6MB
        • SHA256 f0c2cf0b35cfebae2bef68f694388974f402d61ba5faf17a8b77729977545e56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 31.8MB
        • SHA256 9d5e68276751b16eaa6e426b92d970567fbcb7e8a190cf6d8296a7cc6e6c1a3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 24.8MB
        • SHA256 cb2d5d6a2d3fa14c056f0590f7f552cbef0f7324cad7347b35d0399c263a328d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 30.7MB
        • SHA256 100af4f62d1988152d99d3afd7316d3524354ecde8e71a05b7514406884c18b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 30.3MB
        • SHA256 ccc62708959cdabf12fd19778a1499ea9eb166e19cda0ef25805f7f743194ce1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 30.4MB
        • SHA256 0c0d4d9cf24c230f8e277017cf4871afdca54e45a0039731b778711d9b09ff77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 30.3MB
        • SHA256 16aafc210ad7e30f0a4a6c67650bf4f4ed1aeaf3df23dfb72d98544c19a0117a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 26.1MB
        • SHA256 3f9c5b6cd5250fa312080b1cda526609d91033fefb5a3d2c7c21563ecbcf74af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 26.3MB
        • SHA256 51d7354cbdfcea6ae68155f5667165bc63e712e3836bb395cdc635e68e0bcf38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 29.8MB
        • SHA256 4508abd8eeb1478874ac018aa78c7ba668b9cdf5aaa97d20ce7a00b6f24f4779
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 25.8MB
        • SHA256 b8379075a4de7f6581bdad4324a6088ab90943797726af071e5da250f089b624
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 26.8MB
        • SHA256 f7b87cb21836e896edd914e66e44ccd94f67dd41aff364937d85295b709ff606
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 25.7MB
        • SHA256 1a1aa932750e7146148025215b0271614c0b0fa5833c335700c6624b6745b22a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 41.3MB
        • SHA256 acec18fe9e2415cb9fd95c1a7794caad9d07e72232b5efb21a0f8376aeb2b0e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 41.2MB
        • SHA256 d81be0d5791bfec2802de8261a1de4876ccceee8843213b8b4522f48ef187a7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 41.2MB
        • SHA256 67f99b954eeca7b12c98f86cc6921a93ac5a3a6e225c0cd0516e422ad014ee07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 41.2MB
        • SHA256 a0894176c5ab2dfdef584c70e1a11a78ba099604a23931b4a0177da41aae491e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download