Overview

overview

8

Static

static

3

2026-04-15...r_.exe

windows10-2004-x64

8

2026-04-15...r_.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    100s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    15/04/2026, 23:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-15_450f6474fd68eb7f07ac53ebd2e2e958_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 36.1MB
  • Sample260415-29sdpad16t
  • SHA256 589e95ceb86bc944728b28aecac4704dc6c0f498b47f94b324434a94dcaf2d95
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-15_450f6474fd68eb7f07ac53ebd2e2e958_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-15_450f6474fd68eb7f07ac53ebd2e2e958_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2948
  • C:\Users\Admin\AppData\Local\Temp\2026-04-15_450f6474fd68eb7f07ac53ebd2e2e958_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-04-15_450f6474fd68eb7f07ac53ebd2e2e958_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4876

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 36.8MB
        • SHA256 3e9c3e538dbc0c02a60940b9da3df12b55100b4a732e6141668f0a1feae83c10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 42.2MB
        • SHA256 d308926a4fb38f2fcafa52dc1c85c6bf429f08155e59d0d61c4d1933a2670ce2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 36.6MB
        • SHA256 c7060c5fe982433d44ff7eeff7fdb74fc49df8ebfffc97a5d07c1768c4b488ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 36.4MB
        • SHA256 38b42bea4641a02839eef73f6a36bd4ab03a522648fb6d6b1e4614386e2f709d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 34.8MB
        • SHA256 3d60019a3aa34fead88a209b10b4f6f3d7eca3afb5fe5266167b95d1038ea588
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 36.2MB
        • SHA256 7888330eceb8592468a2a5d07a3a113981706d21b4dbffc1f20c2548c4b2221f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 34.8MB
        • SHA256 803b7a729b887c44b3756186fc3e3a7a25e92faed7a304e1bd9ec8ea2a49cc8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 32.1MB
        • SHA256 c9cf23d95f8ffdf6cc02fee1384cc62634b78aeb66fed71a730df8e51aa7f155
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 32.6MB
        • SHA256 b0b4696142dd418906ec1bf00c81adb09b42c9fe697ed0347fcd8ae8ec176cba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 31.6MB
        • SHA256 8cbb18fa9fe0bef6c7dba9d56eddbf2fd44f55090b4be9e70678aced24d0efa1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
        • Size 27.6MB
        • SHA256 4080beeb17a15bf61bb8ad95897dc5b310b9f21e1c715b6f5d8074fed7b68d6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
        • Size 27.0MB
        • SHA256 aa90ce1d8fe90d84848e03b3bf374be9f67f6b1d836faf36fd0a7762ddf9b3b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
        • Size 27.4MB
        • SHA256 5480ef2e799785c522f5f2cde332bd4fd6dab9ce1674573bb66b8714e2a32b99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
        • Size 26.6MB
        • SHA256 2446718d5a3e8c891404f769fdbb95d1bdbac3f76dd6e94ef6cabfd9c2e689aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe
        • Size 20.7MB
        • SHA256 e7984d29ce04d589c312e0460fdce618b3fc03cab2c12667b01f3deb72e2dcf7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Mashup.Container.NetFX40.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe
        • Size 23.6MB
        • SHA256 1aaec5d5a04860c6ee7ecce2ebb2812963dff624bcfc759f9f7259724a557f81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoev.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\msoev.exe
        • Size 22.1MB
        • SHA256 492c47fdd9fe5a724c0f1c840eba429231e89c25aaa585a2e5e6006908c7e7b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        eqnedt32.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe
        • Size 22.8MB
        • SHA256 aec25fcfb730440ed0a46acb2960f96f9cca2f8fd3215f4000eaaffe91a845ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SQLDumper.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe
        • Size 23.1MB
        • SHA256 30f430371c8a91c4902687d13318562b5ae96298be63bb4a88b3ff42b4c18b54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dbcicons.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe
        • Size 22.9MB
        • SHA256 a82a126e9eff089bbc061aef7530224abc5bfe1041e7717639527f219e4cfe6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        grv_icons.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe
        • Size 21.8MB
        • SHA256 43ffedd5c9f52eed24103143595cafd294b96b291df3a3ab46f7b1314b1fb82f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        joticon.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe
        • Size 22.6MB
        • SHA256 b694856d996242e9ef7b70310b0cfd1d63b341447d6768467f7d19f424e04141
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        lyncicon.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe
        • Size 21.4MB
        • SHA256 32b9037efd427c05b2b9a090aad9b4ea4d8b0f76fe3dc106a81e91568cb2cd3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        misc.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe
        • Size 21.6MB
        • SHA256 8420514aa95fcac6de0542fecd6ebd9091cc5d73929568ca533bf64762d5daf2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        osmadminicon.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe
        • Size 21.6MB
        • SHA256 fb62901280ffe2d2b1b3caf97e459fc4477498408f14ac7b806dcbf297a6acc8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        osmclienticon.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe
        • Size 20.6MB
        • SHA256 52eed61e511589f2d171bba80ed9227d6542411c86af85f546a3d2fe6468607b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        outicon.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe
        • Size 19.6MB
        • SHA256 444c68a3c879f16939e806380c9bcf7436ad015c8d85a9f3df5724aca7f2b4b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pj11icon.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe
        • Size 20.1MB
        • SHA256 0dc8add7fa98fb73ee68b9ce6ce3a074d9fa03f7d7d683ea3fb351235949fc14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pptico.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe
        • Size 21.1MB
        • SHA256 26903e10b19af27f34c42fa1ef6080e2f9aaf509a6c37645b71ced2f7e36a877
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sscicons.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe
        • Size 20.9MB
        • SHA256 638621569b40e84dfc3eba666b1086c0fa1d1ee6963afa16fb31317a480748ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        visicon.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe
        • Size 192KB
        • SHA256 f7996a7dd5fe2494d08fa9f763236add9a59a1dae852e1f694232feec98c0753
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xlicons.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe
        • Size 21.0MB
        • SHA256 48040992372a5eb46a1a23050ca3b0d05babe01be0ac14a4bb06db8312555b7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        misc.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe
        • Size 19.6MB
        • SHA256 f94480700c7b8f37e629dd0c6474ecca53fdd27f4b170b23f4cc32f76c71e0b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        misc.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe
        • Size 20.8MB
        • SHA256 e8b71d8539fcdb15f1900111f7bc5a4fde6d038c0af2081c5493b669f04ef6cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        misc.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe
        • Size 19.7MB
        • SHA256 f4931fa8e023165b6495fa10d6afd7bc1e3c7c1e6a6b6c1d2ecaf20d65639d0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        misc.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe
        • Size 21.4MB
        • SHA256 2941d63834b8dc690f143ec86a6c12509ea9cee571d11536480a202def9357ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        crashreporter.exe
        • Path C:\Program Files\Mozilla Firefox\crashreporter.exe
        • Size 19.9MB
        • SHA256 9814736a60fcbbf5ba177556a689f5367d021e3914b838ea69568fcce3b1801c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        default-browser-agent.exe
        • Path C:\Program Files\Mozilla Firefox\default-browser-agent.exe
        • Size 18.6MB
        • SHA256 be59a6cdfc0b23e2cc0c3f29e306d85125edc20211fa84c3f6671eea93a87996
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        firefox.exe
        • Path C:\Program Files\Mozilla Firefox\firefox.exe
        • Size 128KB
        • SHA256 c845e57c2a12493146dd94d766bd3f762d2a164e99d493cdbd76d3b229f5789e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files\Mozilla Firefox\maintenanceservice.exe
        • Size 20.4MB
        • SHA256 9cecfd09719df90d85e60e97abd701dd8764078298ed1a9c9059d6632f5bd362
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pingsender.exe
        • Path C:\Program Files\Mozilla Firefox\pingsender.exe
        • Size 18.8MB
        • SHA256 6ebd6ac3205a5f6153d889e1f50826f46c5e2a9ebb7eb667b10ad0991d15ba89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        plugin-container.exe
        • Path C:\Program Files\Mozilla Firefox\plugin-container.exe
        • Size 19.3MB
        • SHA256 bac6e83d5abfb6ac257cf8ba2c627ef30005e6a15caac93047d8e21f13e2d03f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        private_browsing.exe
        • Path C:\Program Files\Mozilla Firefox\private_browsing.exe
        • Size 18.8MB
        • SHA256 d8143e7fdbdb1311fd558f7e6eda6c8cd959d375155bbe88d01081d8c294be84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        helper.exe
        • Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe
        • Size 960KB
        • SHA256 d9ffb76340420ea191c363a50f74ee7ad00b5aa601e00e7e87165d391a3eef25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        updater.exe
        • Path C:\Program Files\Mozilla Firefox\updater.exe
        • Size 256KB
        • SHA256 e73a3db162a1bc55b335224f6393042a8aa3a42f76cb2c6bbfffd39feb358980
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        uninstall.exe
        • Path C:\Program Files\VideoLAN\VLC\uninstall.exe
        • Size 17.6MB
        • SHA256 f9d062a26da8d281ae6052d2343ccd7303af7f81107a374090c4b0072fcb11a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vlc-cache-gen.exe
        • Path C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe
        • Size 17.1MB
        • SHA256 2784cb956a5cfd509c4f51bd52e12e26df5b42bc0480f2c657293ca68830adc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vlc.exe
        • Path C:\Program Files\VideoLAN\VLC\vlc.exe
        • Size 18.2MB
        • SHA256 4aa71de2fc12ac61f36bcf534af9430a3c9d649b68eb496550bc5524607eb2e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 36.2MB
        • SHA256 4c5a4ff85e38274189d405259beb75717f38041521242cf7e198500c4d5104e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 36.2MB
        • SHA256 6de6144debfe6384b87a2ccf902869c27382e50452440aafe5f37651f8f7279e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 36.1MB
        • SHA256 589e95ceb86bc944728b28aecac4704dc6c0f498b47f94b324434a94dcaf2d95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        set.exe
        • Path F:\set.exe
        • Size 18.9MB
        • SHA256 313c2dff21feebce82ace1c0b927d327196ef1253ebe58b89272eead5f7e2b3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        set.exe
        • Path \??\c:\set.exe
        • Size 18.6MB
        • SHA256 a5031ddf0abb63ac2dc820305dcdd341cc03e672baa6602c066a952b8a56a342
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2948-28-0x0000000000BB0000-0x0000000000CFD000-memory.dmp
        Download

        memory/4876-38-0x0000000000A90000-0x0000000000BDD000-memory.dmp
        Download