Overview

overview

8

Static

static

3

2026-04-15...r_.exe

windows10-2004-x64

8

2026-04-15...r_.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    94s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    15/04/2026, 23:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-15_35e41d3f78e11a3edcf92cc5fd0b742b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 36.1MB
  • Sample260415-3mcv6aev3y
  • SHA256 6259001256ce89b6036df7f6dbb9e95a203bd95abf25d226e179400f97aa0710
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-15_35e41d3f78e11a3edcf92cc5fd0b742b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-15_35e41d3f78e11a3edcf92cc5fd0b742b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:492
  • C:\Users\Admin\AppData\Local\Temp\2026-04-15_35e41d3f78e11a3edcf92cc5fd0b742b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-04-15_35e41d3f78e11a3edcf92cc5fd0b742b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4996

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 36.7MB
        • SHA256 eac75afbff5cd7158075511d6fc96cb6f9434d0b4a61ed1da3cb82d9e9f9b356
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 37.9MB
        • SHA256 7bc9f8f7ac09000b2e69c98ba44c71114717ba7665ed5c6ba7eb76361bca8446
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 36.1MB
        • SHA256 f4d2144433bd0206b6aa4c62e30d45c2b95954069afb831e49210dde2a69d623
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 36.1MB
        • SHA256 c83c23805814f69324654faa66a37e53512597ca0136bc2304a281064cfa2908
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 36.1MB
        • SHA256 ffdc19fc8b20d48f2184d56312fc39bbb148b95bef7bcf6f9e1ded413e7603a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 36.1MB
        • SHA256 d86cce21d46f2fc407b4ddd7ca8f79cb2693380d7c12e11b79f7b0963c216bb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 36.3MB
        • SHA256 43a14ffeafd10361e94f2923e3fb86172efd64951f9e886b91f6b08dc51e5003
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 36.1MB
        • SHA256 84238516f387709bb21f0ea9700d584130fdf8aefdff84e76b5cf795958e6f8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 72.4MB
        • SHA256 281b1307696e105ffe5c71f579c082c541e654a815a4a7cfe4e08f32221c2945
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 72.6MB
        • SHA256 e7eb19f4dd2960ef5925d49509a4d34eccde881ac73749738cf91d301cc6a002
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 72.1MB
        • SHA256 3e0858763c41e9dd187262e8fdc9f1299ce1231f7b8b3af3257af01b3be84620
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 72.1MB
        • SHA256 cb4ba37e0c476829c6e984ff7f1f9e24a378e7303bf2ad9d9c03381af3c9bdc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 72.1MB
        • SHA256 0279bc7f5f11e74623b6efa8734b9f8d52a1fa92ece4e4543193c5041f670561
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 72.1MB
        • SHA256 727a44f83a057a526aa9153fc55f730e7916b0bd566d827ed1810ba9b9031a55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 72.1MB
        • SHA256 939e520c5c3507b2c8017f2cad3399faab922e4ecb521ab2a19ec7e540124d94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 72.1MB
        • SHA256 a04aaea1117b755361a1a7478c0e2bcf5df725ffcb35216a270559335f040e69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 72.1MB
        • SHA256 0cda38758701060bc35599ce74a99e4f66adba7d98efb669a22b807ce7aded31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 72.1MB
        • SHA256 86018d662ac3895d4fec2afbb0fa7a18c14aa44b7abba174d4ae5152d1e1ef5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 72.1MB
        • SHA256 f912b40106cdccd28a217163453995471e730c971a168947dda51207f6c74d8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 72.1MB
        • SHA256 af9354393c1fdd56d8eb10d6961cbd6c1c38a3fee7595551df5a93817566d678
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 72.1MB
        • SHA256 1a6b5169c4bb85daab8b6907c31268d3551b540fbd18b562ff0fbfa82b28c2b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 72.1MB
        • SHA256 6210f1931492e0832c5aa259c3b8a2c6356e42f703064e750043d5c187cf2d7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 72.1MB
        • SHA256 4f92be86bc87c0dad796c60d4d3dac4cb4bed8cb2942826159b13417fc315b50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 72.1MB
        • SHA256 1b097dd1cb8c65ad43050c367e90e26330676fb8e0761faaba3d49173cdbc9a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 72.1MB
        • SHA256 77ad87ab257d7c279ce19dd9b9cbac78beee056864593a4a09f26226ebe39671
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 72.1MB
        • SHA256 80a2fa03fdb030d604c23ad3b1c8f89de77de8a3fd373067eedd12dba0503ba4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 72.1MB
        • SHA256 df33e239505fb064ba9814aa1e4fa35951f935fa55d410298bc55359cf6dac41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 72.1MB
        • SHA256 07abed69b8be669bbb81b68fa553d5bf83f82450f92192578f5ea888790915f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 72.1MB
        • SHA256 1fd87cc64e4a897d3da623e72e6ecb68bec782c4b9036194f6ec33c44f08ef6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 72.4MB
        • SHA256 f6912dd5d133508b6c928912efc9fbb28a9d7a91cc1c7ad9173733f7a2aa8332
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 72.2MB
        • SHA256 a5028e4c99aa5084eab8a2c67b37ccfee5e0569c6eb7e1b6670ab87c7e9979fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 72.6MB
        • SHA256 a27a542b3971f33e353beee78207d1ec5c6967ee5248481f40edea9ff38f1d5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
        • Size 72.1MB
        • SHA256 516547d8c0b2f8d93420869bcb83f72efb114b16e133221c5527ec57bee6860d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
        • Size 72.1MB
        • SHA256 36a96ccf0abea62438132548e6da765c5db535cd5289e9577562f6a30f60b34d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
        • Size 72.1MB
        • SHA256 af74ba60668eb8ff31a735158c3ea4f82e9c542f97532ab35de123f008a1613a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
        • Size 72.1MB
        • SHA256 8e787985eaba9ce1863d6f79cdd3da79cfa3b4d8cf6181a5dfe871e695c49b35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
        • Size 72.1MB
        • SHA256 98e835bcbde82451139e113692091969a0fde39727aee25bb417e5fe741524de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe
        • Size 72.1MB
        • SHA256 ceb7dfc6364f9a91c7b298d7c9c76a8a6c4b3a8ec5eea994f305bcae009d1563
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
        • Size 72.1MB
        • SHA256 a61bb64b707dd29b48ebbcc27ae6ddfed9c8459a38ff2688c11066fc045512d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssvagent.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
        • Size 72.2MB
        • SHA256 ed8e547c90f98a1117d0c23931d4d06471018631ecda756ffa04553bb360301f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 36.1MB
        • SHA256 6259001256ce89b6036df7f6dbb9e95a203bd95abf25d226e179400f97aa0710
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/492-51-0x0000000000B80000-0x0000000000BFA000-memory.dmp
        Download

        memory/4996-55-0x00000000006F0000-0x000000000076A000-memory.dmp
        Download