Overview

overview

8

Static

static

3

2026-04-16...r_.exe

windows10-2004-x64

8

2026-04-16...r_.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    16/04/2026, 01:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-16_826a1877b8a74f0e55f344395faeb4ba_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 8.1MB
  • Sample260416-bs4saagy8t
  • SHA256 f9573f5c2e59f78d7349e3493c55d965152c8645d083dd574c9953fa5c638bf8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-16_826a1877b8a74f0e55f344395faeb4ba_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-16_826a1877b8a74f0e55f344395faeb4ba_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4728
  • C:\Users\Admin\AppData\Local\Temp\2026-04-16_826a1877b8a74f0e55f344395faeb4ba_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-04-16_826a1877b8a74f0e55f344395faeb4ba_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3520

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 8.6MB
        • SHA256 0e6a817cb7beee90d412143b614b65adf0a6798f3ec0f338473fe829d711041e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 9.0MB
        • SHA256 ddaac9b311d391d171fbc7de1d3a853dd1e46e133e298ff16d6887166bc4a437
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 16.8MB
        • SHA256 02178b7c7addc0b3a38ed8eff184fd8a57f9740fc71169b5e7456a231afdafd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 8.1MB
        • SHA256 4566c2e28493ddae1dd1be3fc605bbfd358afdb41a9e0846323fa0e7e4b77ad7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 16.4MB
        • SHA256 0039a4afa90eee408041189c4e381a065de32735b9c6fe89316a97ffe3a588b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 16.1MB
        • SHA256 ff0a063ab4413c116b32e259a735624db13069a311c6c955cde1367efe275c9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 20.2MB
        • SHA256 d918cb6adaea6f8f18e3351070dbf5fbc1b34e0fd8172b55e43e826d28180b31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 22.2MB
        • SHA256 6b2248c16882ebc34b34387afc1cb96c31fec3132badb0a9cc58f0af3859e6f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 17.8MB
        • SHA256 33603789e59abb73d076143e59ce1474c522f8ad182932fa2eb22c38c95071e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 19.6MB
        • SHA256 60e3197fbdb7fcedf4c3746c807c7681bd5d1aefb6e013b509e67ba181e39521
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 18.4MB
        • SHA256 33b87e4139a0a36c54d876298d96a06bbd07a88eb2e5778dafcac83485debcf9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 17.7MB
        • SHA256 b16cb214cb14e57d192bd6da716a6e3128ed3d212aaf3f38a26c93fb7cea5e75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 18.0MB
        • SHA256 e9ed06e1a50723708551067851744f8a21205275bffdd75b32a33946960742d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 19.2MB
        • SHA256 4f63f2fc8050f1dc73633bb3a74e169f154c70ef477c42e2334a02079dcc1dd3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 17.5MB
        • SHA256 e4122b5a99e1c762042c0255b43a8eb0aef9690350876a6086f3e11ad70b7e28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 16.1MB
        • SHA256 fc9ce6027561487b5dcb076d0e5f70550510d635f4b86ce8f6bd710fb010f4b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 16.1MB
        • SHA256 1111ca899aa87042f53b7fd38e53d799fc66f665135471bf7b2d640cb99a668b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 16.1MB
        • SHA256 9bfff68f22fb19158baca009b773e3a5667e2f09f2530197e0a6c77ef8c77f75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 16.1MB
        • SHA256 fe243f6e40f464b2bf9093f020f50eaa219feefd8ac332b476d692a9a47b899a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 16.4MB
        • SHA256 4c522e16feef57263e065fa9304f7f6dcf8f6aaf1cfa3fa70954dd8799fa4fb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 16.1MB
        • SHA256 fa72a3e0196c093563a6653436a68146a10556d9990aaf9f7eac2019491d11bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 16.1MB
        • SHA256 18612640da4113c78b7e27e150e5e12c2df2457def48e1cd647bb09494517a1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 16.3MB
        • SHA256 a5fa4e6c66b3333ccc00647b5cc15aa891c892588d8d6b4e102601a7136b93d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 16.1MB
        • SHA256 6ed820db49a34c85d61c6e76fbae0f9b10bc76a136fe4cb20703b8bc750ce9cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 16.1MB
        • SHA256 778bb7da7aba641d53bfaf631d7e9fcbfffaa322ca207d3cfa29509164d4f960
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 16.3MB
        • SHA256 4b0103850249e61f7dafb6c84238cffd077f9a82c5edc0b32feecd0ecc5e477d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 16.4MB
        • SHA256 287e79296d468e8d7e53a96bc0ed6a8303e82a02e2ee11034fbab8aa3f61352d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 16.6MB
        • SHA256 0813f897e7a0ba82cfc54843fc6b2b4bc013764713765237088742fbd261cb00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 16.1MB
        • SHA256 dba4248437874b559e81e8e462870ba4ce2d88d3a1aa687a7910987039a60619
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 16.1MB
        • SHA256 0a826595dc6ad5773865f5d9d6f5b6e7931777a74af655e1b81d11b132d30a8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 16.1MB
        • SHA256 bdce6b1428789cafc0d573c078f676e7ab219168e942b0c2de96b91d900ed0fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 16.1MB
        • SHA256 9652ed367cece882a2c1bc8d1702be21a1949349d73da07ba2c354ef61773e61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 16.1MB
        • SHA256 ef58fd87f459e7e372d494caa584440623f9af7383efe2be052a7184b129bb1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 16.1MB
        • SHA256 61be49d1c899a7fe97cf69e8359e2bfd47e041e5fb81134eeff2d61b9080c38e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 16.1MB
        • SHA256 e1f30610e9f5322db9ad897e0f8890e79b546de969b097a2d7d0f1ae63cecd95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 16.1MB
        • SHA256 5545a0ce636ffd55839ca4b205aa83c6507e918fa27b15150192880eb53e1703
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 16.1MB
        • SHA256 d5a44c46a0ee964f13a803929d670242c6d295f35659e3638c19b3bd9a014e01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 16.1MB
        • SHA256 6d0d7813a63722f9844c0d3c963b1856c6492e4ad2b081f4d98c47886c13002b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 16.1MB
        • SHA256 03ed757d525f0c26de03c7bd74c86e183f8789c26ea969ff63d29c799cc9a938
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 16.1MB
        • SHA256 82a32625286d6829c1836ca7d7f32da6d2443468d802661a308cb61f726b60a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 16.1MB
        • SHA256 9e3904bcd83a33556414ef5f346a72a2cd35ffbbfe38feaf4708d9b0d8678fab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 16.1MB
        • SHA256 139f5031fc4c06e235d7c272958d80bcc4c5e813b9aa5ca58971b7329b409365
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 16.1MB
        • SHA256 11b73c6b7d034cb262b6c6c3886d2fa53e06e8018b775960458c7b3df05256fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 16.1MB
        • SHA256 3370a84e9188c8f21b56d638a45d6b82e15070dd1c265a8e1dffa9902c4a5c66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 16.1MB
        • SHA256 ae0fc104726d65960f14394b70d8b67273913b3482914954ed1682c9d4200932
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 16.1MB
        • SHA256 96854f476cf9af4860a2cdbfc051a8c1fbd3fa749ddeffcc45af462b26a7d973
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 16.1MB
        • SHA256 695dd656991d0841b7b4a491f0d60e0c8bf4b44661dc5abb0c1f4c666ef5e7af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 16.1MB
        • SHA256 f8583a6a2798a78c592cea883bb0d7d809f6e9bb4dd4edcb195a8ad83c7e579d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 16.1MB
        • SHA256 b1d49eaaefda34091e6e65ffeb58f3bc8ea262824df9cae543269a1f90119f96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 16.1MB
        • SHA256 451e61de26f9ffbaee40d0521a33bef55ddf2f345f3a7c23e48410cd3e957c5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 16.1MB
        • SHA256 b19670611874b128b1decfebd809c2cb1a70d473cdfdbb36431a1bc8c3697db5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 16.1MB
        • SHA256 6447849037cdc2cee6797108515da96e72fefa28cbc81cd8fe9f6fc0a1cdb7f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 16.1MB
        • SHA256 3d7ddb53778a1d06e09a48c41a68a4cae3e2b26e53765b8d2839605f9fd3d14c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 16.1MB
        • SHA256 a36440e1da47b872c653f3e05815e0dd4ed14e8a0e85067cd79592146aa5a55f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 16.1MB
        • SHA256 7b7e6334d9a3a9db4ba1e06dea4602fd786f2d373a8f6bbd2e72c19b4ebc94e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 16.1MB
        • SHA256 c44aa9ffe0c0a490a1aeb073c6514e1a6b0e0833e6f09aeca6bbb5146fcab53a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 16.1MB
        • SHA256 e191eda375bd802244d3fa5d34fac34f71258d34fc4f7c0b64c8dd27e4cef563
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 16.3MB
        • SHA256 e5653ba6c3e2d00d43a3dff3bb86cab0d5ff665f1cddffe060d9e4f10a8ba6ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 8.2MB
        • SHA256 f1e03687695cf47a337c1b792176525c1fe82fb1a7ea7cbd503879fe9ee531d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 16.2MB
        • SHA256 92c5a9bfcabde7cfc69271b756f3a36de6438015ef3eae864ab5be14639b3bd6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 16.2MB
        • SHA256 ad80357eaa9671e518ed71c4c3bb161040435d81985eb5ff6f07d07550f44505
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 16.2MB
        • SHA256 cd817fcca346f7aac42ba9abc93bebbd692753b11bacfa5b3c0b6046c8c58cd2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 8.1MB
        • SHA256 f9573f5c2e59f78d7349e3493c55d965152c8645d083dd574c9953fa5c638bf8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download