Overview

overview

8

Static

static

3

2026-04-21...r_.exe

windows10-2004-x64

8

2026-04-21...r_.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    96s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    21/04/2026, 23:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-21_c42679e5bd5145da1cdccd84185588c4_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 23.0MB
  • Sample260421-3gdkhahs8x
  • SHA256 c873591167f29b3cc5336781989a70d2e3200b087f3cf646ea6f2446c019b76d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-21_c42679e5bd5145da1cdccd84185588c4_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-21_c42679e5bd5145da1cdccd84185588c4_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4712
  • C:\Users\Admin\AppData\Local\Temp\2026-04-21_c42679e5bd5145da1cdccd84185588c4_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-04-21_c42679e5bd5145da1cdccd84185588c4_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:328

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 46.6MB
        • SHA256 c5eebf933b4c47ac4569141ae004535e264a8e09cdbd3793e6202b18801f43c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 47.0MB
        • SHA256 957cc4a40365d63f53b8231b0f68c2f4e232f14aa81a93887fdc32c78c1ca4fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 46.8MB
        • SHA256 e12f2e865bcb6fec28fbbce2e20912a18bb796708e9a50c93a639088ef83eb3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 46.1MB
        • SHA256 a4e9c2ab51d08dc58eeadd6e6ee9b0929b529c1ca7ee713caea43f02fc1d4d8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 46.1MB
        • SHA256 2d6856d37389a73951278e3b80296f878c837edc64a09ba2acdba99f9ab06bb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 50.2MB
        • SHA256 284974a26f7b1a1500ced3500f94416ab08f9e674b81500bfcd997eb1f0b08c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 69.6MB
        • SHA256 7f3ed2f630054c4fb2fd04d99914d3001ea20ed27bbf4d020b19d11e455582c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 48.2MB
        • SHA256 af6cf9bd9451c0be0e9f538cf4c4430d071ddb86486f82b7d8c5cf9662c6ac35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 52.2MB
        • SHA256 26cee092b3cdd04531f20f2f37f65f52f63d61328c795a213c7d93582735106e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 47.8MB
        • SHA256 933c8af80561268d0719144990969bca6813b05747bafc3aa70601ccb6d22ddd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 49.6MB
        • SHA256 b47e47e4f0bd07b3312476295f481c305ce19aa6dd735bd4bb1eb4ba5e5e7f9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 48.4MB
        • SHA256 9e394e986341c2bdaf13c432ac1b7deab4c10c9df9fe021e10d336ae85f0c89f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 47.7MB
        • SHA256 4c9ff0d1400bc3f2444e1582319c14024e99aff4d17f82e92f26f010e97960f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 47.9MB
        • SHA256 c9716da93b3bbced5f3e8fba69b79be5f575afc819494b6146ef07ef33598e20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 49.2MB
        • SHA256 12700edec0be5c1c7acf12cffed7703c535da9373b3d490bcc0d9cdac60fa6d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 47.5MB
        • SHA256 aa39741ec2b49c087cc09a3824aeaf917d84bf564c818893400b76182ea48322
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 46.1MB
        • SHA256 9cdff82c2c1dffe82f6da0b4bdef47dde6b5dfbf7b037e99f5e0d1231fe8b14e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 46.1MB
        • SHA256 7ced311e9cdbae504572463c2864824468544ced7c9ed5fb637ac223778c40af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 46.1MB
        • SHA256 e2335671405b1c51099b09f0654e6555869fab81d1c8ae6e8e850db04df6edaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 46.1MB
        • SHA256 be68d04428e7a1913b554f30f498d3fe8984ea70ef9721f8f9c79ed5fdc6751b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 46.1MB
        • SHA256 ba87574e358fc1b81170cf6c1c4a0188474de309fd0b9f017b30cf319640f174
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 46.1MB
        • SHA256 b0796e1749d4f7fa15dbed52e96c8e2ba1c34268517c43557f81405c10361948
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 46.1MB
        • SHA256 54955e64a4f4711d71427baa2c22aec1b8030c536f6cdab4e3a96d3ad4e0ffb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 46.4MB
        • SHA256 81bef31a2ebc03e03db9b8e39440bffaa4984e7d9fe443693d1377b009f8e123
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 46.1MB
        • SHA256 f95aadf1c2c4de6ee2aa748e285f1cbb0cda5dda5541ddcd2e7760886be401f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 46.3MB
        • SHA256 e5967e2064ef5e6ac4632622fb755b0a3f4e7e6999e0873d88a0d85f00967ce8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 46.1MB
        • SHA256 d3f1c6e38955b547f21d37e33b8d6f5cc72564e77aea09b258095bebf169c586
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 46.1MB
        • SHA256 f86ff92936063c515ee1ab761a990ac4bb3ccb8d3048739f363a3c3298547534
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 46.3MB
        • SHA256 58fec44d9ff739c87ccfdd314db0a5faad9380707543c8b6971e39075bb20c81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 46.4MB
        • SHA256 2abf75324710482beec1133868c2894b299b66827ebc1ddaf859dd12cf1b52d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 46.6MB
        • SHA256 f9c820a8d0b1a684179e2ec36280fbf4d6fae460bcc05f941fa453df8aa1ea58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 46.1MB
        • SHA256 f06a052f75cb48abb7cc837b40af75ede81be488a52c1d066a57ce07fd10bba5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 46.1MB
        • SHA256 69b06683f12a771d3feb5444059b7cf19ce42e55b81d0bf120d6317aa4d42501
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 46.1MB
        • SHA256 7ffe9a66c2798892755a1ae41b9213df3d240e297694e904a2dfeb856b3a4732
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 46.1MB
        • SHA256 ae7dcb3332d671cd0a0481d0e71a8426a1d08a592c15c33115931ab5408221e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 46.1MB
        • SHA256 ff76502c5cfd78b7144f6781149a296e5b5efe08883a4414375158ee3e9bb946
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 46.1MB
        • SHA256 de311e7cdcfcf85973ad2cdc5de50d58819aa84fe9f60440c348aca5655d9fc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 46.1MB
        • SHA256 d7055d2b7e166a227fb6e46988d765ea4419673a607509d1d3bed1dbb4234b02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 46.1MB
        • SHA256 8ae648d9a0d2258c9f0e4e374211d9ddc0e66d83e595b4ec5568e1c9aded7e0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 46.1MB
        • SHA256 d231a1ddb59b6a98a39b741662f2c7c6f1f6c2223154329639c1944b14a0e934
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 46.1MB
        • SHA256 8519484999e1f05854997cf90e7d15957a6c5acf50a3e0a1013b1d4d65b41c7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 46.1MB
        • SHA256 5fb30f03ec0f7ce9e4fcf4122850c88debb5e44f7e4927339439b0e98dbd03ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 46.1MB
        • SHA256 6761c4aa7e3584c585f839049387adcd9968ba890d93c767d0326e22b7e2e7a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 46.1MB
        • SHA256 fd2101fca2c4a653d27a2370d8ef3216f976fac0c16a5f1f381ff278c963ac2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 46.1MB
        • SHA256 347f801d8eceba105dd85ef8cf3b34829aa55dd0e938f8d10755ca3c8ecc6436
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 46.1MB
        • SHA256 ea31aa334ade36fda648f872b94df0718258f63da7cabec4722fdc5b5ed4cd72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 46.1MB
        • SHA256 3aef6643f288fbaae04b7fc30fc4420b01c2d35d15a7d01169224e47c90d22de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 46.1MB
        • SHA256 00a32a35030ae6d141ca4aba78023acadd800ff46ae6f12faa829f9b47be5e91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 23.1MB
        • SHA256 cb2029ca8b9ea1d9921ad81469159c65022fc91990b0042723ee94b494d6a2f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 46.1MB
        • SHA256 44e2b67cbfc5d7cb0f3125aedabe93affca3de81e8a6abf6ac17a59a3b614642
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 46.1MB
        • SHA256 86182ad830aba81331e64114edabba2a61e60fa610f693f2a16f682b3418124b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 46.1MB
        • SHA256 47912575da7ec223324861ffcd10f0b083f27585e8c3cdbe333eb2e761189e6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 46.1MB
        • SHA256 9c27ed3b500d7a7e48fdbf720123ceb7a640d322ddeec9de7b36d42698625901
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 46.1MB
        • SHA256 c257c615f857f38e45d407424f28939f9b488889da4d24872ee8945ae52c9d93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 46.2MB
        • SHA256 6a58f6b822c458c90bd5916cf657999b8dea2c7ddb0ed44662aa54950267bf69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 46.2MB
        • SHA256 81852f204d2a0fd8d066ef0737d884835f500bb0bc38fb5943a909072bcca72a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 46.2MB
        • SHA256 d3b8b4b64273e07e7731e9bd297f32cd401db3e8d570e98aa24167287ee21377
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 23.0MB
        • SHA256 c873591167f29b3cc5336781989a70d2e3200b087f3cf646ea6f2446c019b76d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/328-85-0x0000000000940000-0x00000000009BB000-memory.dmp
        Download

        memory/4712-73-0x0000000000B90000-0x0000000000C0B000-memory.dmp
        Download