Overview

overview

8

Static

static

3

2026-04-25...r_.exe

windows10-2004-x64

8

2026-04-25...r_.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    25/04/2026, 15:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-25_053a91731ceb485cd1d1b4459536d672_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 14.2MB
  • Sample260425-spm4sscs5x
  • SHA256 cee854a8a551eed6821d4d0cc6a768fb3b026ceb78a99a37c0a24298e10beba3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-25_053a91731ceb485cd1d1b4459536d672_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-25_053a91731ceb485cd1d1b4459536d672_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2456
  • C:\Users\Admin\AppData\Local\Temp\2026-04-25_053a91731ceb485cd1d1b4459536d672_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-04-25_053a91731ceb485cd1d1b4459536d672_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5368

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 14.9MB
        • SHA256 55ad73707a5c44a72c93e3112e459038186be58cb26b4b751e0a8605f38d22ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 18.3MB
        • SHA256 b509a01ff558b71c508e75be41c85565e6e7393b137cc249f2a23535b50e3c24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 14.6MB
        • SHA256 23eac763c3f31a9843f4d17b39400ebd3b07ad596a30a1cec4a75d19bd890e71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 34.5MB
        • SHA256 fbc3ea6c19c680bca75eb08fd6f83a9e15b5dc6cbd3f192b0713d9e4865b5df3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 15.9MB
        • SHA256 3a8e878123c51e4cd04e9cc078be8b7c5489785e22a9873eb48561c55ab43867
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 17.7MB
        • SHA256 808c00f57fd6f258cb9884cf9cdfb7a992511326c773af78641612a7ad45ab10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 30.7MB
        • SHA256 7e4ed00377d0a10ebe1e7aac8f994e365ea8e371195f50278329a8c1699edc2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 30.2MB
        • SHA256 9afeb79b994e56f955e3616d49f6020862adafa5c3afaa443d7182fe52b9edf4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 31.5MB
        • SHA256 789fae8c7c0f729f351b2874d8fba00d9890ce21764e78420492057d4d623c71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 29.8MB
        • SHA256 90777dbb11273a05c4680f8b3290cc76cf9b227568a643d9e4cbffecd8a4ca45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 28.4MB
        • SHA256 548525a163e36b1a27d88c454b81040fc4149a816d5dc5fed9a209a13a181c9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 28.4MB
        • SHA256 a8dbce19a8a95f732f2b21222056889d8be3ddae0b79f7f4e441a0b1b8e059ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 28.4MB
        • SHA256 97d21057791654f411ad650193bbd345f315b5d85f354c906817496ca5f3e25b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 28.4MB
        • SHA256 550610470331ee15dd8cfa5cd2831af20dd0b7913f801788417f3e2fd45217f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 28.4MB
        • SHA256 8cf53186e3a7e870d0cb6e7efa2e1748eada47e90469a7bbe61c6d0628baf6e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 28.4MB
        • SHA256 9c174bcb4955aed24f0bd069bb09f4671100b171058164cd05edb18508290321
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 28.4MB
        • SHA256 9b217ca2fce92613515077cae719b4e29dde3f0634e8d10358037eb1c0845a6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 28.7MB
        • SHA256 4e96271fa0d6bf10dcce3758fd2dd681688f1df1bb18a32654f312980328265c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 28.4MB
        • SHA256 9d794b0d3e350c452eab2bf93a90a87390d924aca088ac4c45aedf44114668c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 28.4MB
        • SHA256 ebb0c1249822c31cb2a68d514e4ba620fa32bbabcb40f6d2d7daf349a7d324ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 14.4MB
        • SHA256 88132fbc2f8d7665bd3ee593afd30a8bae6760630935a3f22912073371fcbea9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 28.4MB
        • SHA256 0dabb089369db78ac1aff95f17a72671087a417a5a75f947dee217b54962c57e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 28.4MB
        • SHA256 dbf88bfff9125856adf706f8da99364e3f598b0a83064876794b8e15c6fdaa4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 28.6MB
        • SHA256 00177715e20bf180afa7dce072a68ab3d35027ce5e2932d28fd4fde64e951126
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 28.7MB
        • SHA256 8ed0ec5871e273c1dc983163cd06a3595af53f3d9842951b800d2d3e82536b38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 28.9MB
        • SHA256 f77dd0aebfbb61dfc89d197f8a24fff48b62f1dbb0a0b9ce5f897c4e6606be8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 28.4MB
        • SHA256 7190c62fe3c460d611b97f1c0f694650f0d3cb4baee7f06b9e3eafd0c81919fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 28.4MB
        • SHA256 56c892f44aacfd9131469f727b71b1c553862c6762247ae8482e4a82fda9af9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 28.4MB
        • SHA256 97dc35cea3fd776f692beade8495b052b80ca2afd95f71eb34a3750c3e52ea3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 28.4MB
        • SHA256 0bc7b91afcfb23c2f15fb288b6143f2e0fab6235c7f66cf1c56e9c45b4ad2c7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 28.4MB
        • SHA256 deec6216afbf3f3de32ec0aab948c22e978aa7d08db0ca22050e696dc1d2b0ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 28.4MB
        • SHA256 45cee15e251822f02898c23e8f0a40e0bacdbad67b7921645804fea4f98b7130
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 28.4MB
        • SHA256 549798b76b644ca037e656f32aa80bea37f964ba16d21555d60866a2b44e6a5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 28.4MB
        • SHA256 f8f1351de13ea7a0e10ebf468e4b3528043deb170379974189299b15836c550b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 28.4MB
        • SHA256 96f140f752cb0d0127b2df1a652518fa9aa318aa83261a9073dcb3f3285ac6a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 28.4MB
        • SHA256 a796ff4ba040c74c3a0960b907853945a6f251b109ddb249d5a759779411a665
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 28.4MB
        • SHA256 dad523880c5ab73fb238697cef0e24f7913dc047daa672eacde498d0be850d9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 28.4MB
        • SHA256 101ca6b529d28c3bc0534c108bc0b4f8c2b2b9c6c244ae12e8dd1b44ad617515
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 28.4MB
        • SHA256 30548c71f7eefbdaeb82228f13a5066be0dc6231923b8aceaa79ce61883eaa5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 28.4MB
        • SHA256 32da86d7d99c8132ad3da1b5a91457b87ecd399af51664f09f57cb22db7111be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 28.4MB
        • SHA256 39d19d8f9466845661dee644141e3d23ad671e118549e54dc3c481ed6bb29dfe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 28.4MB
        • SHA256 58a741354f8effc6eae08b8151d5c53e4f0dd3328606a3c116d1208e6b29876c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 28.4MB
        • SHA256 f049f80e73c484e3bb4ae389da4c1b57496761cc9614b1c708930f1b873532c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 28.4MB
        • SHA256 18fbd10c466275caf209d79dff73f50ee8780cef2556818bd015d3ee9e947de3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 28.4MB
        • SHA256 6f35249727063370ee2b4b761af18df2226775685d84a7f610c7b8595f919ca4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 28.4MB
        • SHA256 b1501325692655dbd844ea9db3fcd5fa42128a3061f27bbd22ae61081c4d5a82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 28.4MB
        • SHA256 4ed8c14fb88202a25e44014e7f927b8de0e848e39f3561377b8c7c476f455e84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 28.4MB
        • SHA256 5aad9dce1659c24ab21d8653647a62bf1f65503494119b9f6678ebf494b59b07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 28.4MB
        • SHA256 46b0ae8134e06b104c8c94fcb4c71fa587544fef06396be8687600d05cd91bbc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 28.4MB
        • SHA256 d95c1f979bf4f710d4598d837ac49ea9b8f2788251e4947c72fb270bccc2ceb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 28.4MB
        • SHA256 a96c6784c089b602eef710cf3109cd4bc89ce6b2b895ad865be22659bbe4b117
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 28.4MB
        • SHA256 51b92bbebc06cfc349f876acdc8ce567366cca37962fd39bba4289a62a55aa2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 28.4MB
        • SHA256 a9a5ed5b632e9266ce5bea2bcd964d6f7ac6369c3ae707fc8ab6f45291def04b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 28.6MB
        • SHA256 c4e3330900ea7a594317e79f1646be18390e4d0c5e4b705df4dd65f445e07393
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 28.4MB
        • SHA256 bd9a462ab74d85a49e48e2e8056c21baf0b9d1e3cac9063ed59146ee97510d82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 28.4MB
        • SHA256 ba196be45b14f9bb227fc6b66067799dd7b29116f44695760d22edc86833d673
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 28.4MB
        • SHA256 d74bb9dcc9c691449fa51068aaf0e338a5a957ae416d3159f0cc28f6543b1eaa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 14.2MB
        • SHA256 cee854a8a551eed6821d4d0cc6a768fb3b026ceb78a99a37c0a24298e10beba3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2456-3-0x00000000023D0000-0x00000000024A3000-memory.dmp
        Download

        memory/5368-4-0x0000000002220000-0x00000000022F3000-memory.dmp
        Download