Overview

overview

8

Static

static

3

2026-05-05...r_.exe

windows10-2004-x64

8

2026-05-05...r_.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    99s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    05/05/2026, 07:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-05_ac39cae5fb7f9ac90b208e3bee54fa3d_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 32.7MB
  • Sample260505-hydllsd14k
  • SHA256 8d12c0e815802e1b25efc92697f76e85ea428c09c2ce47abd3aee54ff950fe9e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-05_ac39cae5fb7f9ac90b208e3bee54fa3d_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-05_ac39cae5fb7f9ac90b208e3bee54fa3d_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4268
  • C:\Users\Admin\AppData\Local\Temp\2026-05-05_ac39cae5fb7f9ac90b208e3bee54fa3d_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-05-05_ac39cae5fb7f9ac90b208e3bee54fa3d_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4744

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 33.7MB
        • SHA256 876d10a6d1c8231c8ee6e0b0c3f14c6ff5a2b1b09d0ffb6afa17129679f93791
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 65.5MB
        • SHA256 31f9990fd8e34b2d02f9da383c5440e3c3e1dfa0c177ab78957867f757784421
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 51.1MB
        • SHA256 493a316b13c164e386e2a834ee2b12b23ec3454d53f49681269ce6ef962f8906
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 47.0MB
        • SHA256 abd2d7fd38a138b18d85891e85ef72fbc602ea2ef0a0a6414f61443ee32e2210
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 44.8MB
        • SHA256 97ba4298b5782683d2957beda72a64f6783286c9327a37d956c89cd14121f4a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 43.8MB
        • SHA256 71cd30eaa8bc860593542ebed2357ee20234cd1a11181e20f471b6f19055856a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 960KB
        • SHA256 d9ffb76340420ea191c363a50f74ee7ad00b5aa601e00e7e87165d391a3eef25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 38.8MB
        • SHA256 64873be1f6911f2409850643eb183b98a09839ab883833214a156935aeb8ad8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 32.9MB
        • SHA256 e8371cb498b1c8097acc53c58396d0b05bd3212acd892e84754f27cb1ceb50d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 128KB
        • SHA256 c845e57c2a12493146dd94d766bd3f762d2a164e99d493cdbd76d3b229f5789e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 35.7MB
        • SHA256 7560100721b61f4982d700359b525281921a91206e28e67401e75c7c184a966c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 33.6MB
        • SHA256 cadb158bf0369809c5a347c7ed1ff9c24742fbea7ffe99af2a3da3acb5c207af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 34.0MB
        • SHA256 171afbdc3503108d7e153b51a2e983ab25e1cd7e1318e9a8a9edcdaa39ec8a06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 704KB
        • SHA256 556f0e5bf8f8879bfd5863e82f04fb029ccc6cb1c1df754b1d037eafa4c59ead
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 30.0MB
        • SHA256 52d5710df4b97739f0acfc1fe5d33593bd74a412cdabf7940f619ff8865f881f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 30.8MB
        • SHA256 275f03fdf436d654289ae721522c3f5e339b8b590acd7412725ea77c86e58ec7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 29.4MB
        • SHA256 5f58acc3a32824f221431def709c8f651b7a5629548b591126a89ffe42d03d84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 29.1MB
        • SHA256 ce7ce77e2e149263c9d9e52317220bca8d6d8a5e4ecdbee6f26ffca206274626
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 29.5MB
        • SHA256 6d0e5b5a6729f74c9de34b3c1376eb63e9910c43a4052aa1f5868c9ef4722088
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 29.1MB
        • SHA256 0b29533e2ebfa398932f2ab3c029d79d9f2a601fa18ed9cbbd8c82eee93b9a42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 28.1MB
        • SHA256 b419c397b84012aae82f9222792a0c179a956cb90ac845d6b29a8526142d2837
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 30.1MB
        • SHA256 5e7f95e6a6b556814208fb047685b857875a41e38b56b6a77f70f29936864782
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 27.6MB
        • SHA256 31d34cf959c6e12f575f909f51fa316604a91b31facae76453feb369c65a80ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 26.8MB
        • SHA256 a7f3dd03b4981cfea19338d8c1d243989487331616494587d4763be03dc6bd86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 26.5MB
        • SHA256 5c18b64c6d4526c80abeefb178ea3ac9a41eae39c1c5d926e96de24f639d50bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 27.8MB
        • SHA256 727240ae6851d60da35ecc48d19056ecfd1a27250f22c30f157f9279739e788c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 26.8MB
        • SHA256 a93f311e6c47b9d712e30d6f74e2867fc17668d7c99565117b4205453a8e4f34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 25.8MB
        • SHA256 675f71d16be03fd08372bca31c98b6d29e3b8dad1bfa2c5a7f7c75a5525e8862
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 25.6MB
        • SHA256 8de612ae2085941a6472223ea731fa8309d0881e435e10493eb33cf8338b0d5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 25.9MB
        • SHA256 02d37cc138f81d9b6b149bc5b62bde90f1f597cdfac9816bfdcc876f22e4c4ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 25.3MB
        • SHA256 ddff21711eadd0a8f131d83fc9cf8348e877b553bd8d42790e990853bf04d4b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 25.0MB
        • SHA256 cc7ec41df638f973673161392da3e15fee6c462037f42859fef6161e12e2932c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 25.2MB
        • SHA256 a245f064ba343d6335ea8bb2f975baeccd2af0db0532a21afebe3d50cf20497a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 25.1MB
        • SHA256 d2c573ae672fdb76905b9d9bdf891946bd15e9476fe8238232423d235f549293
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 25.7MB
        • SHA256 bed81455f27d0732bb85e20a44ede40ff5c8b0765d8faa9765388a03b26d08a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 23.7MB
        • SHA256 41853616706d84e6be0cad81933ccc2b67b7ae11ac4b87da15922f13209b79e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 22.2MB
        • SHA256 f2c5a4c0be228757786d49a271535ccb3dc531f07e73dc8355bef0ab32c1f820
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 23.4MB
        • SHA256 9a7913ad14322dfc0aa85bdace3c0b4baff8f388b43a58e0954c23de6e97486f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 22.6MB
        • SHA256 3b04883354d22aa135b679fc9037aab948675d39b63655b6d0a7f2dd17bc1506
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 22.6MB
        • SHA256 26bd58f2de4943c100466770fac760d4d97ca92be15cbe6fd8e38669bab802a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 23.1MB
        • SHA256 fcd8d8580dcf9541b9ba6f02aae3a09dc9dbf161eab86d75809b90a81a27d00a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 22.2MB
        • SHA256 c5fa855d05ce43ee07f70d3a6850bd520bb3819accc92ec5d586ca6c643caecd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 22.5MB
        • SHA256 2b1ebd62d5d62ae35cf2f98f64bfdd30131eebe8dfb8bb9c41449c62b42619b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 20.8MB
        • SHA256 0210aa5a9c45e7c04cfad94d3c67ffcd5800e198cd99a4c3a4995470c0cc6b39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 22.1MB
        • SHA256 e5ce84d26726929ccec83cda30c5633edaeab397bf2ed97209dbeba794166a5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 22.0MB
        • SHA256 c114dadb40a0b554b0b724f2d811e5fbb5b157e5866c8174e98c3767df2eefca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 22.8MB
        • SHA256 b94c27fba8a888f1fd0d790e41aec25e93eb1b87f88f2d2ba723160ef4ec9ac2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 20.7MB
        • SHA256 49cd02e4a66f5498f1f00510ade6f4c324934a73414cd25cad1a7ddaa59c826b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 21.2MB
        • SHA256 97ab8821062c9eeb16ef6761554bb852802c86c6b15f847fa3435bb68a0e3480
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 22.6MB
        • SHA256 d4e1f4c4580361bb04d6f880ce7170b6a283570e92fb0e614626b4a665ed9149
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 20.6MB
        • SHA256 b42fe0825cb90939bde587939bd9fd0990f0ef45a73ad44fad25170157331dc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 20.6MB
        • SHA256 78a246444fdb3e14f5d51d5d34a13ca244a1c40cd17c9440a420ae44b8ff4498
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 20.2MB
        • SHA256 66be9fc2d7a43ab075b7a3878d489d137795e3c78203e71f906d2a236745ba0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 20.6MB
        • SHA256 1cb140c98c5ab75ab32a8ade4e37b552fe973b637a46473f2a1941a9ea367801
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 21.7MB
        • SHA256 33b3c000e93ed5557c85c67aee0209977fe8665612137c57d48b5d033b3a28e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 19.6MB
        • SHA256 a3460e088c78086604763513eda81c6a63fed2bad4029bd5d0b41e6ab3cd3bd5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 38.2MB
        • SHA256 6e678ff7042b8ae735b30031618d6af6e37f707913d3a9e328e41eee96b283fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 36.5MB
        • SHA256 ea1fc1ba21ebb1dce24780473375687072b95687abbfb3dca1d71f682ce67540
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 37.2MB
        • SHA256 970ff6ccdf585ec6b074c7ea3606231b030e6bc837b01ac9c2e359c869cd716c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 37.6MB
        • SHA256 4475e5b96cd4ca424ed4fbe48a1728fe2ed7d0a18286f3901b0bff2cd0091ed7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 32.7MB
        • SHA256 8d12c0e815802e1b25efc92697f76e85ea428c09c2ce47abd3aee54ff950fe9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4268-11-0x0000000000AB0000-0x0000000000B6F000-memory.dmp
        Download

        memory/4268-462-0x0000000000AB0000-0x0000000000B6F000-memory.dmp
        Download

        memory/4744-13-0x0000000000930000-0x00000000009EF000-memory.dmp
        Download

        memory/4744-463-0x0000000000930000-0x00000000009EF000-memory.dmp
        Download