Overview

overview

8

Static

static

3

2026-05-05...r_.exe

windows10-2004-x64

8

2026-05-05...r_.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    113s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    05/05/2026, 07:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-05_ac39cae5fb7f9ac90b208e3bee54fa3d_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 32.7MB
  • Sample260505-hydllsd14k
  • SHA256 8d12c0e815802e1b25efc92697f76e85ea428c09c2ce47abd3aee54ff950fe9e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-05_ac39cae5fb7f9ac90b208e3bee54fa3d_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-05_ac39cae5fb7f9ac90b208e3bee54fa3d_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4828
  • C:\Users\Admin\AppData\Local\Temp\2026-05-05_ac39cae5fb7f9ac90b208e3bee54fa3d_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-05-05_ac39cae5fb7f9ac90b208e3bee54fa3d_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4724

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 33.4MB
        • SHA256 e0246e1f00dd7b3b7aa66625f801363dc34b01a293d2928f3fa4f5ce9834c91a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 65.6MB
        • SHA256 81937f231d23db3c7770a7cc1fb47968a9a3d4eda8d46aed161b513721cb37f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 71.5MB
        • SHA256 d4f56d448c04a1eb6a31084d4694137ea9acb413e24640146304f0cea4015779
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 67.2MB
        • SHA256 febca1b4e78486b8dbe9de27c161332da296b220ceff3fc72af9578d9bd9ce0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 69.0MB
        • SHA256 0e4a1c8245cf0a9274872b839240362c270659466885b97f8dbf1edc22dd1a9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 67.8MB
        • SHA256 b9c67b2a844f135ece544585ce91eaf9ca0c58ac383059062ad8d2edb4d0e096
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 67.1MB
        • SHA256 9e5e0198573d2a683f0ecf3d561340e592d94300de5935e37ecb53ab6125b2c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 68.6MB
        • SHA256 e96afa74690c0681e4adeacf413a58c8eb679305c189e24c2662286bdfcedb3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 66.9MB
        • SHA256 a4e988930cc0992d847c9f6204e769d5713f7fd8963918a6a971749249aa609d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 65.5MB
        • SHA256 59e7515f6337130f29a185c98b05692dc9182451aa580f7febd09f6c675bc379
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 65.5MB
        • SHA256 fe355aec225dc1f128d9e30515dfedf8de4d494370e6604e7dd89eace4c053ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 65.5MB
        • SHA256 1917861c94544309792fc02499891253ab27dd3224abd2610c155cb918441f56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 65.5MB
        • SHA256 3327cfb2bd8950a23aa11f9d23f67ff5c99bc199cc20103845ba5b6fec26e5f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 65.5MB
        • SHA256 68167f0ce1c435cb229b4899ee06204d7d4fe5ccd5a8737dc699e3d6aa9938b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 65.5MB
        • SHA256 f2864e8401f64d22ee8b6b9a1f56b58093e5d546da2c41455f3d2754ebed106c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 65.5MB
        • SHA256 19b21c549c14f8b1cd14cd7ae5a4816142a4cb768ee808fa8ed4623f01e4b34a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 65.6MB
        • SHA256 b2facbb012c84c402f524ba4ab2f109ee1f1806b1f7261d1faacabfc1d754a00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 65.8MB
        • SHA256 850dd5b829134b62439be7bd1339d8d39acd9177488582bac3b8d50f1de10bed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 65.9MB
        • SHA256 8928f18d82dd6dc30acfb2fe2ae611799bd083b271f0ef26bd3a31fefef1ef1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 65.5MB
        • SHA256 831829e89c9d13d6488d1129f4bc4963ec9a050d14165bafc2f1275e38631287
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 65.5MB
        • SHA256 a1ac4ea014b549823be2600cb273e409b5c60af16a2cdde617ec0afee310dee4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 65.5MB
        • SHA256 a05528ee63c17df4b0e7f4ec05366839233dba28abe19f188538df5404f49625
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 65.5MB
        • SHA256 3eb03d5e9b8f69b903a784924a10f0c07a0a4769dae26862168a37a5ddc9d977
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 65.5MB
        • SHA256 e0ceb42eb78a076f9e54f28d59baee9071c6ac24c03c9d37d38864acf9faac9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 65.5MB
        • SHA256 1f6ce66492b158205ea9bb7c43c42fcdbfe5cf874c16244a332b195d316bf31a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 65.5MB
        • SHA256 289577c6817d03a8c0684a20efd8ca587711c7b380ea961667a415451bde27ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 65.5MB
        • SHA256 33c778b809da7fff4054a344d16589f3b53afb244fafe7c8347678c2c44f0689
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 65.5MB
        • SHA256 e9170247e9136b9f4dbdf9b97b8eb007d1b2d7114a9cfc6cf15fbb4393c6f91c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 65.5MB
        • SHA256 7d2892a95cbf219af35e61f95eb8abf9a914d75371ed6dd8f49e059e692d3f75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 65.5MB
        • SHA256 bedba2faf851707a1ebb53fde077b66f37accd608b0c3d62ef86d61fcb05ff21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 65.5MB
        • SHA256 43c54b121dbfd47813f3561550c4c9dae2e5781cab787fd994709aae7ea735d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 65.5MB
        • SHA256 453525314f29fd51fca016fa05fbcb9a944994723f0f372b640e52aec590bab7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 65.5MB
        • SHA256 d8991b58fdb8fe1722cf0eb91b1871f9bf815cd2504fe81048580b8fec997fec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 65.5MB
        • SHA256 b4e80f7cca2227fccbb36b6ead22d5d38a9881113587af8f51728a0d4460ee39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 65.5MB
        • SHA256 dab5136592c524687456612f1754960bf9f4daadf245d73307af5cc446e521e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 65.5MB
        • SHA256 06545fedaab4c865ea8e260d350eeed62ba82783a340118b7991bc423d32e91d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 65.5MB
        • SHA256 6ebe70e6bb1933b05c74619c07e5eb11cc3e720716d2f6fadf2914c0d06f2340
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 65.5MB
        • SHA256 3f6d6b5253d53f00376a75cdefb73b50f003cca018c334f40cd4d96fcb312b9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 65.5MB
        • SHA256 e5845c153fb3c286f3b8f3e5f8e2ae0fa107b02fa6538a9e11754ed1c512bf6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 65.7MB
        • SHA256 0ea97cf60456c4a35104151cb8c8b31ce6ee80f3b3117225f002cb3fb6271c15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 65.5MB
        • SHA256 a4e81e708c2c3c816ab32296350bf3a66ccaa574b6b1da00477229027fd588ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 65.5MB
        • SHA256 374d3c2fa7dedd29df4ce6101de45ccf899531479ce9749edce10a6e2349f919
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 65.5MB
        • SHA256 0cd6fbf306d79c1869ac9187097991d99eb9c21c674e49b2f10b1f8dd062a30a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 65.6MB
        • SHA256 1824adc795e985d4742a7731d1845645ce7d70a428069aad02aa51230cb1eaad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 65.5MB
        • SHA256 a8416d877339d29dc0993d552d27e65a4912e1bd8a7b62dee63ef09314e42ba5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 65.6MB
        • SHA256 39ce45837bd86a911d6c415a7d906e8de7c380837c7c833aa31551e770dae588
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 65.5MB
        • SHA256 6afdcc96c6b2982e4b2972443b533548b388fec0bf78f5b15d0c1e24656d24f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 32.7MB
        • SHA256 8d12c0e815802e1b25efc92697f76e85ea428c09c2ce47abd3aee54ff950fe9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4724-68-0x0000000000A60000-0x0000000000BAD000-memory.dmp
        Download

        memory/4828-56-0x0000000000BB0000-0x0000000000CFD000-memory.dmp
        Download