Overview

overview

8

Static

static

3

2026-05-05...ij.exe

windows10-2004-x64

8

2026-05-05...ij.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    05/05/2026, 14:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-05_12ae15201039dc0877bc2f35a08c046a_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe
  • Size 36.9MB
  • Sample260505-ryrmxaas2t
  • SHA256 bfb2d9c1760ee67a43bec200fd040f12ee00726143463136a010885b5ca936c1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-05_12ae15201039dc0877bc2f35a08c046a_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-05_12ae15201039dc0877bc2f35a08c046a_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1800
  • C:\Users\Admin\AppData\Local\Temp\2026-05-05_12ae15201039dc0877bc2f35a08c046a_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe
    C:\Users\Admin\AppData\Local\Temp/2026-05-05_12ae15201039dc0877bc2f35a08c046a_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4944

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 37.6MB
        • SHA256 fbde2d1d762425249d91f77df294f55c4bf8319f73b34753f0371718fa758afc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 43.0MB
        • SHA256 5a557c7c0d6fc921666a8ea222c77dc03b56bd8792ec961c1e9d74b7c4e3c598
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 36.9MB
        • SHA256 76f240107e65803a9cb1add27e9fe934c952f86860a52518d9ab5c639a802057
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 41.0MB
        • SHA256 06077ec022171ec11dca758dfd0770d41505cdfe52db38eb7fc7324fff1d9458
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 41.3MB
        • SHA256 c2634f98ec79d390d3462615bbf8c1497760b54bea67dce3c1ca02a6408b5c72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 38.7MB
        • SHA256 3340fcadf08cb874f387bb8757efab5472159806e5b4aaab7eab798996b9eb01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 38.5MB
        • SHA256 335d3b9f727a05fb5f7938ba9a80c363a56b0db0e88d2bff839d49ee5a27fdce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 38.1MB
        • SHA256 c95be523434aaad7d7327ccdefee00c25c5bb1fd644158e8721fe138cb28280c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 37.9MB
        • SHA256 280f635a2f76a8c10330129e4d5478dca3ecf9bd1626923ba343510fe761600a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 38.6MB
        • SHA256 eac30f75f1005c88f220918ea7b8b82445a0352a6607668b6c7089197fb508e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 35.2MB
        • SHA256 998ec5fb2ba4727d557efdc0c0422087b35f964ce62fb57bd946be719ece8560
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 36.6MB
        • SHA256 04b92a52174145b7f8f8487ad4a5feb22cbe884775ab103009c359bc2970982d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 38.6MB
        • SHA256 556676a7d7ae172cc34b579e908dcb425891261b1a6752f247c8921d10f6fe65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 37.1MB
        • SHA256 fffffbded65d6b8250995a776ae2261e0fec25cfa34075bd60b62ce37f2e4272
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 37.0MB
        • SHA256 cb0baae847de29d62b0ae8a91de6e84dbd992c00139ecab774c6951717b304fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 35.1MB
        • SHA256 65a034ce9afe018c5050742c50e48b23bd7b3b55422612d96606de1ed29daa8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 36.4MB
        • SHA256 7b62e1d8f3c25f86a2423019220280ef0ae17aaea04e5ff33ab6c952bb88dbff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 36.6MB
        • SHA256 8ea868583040aea93034c9efae65f06ff509e3f53b05fafdb5d97f567691a37c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 36.6MB
        • SHA256 0ea04479caf32a9a750d16fbb8b640c8cd6941f904c2c3d7651ea0bdb6d2ac01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 37.1MB
        • SHA256 3d217fe53f3bfa2108d6c8b888ed015e00c175d96bd9f24c44c17339635f8317
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 35.9MB
        • SHA256 dc3ce89415366d31b37d175e1798f20ad2af19919390ee05359691a68973d3b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 36.9MB
        • SHA256 7ad01c1e5ff135e6bdb98ba5a71e2a61860bd58fc41b1eeb7569eaf5d930d78f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 36.1MB
        • SHA256 8301a81e2df03941a9cd4d221db4905e8802cd125c98222618f94849b4b27da3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 35.1MB
        • SHA256 d098fb696e5ea8139a6009447c0066a4bedef200858718a80f91fffe41c0173f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
        • Size 36.3MB
        • SHA256 c31b6b7fe59538c9fe30ebdbb746def6bbf68ad31e990c4ea68205c35199ef4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
        • Size 1024KB
        • SHA256 6774edb49dbdb14db4fa95109f3dc6cbefd3b9583276ae74ec68f6216cc1baaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
        • Size 34.1MB
        • SHA256 42972f2bbde3fc3caecf9ad58432e1709bf2e388ea7344f45263902367e3d8ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
        • Size 37.6MB
        • SHA256 c0ba1098f2c25230c2258af53d78d781a60bb1b8e17c92eb6000e65ff547dbb9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
        • Size 32.3MB
        • SHA256 4f8d5e9e346e35043a460bb2ca025f0a6ba0d2b7f4a17bbe0c4b313b52efd9fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
        • Size 34.4MB
        • SHA256 bb845f5920c118cc7fffc815c5f821ee6f781681173313617eb056bc74916e0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe
        • Size 35.9MB
        • SHA256 34e9372816860d9b3ba52d4ff5c596b08617b930d82c8cc289a54cf602f56726
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe
        • Size 33.8MB
        • SHA256 1f8742df529abf905d49daf822e13579af94fa3e58eb0145a32bb886dc10ef1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
        • Size 34.6MB
        • SHA256 edac3f8600acaff80d49f01b5ff5080602aa996ede24ce7655f20742cc364231
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssvagent.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
        • Size 35.6MB
        • SHA256 63de659117ebe45de05902ef100f550d38b15a68f3ff07480af1ce67aeefa760
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe
        • Size 34.0MB
        • SHA256 5208307941f7ce23b01b626e95913c116646a58ffcd7740e19a97157026fda30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fontconfig.properties.src
        • Path C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src
        • Size 34.6MB
        • SHA256 b7f7c0211219b56f41f99a03428aeb465331af539c3397bff1ca24728cb4fbc2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jabswitch.exe
        • Size 33.6MB
        • SHA256 923f22e940b3ffff187721d6f6a1a8190927784a644a1e5d6e2de74b60cf1366
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jre-1.8\bin\java-rmi.exe
        • Size 34.3MB
        • SHA256 05ce920bfae5e195ea45fc651dd288194d6fa7e852ef55708f682c72d388b5ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jre-1.8\bin\java.exe
        • Size 32.9MB
        • SHA256 336f9ae8820a930dde2e625046111684b180ed8c4692899220c1a544255cffeb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javacpl.exe
        • Size 32.8MB
        • SHA256 1f2cb9ee42a209d53f4a851e7a5274895b46a44344a5737e7e5a9df4ad47494b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javaw.exe
        • Size 32.4MB
        • SHA256 45585e0027bc8dc805adb708dd7918640c1d7d23aaae3061a877083d7a9d6cc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javaws.exe
        • Size 32.1MB
        • SHA256 0511113a9cf4e54c9824d14c854491ce7c0b02c1446c03fffc2711e1d2e4f3c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jjs.exe
        • Size 32.6MB
        • SHA256 789f89a40f65b7055485fbc1ad7c35f4f1cdaa55413a1618a36111d43ccfd4bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
        • Size 34.8MB
        • SHA256 d72d3080a88bd68d4e8d8c2154ded86765063933a6d9e02d063df6df87086bb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jre-1.8\bin\keytool.exe
        • Size 33.2MB
        • SHA256 0a06723468b4893f682e84e1aef763df3343de1347ca1c163fd8c03bf71b2d91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jre-1.8\bin\kinit.exe
        • Size 32.7MB
        • SHA256 a43cb05bc1d320bd6796abbe306f02c449f3932e0caf598e426d62bc79422feb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jre-1.8\bin\klist.exe
        • Size 32.4MB
        • SHA256 70f5d5ce5f82a3c2976f3e57b3c102feaa035b1db2f986fd1954911a41da3f83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jre-1.8\bin\ktab.exe
        • Size 32.8MB
        • SHA256 1a900215bdc8c8b58479ca9fe08a9c06ce0c04381b32d4d38edd3f964212127c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jre-1.8\bin\orbd.exe
        • Size 30.7MB
        • SHA256 0671def3841970b34704fd8f8c0e33b41f6e44d9ad71be2d87bd7b629bdefdb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jre-1.8\bin\pack200.exe
        • Size 29.9MB
        • SHA256 6617f293c8e11565a07f5bf24a8195c3da657813ca2bc108a09884aa1dc06b84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jre-1.8\bin\policytool.exe
        • Size 30.6MB
        • SHA256 944b46c0498bee6f9d243c384cdffba51a06e2713d5e7ca79b33fb1069e42305
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe
        • Size 30.1MB
        • SHA256 7e95cfa242c8fa49902b3ba6093e8f97910e48f46bac90b456d5904722f26af3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jre-1.8\bin\servertool.exe
        • Size 31.1MB
        • SHA256 e22ab060c65d17825fac3edd0233b75f78a8bf7548a4a7b191c67d93fc426164
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 36.9MB
        • SHA256 bfb2d9c1760ee67a43bec200fd040f12ee00726143463136a010885b5ca936c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1800-42-0x0000000000B80000-0x0000000000BA5000-memory.dmp
        Download

        memory/4944-56-0x0000000000700000-0x0000000000725000-memory.dmp
        Download