Overview

overview

8

Static

static

3

2026-05-07...ij.exe

windows10-2004-x64

8

2026-05-07...ij.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    98s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    07/05/2026, 11:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-07_bc38c21267ea6570ef1ef725ea6b570c_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe
  • Size 20.8MB
  • Sample260507-njgmlscz21
  • SHA256 2e295fba52ffc6f5d0b417d2f2ced22f3c9875e2fd8ea7170f2d6f8050b6d57e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_bc38c21267ea6570ef1ef725ea6b570c_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_bc38c21267ea6570ef1ef725ea6b570c_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3328
  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_bc38c21267ea6570ef1ef725ea6b570c_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe
    C:\Users\Admin\AppData\Local\Temp/2026-05-07_bc38c21267ea6570ef1ef725ea6b570c_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4928

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 42.2MB
        • SHA256 ee3a5ed9daa136347735b5c82a5a81f3d3b88b4ec982c92a9bb196d235625309
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 42.6MB
        • SHA256 d2b8f3f7a9e4d20f6b9893d54f49a010198dd364780985cbf08e7d2c42e31166
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 42.4MB
        • SHA256 9879bc47fb7a87517c646e5033aaef00251f9c1c1535af6b4e4fc96ae0d97255
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 41.7MB
        • SHA256 85c5133bd12244fd9fb400fb3aa661e7d1e0c0f673a6e83abce4a553171e0f90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 42.0MB
        • SHA256 620c9952a8660c17e35ee7e13518f42dd89c8372c913056321d9a7ee07855112
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 45.8MB
        • SHA256 18fa79f3deb3ac614e06793e40692e21d25126edf30e1122f299bea322891aee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 42.0MB
        • SHA256 f2dca53f28424e77e4121cb7a330997e29ba6222712a068e8448833aa090ac8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 65.2MB
        • SHA256 2b42317b086579bbc60c3c25d4a5fe35bd8f7bc22ebd05d9a7de1921f50b141d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 43.8MB
        • SHA256 a22d25518b3ca1dcbb29bb078b332fad49bd05cf0c94f5aa1153f482e6305e71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 41.8MB
        • SHA256 fae853625ee080c24457bd6f9bd35d7460a6bf4f7f76e96de95226641d871535
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DenyDisconnect.asp
        • Path C:\Program Files\DenyDisconnect.asp
        • Size 42.3MB
        • SHA256 8c590341419d13e3fd635a777292074858fbc829dbdf793670aa599794c65500
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 47.8MB
        • SHA256 ef777ba542db906f330894ff4ff7089e5d74afc646e8596ce38fc806e4894642
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 43.4MB
        • SHA256 8c2a49d2c31bac1e9e0f4b419039d719507fa33851316182337ed58c4bf50847
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 44.0MB
        • SHA256 dd8ba8b2691da7ea1e9789122569642e46ab0a8dbc7310fdcabeb734f146b73e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 43.5MB
        • SHA256 33b35997bd3965df91c9e46866e6df95d5c976361463ea1b4ccfd65acf8ffb4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 44.8MB
        • SHA256 653f8ec3d8c9cea79b8e2658fc294fcdb811cf34f9b0ccddddd1b1098a972179
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 43.1MB
        • SHA256 fbff7641d3b1aff2fb25f56a3c42de1bb67dee4eafccf69c81a9525bb27afbe2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 41.7MB
        • SHA256 fe9ae392aee649a670a7adbb0e39650a5f7e3db93123ed5176bd3552b72469c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 41.7MB
        • SHA256 d496ab31f4329733e50b6bdca459f988ac5876b604b53875018cd7eccd76c965
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 41.7MB
        • SHA256 bc0844ed9a8cc42af40237f4005d8a044c557768b57fbfee22fac49f84891bb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 41.7MB
        • SHA256 4ccd6424d0bae185e0add48ef7fd852a0f6b44a0cde0db1ced3f45e403363c84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 41.7MB
        • SHA256 1176d069a5f9c238e54199f5e62e841797d6e31d8352f5b44c407b40720bf9e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 41.7MB
        • SHA256 ce0e9c63eef0ef0b4a34f485cac926dc4351765e9672dbefa9f1e60599e6f471
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 41.7MB
        • SHA256 0e718ba969ccde4561c8afd4cb8b6c2453799db3ef23c4052e294fab1cb60e6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 42.0MB
        • SHA256 11bb5c6483b658aa2b1040efb5e44e624fae7b10922983c258596d7675743d62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 41.7MB
        • SHA256 5a8f8537a3e8d50273291743ae92ca256b96684a72a5544f8792eb64c6c0d06c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 41.7MB
        • SHA256 d9bdf9d4d168fd55112b1ab18f2ced0dff15a17af33b17f6b647a87f2cb50cb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 41.9MB
        • SHA256 1540629d38fca2280a7ad45a1aabcfb00f648d861f13fdbee42fbc17e1ac05ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 41.7MB
        • SHA256 693f83fc928c202b2cc82701beed52018df008486692468ce8a9c24cee1fe6eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 41.7MB
        • SHA256 971c3c44c4b5aed7de51fcfc4a77c72826f8ac6d61a951d7d2d997a0f743d271
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 41.9MB
        • SHA256 1d9a223ef9223ebebc92bade5267b1840e7b03cb2c85e0a493da2d0e6988eb00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 42.1MB
        • SHA256 95eb1ff1eb445de6150eed23221b81661fd219596d0040a83fcefb72f9b95ace
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 41.7MB
        • SHA256 1b2f8659d00037ade0c838dc0e72ee7a0807dabc9d1aaee7ee0b4cd6846ba461
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 41.7MB
        • SHA256 61c871c40f975c86d3fd96f1ae19cf43c3f8f52d2b8f987e40a7da16bb1bf687
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 41.7MB
        • SHA256 f7dfb6188129da4a6e8d1b8c910feff98bafb30b0a16761a618e37264f4e4b17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 41.7MB
        • SHA256 f1af6e52d192a05cd3ab29469738f38a275f01518cdca2bada93bc6238bc845c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 41.7MB
        • SHA256 f2f5731c4e7c4322903d07d3d640deb96eb1528bf588be5a3e819f3e451d122c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 41.7MB
        • SHA256 079af13d0e6d74051623eb21214a7548e0d84b79df051c95222a1aaf38de45d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 41.7MB
        • SHA256 f08fe432e2d08aa5f9869f516098a6d80bd556a7986b042a941c3d7a01b0e43c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 41.7MB
        • SHA256 d4b7245865544e96a96f644a29a95de074520506c83bb053d1b7470889a39dfe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 41.7MB
        • SHA256 af4d07f9b71269ce12d119a5279b0f78df48262145335fa28d325e17f9cd9814
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 41.7MB
        • SHA256 d38c1c2f0bc9a77e951cdd36a4974c375c06d8685f84f9424249a5ba87c7ae7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 41.7MB
        • SHA256 405888830fd1ba6a403579ef0014f03ab25968181bd5e55bbb91ab01002c9c0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 41.7MB
        • SHA256 ec05d93a8509cff76d51d8a3c8de69573dfa890312929e33a840957456ab74b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 41.7MB
        • SHA256 ef6501a0ef0a83492f90fae8523ce08f4f6e8ebe28bceb3697c112b6b22d36b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 41.7MB
        • SHA256 be1da8b0415c456c68affe316b7915ed0818c99fc17b29f68d0e151ad000a98b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 41.7MB
        • SHA256 37bd1d0d4101be1a45e37a78df54f562d7c5d2cd6e9e909fff5ab1a54bb316af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 41.7MB
        • SHA256 494faa9ad259d024d4ca52db7aeb93770607ef43649adee58cb7fe9efd72d3b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 41.7MB
        • SHA256 58aec2ab0735a7b3d89984e011aed65d9a71be13969171c3a5fa10c92cb0c294
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 41.7MB
        • SHA256 36692d34b1dce6874e32d59863fff32f2d72d98406f7c5b4abed5cb67be27012
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 41.8MB
        • SHA256 0e4d579704989e259f3db72890f9fe52f9b03eefdf5de9a125de29691d69936c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 41.7MB
        • SHA256 759c6c97e4c3317730659648bb9b4c02f4ab264070657199d5377a0a71147c82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 41.8MB
        • SHA256 9920c5414bb90cbdddacb47c15c9210180c5c3d123a499d9c327872385686ed9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 20.8MB
        • SHA256 2e295fba52ffc6f5d0b417d2f2ced22f3c9875e2fd8ea7170f2d6f8050b6d57e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3328-68-0x0000000000B70000-0x0000000000C31000-memory.dmp
        Download

        memory/4928-84-0x0000000000920000-0x00000000009E1000-memory.dmp
        Download