Overview

overview

8

Static

static

3

2026-05-09...r_.exe

windows10-2004-x64

8

2026-05-09...r_.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    09/05/2026, 22:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-09_61ab3806d4d03381126e75836185d8a6_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 11.0MB
  • Sample260509-2d5ddady7s
  • SHA256 f9022e36d89a715936d71eb572b77871b8d520c975c96d77b21677fc3bc02db9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-09_61ab3806d4d03381126e75836185d8a6_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-09_61ab3806d4d03381126e75836185d8a6_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2716
  • C:\Users\Admin\AppData\Local\Temp\2026-05-09_61ab3806d4d03381126e75836185d8a6_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-05-09_61ab3806d4d03381126e75836185d8a6_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2908

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 23.0MB
        • SHA256 dd46489ab035556dfc4766044a831572e902307bcbdab0ed02b009bf56e364d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 22.8MB
        • SHA256 5f6be325567d3b764da65a275b1655e702c3f317e435d24389b66e78e25f32ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 22.1MB
        • SHA256 a02354a39e0102722016725906dfa0c99763e6bd0d8d76760843275225da171d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 22.4MB
        • SHA256 9f640f85b93a3f60145165ca5a4fc9bbca4ce4dcd3ec1eb487ae68255e68e793
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 22.1MB
        • SHA256 d0eb8714025dba02d9bb1487106de756ad9f67a029b0e8a83c57d83d29c61b10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 26.2MB
        • SHA256 c330dbd142fa6d676240397f9996f535382b0fe0a3ed8ea6e9ad7934df98bf82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 22.4MB
        • SHA256 6c40a1c2afb8790f47d2c3cad710963327d938f8a52606acaad558ecd04db615
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 24.2MB
        • SHA256 aada7a839ab3e47f617734e390515574dc092fa6661bed53a097e65e145869d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 22.2MB
        • SHA256 b310ec63079db922fbb20441e81c6f2c30792153f1313134284b73f45410ce9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 28.1MB
        • SHA256 a2dcc8f42f6e46b98aa72aa3e62b9d1d29bb8c0600b34f46393f154190251ad8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 23.8MB
        • SHA256 a0010509fe2205f7685c91de1414733b6d138b3701269a6edc0971d07f3a37fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 25.5MB
        • SHA256 788eb292ab88ba9fe7f1d5893a5324552b025f5ae42d7c5f663c0e62a5b1745d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 24.4MB
        • SHA256 6de86d65ba82d5b73c8db2173a4d0ecc921b7b5b39e18bdfa5cc60eb897ef412
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 23.7MB
        • SHA256 5ea8c30aa75276e6f9ad23ed0482dba51807f55a462a7670fa80cf7c4a941cce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 23.9MB
        • SHA256 c1edad52532d6b541b202d44281ebc3dd15a8cd062f57096492e08a6e344f368
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 25.2MB
        • SHA256 c9365375be945f7e6570b38c5bffdb8b1244ad15d4dbda2ee54a38fcc007e00a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 23.5MB
        • SHA256 ebf928d86a350b403bb476685fbc5be068b683153879be2ee20040d838cac7d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 22.1MB
        • SHA256 87b2d96ebdb7b8fb0058fdcb25e3c9dc9f864cc886c88930e8c9934142238502
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 22.1MB
        • SHA256 52fa2b3d15b3b1db0b4e58d477182d36b4fa77523382ebc1abb417618454650c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 22.1MB
        • SHA256 df409f9224c65fc7a677f0dec5bef46a46a40b9051efebc591ce1c1fa71a387c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 22.1MB
        • SHA256 9f98275638f12a54f6a315340be759f7012a286c75512797fdcfc438406503ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 22.1MB
        • SHA256 8c1ad5e520e40a821e08b53ba7d9dec1a87e90691a02c07873e68df4cb375d06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 22.1MB
        • SHA256 670d6a27305679e9082c9475f4ba36c4246af5766c7aed9c93e714f5928fffbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 22.1MB
        • SHA256 78cc72ba20d02b03317db26aa286257e0176eee373e6fbcdced0c6e937b9eeb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 22.4MB
        • SHA256 96fb91b37662c1c79ee590e43fd626285e7047c087ccd60f903b2a3a2b4cf24b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 22.1MB
        • SHA256 89979aadf3f12b419abbef1496e0d331d59fd77be3ae98ad1147281fb67f136e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 22.2MB
        • SHA256 aa6e77395273438eddc2126a89819ec60b168ee87ae943b40306b0c2cdd6064d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 22.1MB
        • SHA256 a0e0948f2aa790c7cdc85060bcc53730e3227b50ec4f6dc094c742f03855dfdf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 22.1MB
        • SHA256 a5f6f5deb7ae761e9cf12413b2338524f8617afc5ab706bdf2d131cf28be13ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 22.2MB
        • SHA256 959aeb41501379844a6bc7ad4a01d09dfa45392f1f11a380a151818f4c9f0805
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 22.4MB
        • SHA256 72592dac5445cdc2a2731ad424320fe032a540992053603fddc5f9a2086bf944
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 22.5MB
        • SHA256 7c6b475042a7648d59568458d887a618886537e186c312a291f5292639a15831
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 22.1MB
        • SHA256 fff2b588cecf440e3a77443e14120d8a91ca0c6bce05f21e79dba11f8db910db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 22.1MB
        • SHA256 c9e0251f6d0957b877c40e51ac172bf4ca5ee968331a25d3c86d4c35d29bdea4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 22.1MB
        • SHA256 35170cf40809b4ea1172645719bd5f46b9e1a9b7f7383c0cea0a39fd7272a4ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 22.1MB
        • SHA256 57d6ee6d935b0a7046040836be819b275f15281d136f07accf55b3f2f8095247
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 22.1MB
        • SHA256 83ee5de39fb1560c65732c67ccb2d4c37606dc5956845c6ded8d0bac246ae9a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 22.1MB
        • SHA256 c901e7fc11651d8ef91dff392914297cb6a82ab28058868355ee2395ab26ef1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 22.1MB
        • SHA256 99e6ecc041e398559fd9a47713328056f14b3d2f5587c7ceb7b7ba199654a1f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 22.1MB
        • SHA256 6ccbaca46ab834e69573a172e479c3fa887336ced157654b5886fac3a95e2cf2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 22.1MB
        • SHA256 9fb2716f5ffe4ddb802ac741e10301d9ff7d91fee9e7b70c817308bd276136ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 22.1MB
        • SHA256 6e586089090cecea33de2fa5275a991d6421e145597548a36e2ca13e7e476c2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 22.1MB
        • SHA256 77822934b4375935947888bb2d8dcb51649c09bbe9948fbbf1f239c765968973
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 22.1MB
        • SHA256 965335a5aa4e373c59d0b32586cec7ae432cf654c63eabe36c8fd119f65761b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 22.1MB
        • SHA256 8d3e72f699254427fdc55b5bbe8b9c01425030aad66b5bcd52fb385d45c27817
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 22.1MB
        • SHA256 2f1c3ad23a4e5990b197d5fff8cdb662add32228c76bd1def1f4ec7dbfdc08bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 22.1MB
        • SHA256 3468e3f3704efe76e02679248e44be198c5016a46b7bfd2ce80e327cdd031ef3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 22.1MB
        • SHA256 7660864bc05c929e192cc450a1a7cf71584bfc662d2ccc077b0dbfb4ea841194
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 22.1MB
        • SHA256 001ba74a440b7cccbcdfb9cbf6ae785dd0949e08fb1bce3a8895091bd943308b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 22.1MB
        • SHA256 9c1c606560f3f1b5833add4071a31883412efa4054de6c62398067d5e67fc0a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 22.1MB
        • SHA256 8fb8269ff8fc414a409dd1929373956700e258292dd0347e7822ef89556d84d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 22.1MB
        • SHA256 ddbd2c7a77a3aa2bb55058540a4ed504e96ddf6339d46ff094b58e4c32d205b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 22.1MB
        • SHA256 7cac6a67f225fd743ba8c1da12af71f716c24d0ea92ba19b1ceda28e1a1a86d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 22.1MB
        • SHA256 cce93e6cb497d6dc15d54728bd1f5e1a3e65c8d0c391e19062a73f7b694eeb75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 22.2MB
        • SHA256 077ab1aeb7d8ec35f6f463c4e8dd0420d4557b8b7702c6b39222f56ede650091
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 22.1MB
        • SHA256 b2f18fa8b25f4c48e5eb8a0412d63e834eb196e6a44083373a962182d1078702
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 22.2MB
        • SHA256 ba60ae144b4fff6f1143e92ea94169c7a15dfe8ed92929d0c46177dedbfa8675
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 22.1MB
        • SHA256 52cff15503bd7de17aabba355931a809bf1c2337082a3d1c6e9d3d8d3a957bba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 11.0MB
        • SHA256 f9022e36d89a715936d71eb572b77871b8d520c975c96d77b21677fc3bc02db9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2716-210-0x00000000024B0000-0x000000000258A000-memory.dmp
        Download

        memory/2908-250-0x00000000022F0000-0x00000000023CA000-memory.dmp
        Download