Overview

overview

8

Static

static

3

2026-05-24...r_.exe

windows10-2004-x64

8

2026-05-24...r_.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    24/05/2026, 16:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-24_71fafd0c3ee6df8e3412d78f46f4686b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 18.1MB
  • Sample260524-tkcypsaw4m
  • SHA256 ff969b84822b0b0da9dc17e1f17f5f0713b729f35d0277ae9517948cd0b964f9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-24_71fafd0c3ee6df8e3412d78f46f4686b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-24_71fafd0c3ee6df8e3412d78f46f4686b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1916
  • C:\Users\Admin\AppData\Local\Temp\2026-05-24_71fafd0c3ee6df8e3412d78f46f4686b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-05-24_71fafd0c3ee6df8e3412d78f46f4686b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3584

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 18.7MB
        • SHA256 162aa617bbc7fe80f54c86f0da102ef184897d9dd643cd1d4f883ed6e801b7ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 19.1MB
        • SHA256 5f7f6d6cb9020c68afd0bbc23697ce620e3f68215b9c007b3d2a20b554367f0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 18.8MB
        • SHA256 3ae9e95769a83b68ec71acc072a8169ea30ce9afca91cb931b1cb9827fa053dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 36.2MB
        • SHA256 72e642c1999b3cc71660bb2972faed8e5c5785cab3e747dc3fcb5188d51f6524
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 36.5MB
        • SHA256 1f63a4e2f2a72abf764855f09e6207fec2718c46d447f17ec8d156d3cd56ee14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 22.2MB
        • SHA256 99b1e1f666f9c71616bd5286dd0426684af74e4b515007c0179416cc4267340b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 41.6MB
        • SHA256 ed834a9c259fb4472cbbb78673d33bccd0c93db74c518515780558ca14d3eafc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 38.4MB
        • SHA256 63a11ff548d174592fb0cb1feb584afb0ea9a15c59bf1403e3d298243533090f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 18.2MB
        • SHA256 5f37665eefdce1fa22acf277110f3e9631a678258ebac725490649070d4522ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 19.7MB
        • SHA256 2995e54542c1c85f16565782b5a010a68c52c8071f3e00eff550befb8e8762ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 18.1MB
        • SHA256 92054825b76548dd2da0ea72a331cc8bd054802843567942a2a923994b8e37be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 18.1MB
        • SHA256 ac196285e7123bb61a1ed69a773ad7e3b106ca3cf8c5efc10af09f6ddef3459f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 36.3MB
        • SHA256 5b289f175ee332f7ea43127a2e9cfd8480624e9bcda4fd481826803c0c06d38e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 36.3MB
        • SHA256 2f386c7183977d82722953acb087828d4eeb825c0c95314f3a2535b16337cd98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 36.3MB
        • SHA256 9b15a61aaa1185a5edeb431061396620e5e0422eb712c4377144610ed7d1c322
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 36.3MB
        • SHA256 8612193ab087a6a8ea72955d3e8773535d97379fc768ed297b89f0547a314f6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 36.3MB
        • SHA256 5e571638863d9ebf5456157e1d354d6e87b4fabc39488e404509c86c029285c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 36.5MB
        • SHA256 bd41241a8b0730f6ebeab7ad595dcc6d988a3762560d53ae3f85e5c9449dec13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 36.3MB
        • SHA256 8a1dc59262627c1a7c345de27f93bb949740b2c03df30b68a30bf5a419ae75ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 36.3MB
        • SHA256 d678b6854d84be179aab3150f888f67509d04446dd1425e3515b355e7e2eb283
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 36.4MB
        • SHA256 1946dedf03478d2408e5f49d68ace46893b95d4666931e89275f1fb0fabbc50a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 36.3MB
        • SHA256 c7abcaeb2958650d6e0cba56be651fa39f19c973f262a31ae84bc066b00438a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 36.4MB
        • SHA256 32bcb63fa036a58021912ea88c0225449ed5a93bb9fc4b7d2c4dad00f3a97305
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 36.7MB
        • SHA256 b4711fd0ca39fd84d4826672f5d2362ca521366888f8cbc0db060d5fb1e0d154
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 36.3MB
        • SHA256 f4a2af0760becf84b4ae91c1c1ff28a3eaae05dff34edea47351d1904e160b7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 36.3MB
        • SHA256 e32900cddd5f72736e98f02dc5ffdf04983aefa0b984fd8a9c5f526d2632f558
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 36.3MB
        • SHA256 55d3899be1718503b3bcee1ded53b3bae428f2e306f968fe1c11c220df6a50ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 36.3MB
        • SHA256 c234da4bf61d3d89eefc135788e13582377f0f4c0a21560f62db69f7e5257cbe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 36.3MB
        • SHA256 362a5c61b653d4437f5466c66fb488f3fbdc6e75f5437f790d7d1456b370ab5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 36.3MB
        • SHA256 e349079088b42f6efa1fd1016cca0519e00bb78ef4a5b2c53c7b4459ff3b7168
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 36.3MB
        • SHA256 97d84ffca89bbb255e6722da8c582705deb1e2dbdbea93770dafb4bb6f8b68a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 36.3MB
        • SHA256 b6a0b407245ef327e4be4306dbd73c25cf206543cb92ff85bed47f6082da556c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 36.3MB
        • SHA256 f64569aad7c81485d04171e2e24b825ceb8805119ac7fc586828f5f7415bacc2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 36.3MB
        • SHA256 f79bd9b801bbee316ad31976271c2d9f1684b33583471f657b11296ced5108a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 36.3MB
        • SHA256 216892224e1fa195e51c69e121bbd424c7917258b9f047fd77ae7fb99bf52493
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 36.3MB
        • SHA256 6f83fc08aa0d527f68ce46f79dd72b53c2a1326ffad846a42977b7df724acf70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 36.3MB
        • SHA256 f4d568b0d4524145455c9dc5585054ae4218bb12954c42ad1ae137cec9f38f13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 36.3MB
        • SHA256 b1f41aae2b9e75da1862389806f3f012dff337bff387eb478ebac80b1b674179
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 36.3MB
        • SHA256 85810e3ca00c955f272304c954e0d1727bd8208d1ff77ec5e3fed1089c638a5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 36.3MB
        • SHA256 d57fc2fcfcef15819541ac8f743ff9f5785d9634db1bec36114a28db27673aeb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 36.3MB
        • SHA256 9fe5e32e632d6e51ed4f37de45d608acf43c73f4dff62b81c3d92c356a0f55aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 36.3MB
        • SHA256 e93fa7d62c7759a9c4fce59723084992cdb6f34b9f91f3f294fe203dbc594db3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 36.3MB
        • SHA256 a73b45aaa72c51556bb241de151907a1a553a11691c32d08189698825e71e8a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 36.3MB
        • SHA256 bfdeaa7a8228894dae81aa81a9e7ae907f54f80db0e5309c59037cf88fd23085
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 18.1MB
        • SHA256 e440edfb68cd29e51ff88f97c2d560b144e387ba8940b6f010d4b30c4fce5564
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 36.3MB
        • SHA256 878bebf93e7c432def17e2bf318e64e81f9ff8202abdc8cdbd440a77c1e3d6d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 36.3MB
        • SHA256 00d6e00e73c103a494e81c0cff586942ea0d544f02809f8498f1900c3257037a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 36.3MB
        • SHA256 1825991ad47f90e723f6ffc4d15800b2f31153aafea1ee81fd7ddf692e754d9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 36.3MB
        • SHA256 6ec27567be38fb4de36575c3654dcdbc0e2fd6f0d70fc95e20c5ac007dc1567b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 36.3MB
        • SHA256 2a1841039331d8f0942dbe48ecf81dd4233349994d3f374d0b2e4ccd478b1cd1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 36.3MB
        • SHA256 662cc65abbd1c4a7133699c4d2d3f906c9f0138636890f429e4381591982ad91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 36.3MB
        • SHA256 44d79ae49f0052a5e736a406681ea9a39909d8f54f20db5a04d160ed90448925
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 36.4MB
        • SHA256 5f01edde441770d25da2cdaa55c5f49fd73e1e89c0f7b859aca34cd4277523f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 36.3MB
        • SHA256 ddab5e66ac1ea974290586d98581ac0de055fb6681fa9e441bd27be38bbea7bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 36.3MB
        • SHA256 107ba39d806f7e2452d3a131d952ceaddd3744f02cb6d2f26f4efeb64d5dffec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 36.3MB
        • SHA256 3fffc718729d43c9971ec0670df76b812a77e08bdbe1b02d5628f187a40ed449
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 36.3MB
        • SHA256 2925a756707b358feced789182e26e84f93d5045e86f32c7419b634b8fed9775
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 36.3MB
        • SHA256 2321a2666b53aed2d984fc6c9f06750eb27a803e7cc2ca75dbbe88fa158d676a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 36.5MB
        • SHA256 8a55308bcf7816804f867eabc391e3a0464bf32b76005423d7c015f32d0aa011
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 36.3MB
        • SHA256 cb16945e9bc6e917342482499351806fadd28a540e538887a7a4a2fb3d0752a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 18.1MB
        • SHA256 ff969b84822b0b0da9dc17e1f17f5f0713b729f35d0277ae9517948cd0b964f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download