Overview

overview

8

Static

static

3

2026-05-24...r_.exe

windows10-2004-x64

8

2026-05-24...r_.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    24/05/2026, 16:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-24_71fafd0c3ee6df8e3412d78f46f4686b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 18.1MB
  • Sample260524-tkcypsaw4m
  • SHA256 ff969b84822b0b0da9dc17e1f17f5f0713b729f35d0277ae9517948cd0b964f9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-24_71fafd0c3ee6df8e3412d78f46f4686b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-24_71fafd0c3ee6df8e3412d78f46f4686b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2456
  • C:\Users\Admin\AppData\Local\Temp\2026-05-24_71fafd0c3ee6df8e3412d78f46f4686b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-05-24_71fafd0c3ee6df8e3412d78f46f4686b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2520

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 18.8MB
        • SHA256 3ae9e95769a83b68ec71acc072a8169ea30ce9afca91cb931b1cb9827fa053dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 18.2MB
        • SHA256 5f37665eefdce1fa22acf277110f3e9631a678258ebac725490649070d4522ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 24.2MB
        • SHA256 4d3b0cea57ebcec336cf378953cbd03818aeac528fbea4c66b7eb542db10d2c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 21.6MB
        • SHA256 ab655629b852a1dec93ce571309515629ab40664e45ed7426d2ab4b928da393c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 20.0MB
        • SHA256 521fab173042e22180373a0fa329c97ec9c3c23ce6f86d128509fe0467ce09c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 19.5MB
        • SHA256 bb51c0851e9a572698b8641da92b0d51a2bf8eff3fd0f3a618089af445d139fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 36.3MB
        • SHA256 f1d4e94b0fbdc7b2715241a08cb9b4836732935ee0b303131965e6033c713908
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 36.3MB
        • SHA256 4472bd80047210559a5ff68678501e086ab73e6e1c3728ea13d49e2e039eb405
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 36.3MB
        • SHA256 5b289f175ee332f7ea43127a2e9cfd8480624e9bcda4fd481826803c0c06d38e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 36.3MB
        • SHA256 2f386c7183977d82722953acb087828d4eeb825c0c95314f3a2535b16337cd98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 36.3MB
        • SHA256 9b15a61aaa1185a5edeb431061396620e5e0422eb712c4377144610ed7d1c322
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 36.3MB
        • SHA256 8612193ab087a6a8ea72955d3e8773535d97379fc768ed297b89f0547a314f6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 36.3MB
        • SHA256 5e571638863d9ebf5456157e1d354d6e87b4fabc39488e404509c86c029285c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 36.5MB
        • SHA256 bd41241a8b0730f6ebeab7ad595dcc6d988a3762560d53ae3f85e5c9449dec13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 36.3MB
        • SHA256 8a1dc59262627c1a7c345de27f93bb949740b2c03df30b68a30bf5a419ae75ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 36.3MB
        • SHA256 d678b6854d84be179aab3150f888f67509d04446dd1425e3515b355e7e2eb283
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 36.4MB
        • SHA256 1946dedf03478d2408e5f49d68ace46893b95d4666931e89275f1fb0fabbc50a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 36.3MB
        • SHA256 c7abcaeb2958650d6e0cba56be651fa39f19c973f262a31ae84bc066b00438a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 36.3MB
        • SHA256 c642c001e032c47847190acd7fa4e830fe6ff2ecb2538f5652de7d458614198c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 36.4MB
        • SHA256 32bcb63fa036a58021912ea88c0225449ed5a93bb9fc4b7d2c4dad00f3a97305
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 36.5MB
        • SHA256 e3c0d67ad306473a3ccdd1441130d902cf66da3276eff8ca8f0e7b20c24e67ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 36.7MB
        • SHA256 b4711fd0ca39fd84d4826672f5d2362ca521366888f8cbc0db060d5fb1e0d154
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 36.3MB
        • SHA256 f4a2af0760becf84b4ae91c1c1ff28a3eaae05dff34edea47351d1904e160b7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 36.3MB
        • SHA256 e32900cddd5f72736e98f02dc5ffdf04983aefa0b984fd8a9c5f526d2632f558
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 64KB
        • SHA256 79a0b1f3b0958e830806c9254c2ba2af079ac99713004febcc3610200c9f504e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 36.3MB
        • SHA256 c234da4bf61d3d89eefc135788e13582377f0f4c0a21560f62db69f7e5257cbe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 36.3MB
        • SHA256 362a5c61b653d4437f5466c66fb488f3fbdc6e75f5437f790d7d1456b370ab5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 36.3MB
        • SHA256 e349079088b42f6efa1fd1016cca0519e00bb78ef4a5b2c53c7b4459ff3b7168
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 36.3MB
        • SHA256 97d84ffca89bbb255e6722da8c582705deb1e2dbdbea93770dafb4bb6f8b68a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 36.3MB
        • SHA256 b6a0b407245ef327e4be4306dbd73c25cf206543cb92ff85bed47f6082da556c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 36.3MB
        • SHA256 f64569aad7c81485d04171e2e24b825ceb8805119ac7fc586828f5f7415bacc2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 36.3MB
        • SHA256 f79bd9b801bbee316ad31976271c2d9f1684b33583471f657b11296ced5108a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 36.3MB
        • SHA256 216892224e1fa195e51c69e121bbd424c7917258b9f047fd77ae7fb99bf52493
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 36.3MB
        • SHA256 6f83fc08aa0d527f68ce46f79dd72b53c2a1326ffad846a42977b7df724acf70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 36.3MB
        • SHA256 f4d568b0d4524145455c9dc5585054ae4218bb12954c42ad1ae137cec9f38f13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 36.3MB
        • SHA256 b1f41aae2b9e75da1862389806f3f012dff337bff387eb478ebac80b1b674179
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 36.3MB
        • SHA256 85810e3ca00c955f272304c954e0d1727bd8208d1ff77ec5e3fed1089c638a5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 36.3MB
        • SHA256 d57fc2fcfcef15819541ac8f743ff9f5785d9634db1bec36114a28db27673aeb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 36.3MB
        • SHA256 9fe5e32e632d6e51ed4f37de45d608acf43c73f4dff62b81c3d92c356a0f55aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 36.3MB
        • SHA256 e93fa7d62c7759a9c4fce59723084992cdb6f34b9f91f3f294fe203dbc594db3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 36.3MB
        • SHA256 a73b45aaa72c51556bb241de151907a1a553a11691c32d08189698825e71e8a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 36.3MB
        • SHA256 bfdeaa7a8228894dae81aa81a9e7ae907f54f80db0e5309c59037cf88fd23085
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 36.3MB
        • SHA256 b250fede58c80f60c564a6c25a5308e25e9ab67e0016f943e1e0809576c02b42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 36.3MB
        • SHA256 6acecb2b25a5a680676d1c70e54f25b22d2e13791cac99edb859fc0c5cee9001
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 36.3MB
        • SHA256 878bebf93e7c432def17e2bf318e64e81f9ff8202abdc8cdbd440a77c1e3d6d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 36.3MB
        • SHA256 00d6e00e73c103a494e81c0cff586942ea0d544f02809f8498f1900c3257037a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 36.3MB
        • SHA256 1825991ad47f90e723f6ffc4d15800b2f31153aafea1ee81fd7ddf692e754d9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 36.3MB
        • SHA256 6ec27567be38fb4de36575c3654dcdbc0e2fd6f0d70fc95e20c5ac007dc1567b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 36.3MB
        • SHA256 2a1841039331d8f0942dbe48ecf81dd4233349994d3f374d0b2e4ccd478b1cd1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 36.3MB
        • SHA256 662cc65abbd1c4a7133699c4d2d3f906c9f0138636890f429e4381591982ad91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 36.3MB
        • SHA256 44d79ae49f0052a5e736a406681ea9a39909d8f54f20db5a04d160ed90448925
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 36.4MB
        • SHA256 5f01edde441770d25da2cdaa55c5f49fd73e1e89c0f7b859aca34cd4277523f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 36.3MB
        • SHA256 ddab5e66ac1ea974290586d98581ac0de055fb6681fa9e441bd27be38bbea7bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 36.3MB
        • SHA256 107ba39d806f7e2452d3a131d952ceaddd3744f02cb6d2f26f4efeb64d5dffec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 36.3MB
        • SHA256 3fffc718729d43c9971ec0670df76b812a77e08bdbe1b02d5628f187a40ed449
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 36.3MB
        • SHA256 2925a756707b358feced789182e26e84f93d5045e86f32c7419b634b8fed9775
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 36.3MB
        • SHA256 2321a2666b53aed2d984fc6c9f06750eb27a803e7cc2ca75dbbe88fa158d676a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 18.2MB
        • SHA256 0a1f54896a614eae7d43347a159dac83d63143afff85c5770ed375139d269cc3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 18.2MB
        • SHA256 5d22a3d37c90c4384212ef5c27f36d2e8033cab8909f2a62b4b87d7ef1745411
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 18.1MB
        • SHA256 ff969b84822b0b0da9dc17e1f17f5f0713b729f35d0277ae9517948cd0b964f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download