Overview

overview

8

Static

static

3

2026-05-28...r_.exe

windows10-2004-x64

8

2026-05-28...r_.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    116s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    28/05/2026, 08:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-28_8cc49d7a0fc9b7eb22b7c940abcba2fc_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 13.1MB
  • Sample260528-klmpvsaz3k
  • SHA256 535eb949bf24bfbdf0acbc10575a425ba73ceb9094f1711c9259d8e09b5793b7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-28_8cc49d7a0fc9b7eb22b7c940abcba2fc_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-28_8cc49d7a0fc9b7eb22b7c940abcba2fc_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5136
  • C:\Users\Admin\AppData\Local\Temp\2026-05-28_8cc49d7a0fc9b7eb22b7c940abcba2fc_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-05-28_8cc49d7a0fc9b7eb22b7c940abcba2fc_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3740

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 13.7MB
        • SHA256 c1d9239cfc776ef0c6c5d91b9955333a5fb13695f6810e4a635c2dda689a38e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 26.2MB
        • SHA256 e7974c74fdae93f1318ce844d0c2dd3f5f267e679dc91832d2bf56d576c74ca0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 30.2MB
        • SHA256 b3b1599fb2022816dfdc4dca6e9cafe61e85a47ab426fcab2e85dd4f092ca345
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 26.5MB
        • SHA256 756d5c366fa2023b965d91572fbde22345608b95880435231433778632beaae3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 49.6MB
        • SHA256 6f15324768aa12837a796aac0680c91356205b229e2d99fae879d1881378ae64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 15.2MB
        • SHA256 76cc611839e287870afe4773680cae54e77e19c075c3e48003051b1dc62b06e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 26.2MB
        • SHA256 24c8accc2c44a63c0e9e234e03695fa271cbf4f46c65a033573ffe7993867b6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 32.2MB
        • SHA256 8100cd60ff6baa82182a9782f33cb3e564358a9e2be1a712025cfc089e315637
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 27.8MB
        • SHA256 726860f954323cbed321ba26f32ee3a54bbfff4e1e0de1b338525e2486f28bdf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 29.6MB
        • SHA256 542d53fb7da6c85cb12998aaac9cbc3d54a99e202657c84ef48eab5216171fbe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 28.4MB
        • SHA256 7a508c9d70c3cea83161960783fb7a58719f71558e84ca34bcfb1cbe43c81b10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 27.8MB
        • SHA256 6c16a68360b28dfd6268f6158f63eca7980344950f0a8d798532473141c92619
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 28.0MB
        • SHA256 40c84804951d13e826af385f63ebd674c8d17c5d9a6acaaf453cc76577e3a69f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 29.2MB
        • SHA256 e082f96dca687c0b912808a325abd04ad0908643d4c98aef4e8d2753dc2a55ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 27.6MB
        • SHA256 5db59b14d3399b141bb859b675ce95ddd8b9da6d428419afcc2b406fe5cc31ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 26.2MB
        • SHA256 4885f2c5dadb19f781fdcbd1a412d817f75209942092e6476109bd1bbed38697
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 26.2MB
        • SHA256 d5e8452ffc5f37c5c5f45a132b065809d850edad6f30dbf80e1755c9082440aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 26.2MB
        • SHA256 dd2939ab51dce5179fb33509d51412a4d7c6abea09d37ceb7fd27e82c6362ea0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 26.2MB
        • SHA256 7956e4046aeeef07860b64aed547a854207e488082f06a6f1895aaa077546eca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 26.2MB
        • SHA256 085becedde9ca885a1362c9409b1ce3d3b7dc473c1fb7d3c2b2576d922aac26c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 26.2MB
        • SHA256 d455a44f0b87e2be1aaf187f1e5066e377bc01b0d731ade17393f856f626d7a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 26.2MB
        • SHA256 548373fbe8e5982ec9be66b3b42ae64272585a156367b0e5029325ea3a3d5743
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 26.4MB
        • SHA256 197be4859814765b394058911ed2d1667e89bc7371150e559a05f74c89610ef3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 26.2MB
        • SHA256 c48902dbb09cabff2b746510d2d37f95f31c384a83d7c2f30e593b71e762d784
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 26.2MB
        • SHA256 ae7229f65e41043e3db31df00bf0f0f98054ba81d977ac5bf637c705a9de54d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 26.3MB
        • SHA256 6af2e499ccc2ab149bed8d4701e6203bceb28af01d75d06a2db1a36ee0c28d73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 26.2MB
        • SHA256 1f402e5b7b9539e1547080dc0789431e2aef20e04b5c04ddf982fa65fe6ecc63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 26.2MB
        • SHA256 24b3a2b412e113230674822290974d679bef745a456a1c0a2c60e4263df60130
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 26.3MB
        • SHA256 bc7d9745a184a5128973a8f43a53bd9a479b202b7ff741bfe17b7a932ca0747d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 26.4MB
        • SHA256 d24f935b9d99fc49d8a2573ae3722b4d989b83005a9b7ff854446d1dfc84ce8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 26.6MB
        • SHA256 c5b657e776310369348dea59cae5eb611acb3e038caebc32b3aae0d280a77a82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 26.2MB
        • SHA256 3c3d5f224e04c6cb24a85207dd8f2ce39069049cea3970fbef1c7907678ec39f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 26.2MB
        • SHA256 0aaf5b534641e41cdfb1a2f7afdca3043b180a163425c5a6fcdeeedfcb2cc5a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 26.2MB
        • SHA256 96753ea05d26935cabb1772a3602d305d0b18010b1e83a5a883d4b3109364c13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 26.2MB
        • SHA256 ace7184320fb9683da40a4ee9ec2aa30fc7f9478351236598e8e9601925f4918
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 26.2MB
        • SHA256 55b0c1dbe8025e6ba692ffee29a6eb748ad638f53a3dd93f6237b492474d992d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 26.2MB
        • SHA256 f9ac112da315fb9c18edf4cedfe9dac311bbb963886505741d202e5bdbedeb48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 26.2MB
        • SHA256 8a4e7ab3fc6c9033c85ae4fcfc072266190b0417326702e28d03a8a15714b16e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 26.2MB
        • SHA256 3f8f8ca2cf1693c6e9d9acfd74fec07445f29c68194aa4bb685984b5e0dfc628
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 26.2MB
        • SHA256 acaf2fd177379a1db308eb42ffa00fdbb9bcd09adf462d531a66112abfd3f656
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 26.2MB
        • SHA256 816600cc7a458983bd01ea4eb6bbcfdf0d01857cf9e0897c13fde64b29d6bb23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 26.2MB
        • SHA256 21965587fb7e352c01ecba521a143a05e4af636c6622a0b8d8b8be55da39907f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 26.2MB
        • SHA256 0b1110598cd100aadc4b0cb408a0fae159f3bbf7e2491db63a35cb7b7df327d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 26.2MB
        • SHA256 a52dd000251aceb91b7a05f47ed9e80720e47ceab453b895042176d3e52e474d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 26.2MB
        • SHA256 c9ec0ef136aa5ccd6e8596caf692dbf4a2b1e432b70d0ca8336a1ca42589d9ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 26.2MB
        • SHA256 2174f08c98dc95dfe81a99de6e76ddac84d289b3d6bd0a0f9af70bccc4f2d049
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 26.2MB
        • SHA256 e2576ee485999abf0d889fb9b833013065536657b04829604aa25776ac2d464a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 26.2MB
        • SHA256 1cdc7c791a4ce841ba00c6bb1c4e3c2b9e0313587a6019121a70ac5899d577d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 26.2MB
        • SHA256 452f770b09e9aafc236e565b7b05725c53402c94d2f3b9a2ab3ed5ffc274e076
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 26.2MB
        • SHA256 714c564c81f56b1547af3ecd6566f366c429486c50dcc2dd8dffffbddc95f984
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 26.2MB
        • SHA256 77c68353031f28944dc894e93202258b15c7b306b7a66173aa1d5217380c04da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 26.2MB
        • SHA256 85741e549d827e4428cb4aaa61f3269f59619555afe74ae0afd228ee932bcd8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 26.2MB
        • SHA256 e7429a70d30783712d95dcea683590e1d0e03e106abea2344b8ce39bbb3a8165
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 26.2MB
        • SHA256 145da8cda424c64f98443c308966aecd68b567b2bcb1f7951646dcc77e76bd37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 26.2MB
        • SHA256 72668697eee4fc3817d543091c4b0d857cf8fa0218f73d9a7367f630605817d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 26.2MB
        • SHA256 addcb49404c3e8688465e787a6e578d2f3349e324b2796c6a2f9a0d8a2ec3cd2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 26.2MB
        • SHA256 a74a497776cd0143812a3e941485467d2f41c2b6cea0b9145cee27cd236122e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 26.3MB
        • SHA256 5c47938abb2c22ea38a080cfd29eaa1fefdea538c3bea01c559e295c4397a92a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 26.2MB
        • SHA256 df7fb4672e60cad676da80d996ae1d0537ed64e357c63b20e3ff9f13826e5a58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 26.2MB
        • SHA256 775e7fd50ec131713646e898ce60a9f491182c61587064615e4ceb444f226dac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 26.2MB
        • SHA256 bae7b77ff24b32fa4455bdcd51d19cb9af3cfce2187b66455334f98b9ffa96d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 13.1MB
        • SHA256 535eb949bf24bfbdf0acbc10575a425ba73ceb9094f1711c9259d8e09b5793b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download