Overview

overview

8

Static

static

3

2026-05-31...r_.exe

windows10-2004-x64

8

2026-05-31...r_.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    95s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    31/05/2026, 08:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-31_04861c9fd87f37493d840508f63048ad_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 22.9MB
  • Sample260531-krnjcaft3n
  • SHA256 a7e9fffa7f008ac2e95bd0753036b50d0f061695fcfdb5bd9a55bd9ee4663a8b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-31_04861c9fd87f37493d840508f63048ad_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-31_04861c9fd87f37493d840508f63048ad_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3964
  • C:\Users\Admin\AppData\Local\Temp\2026-05-31_04861c9fd87f37493d840508f63048ad_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-05-31_04861c9fd87f37493d840508f63048ad_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5800

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 23.6MB
        • SHA256 6b80b160aaf62c14df491b6e0fd86dda71e8177f1046d0ce8364572f9e9cb6a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 23.2MB
        • SHA256 9624fd93747aab6f2e7998f2b63ba48cb7e88a15841eb788a9944994fe7044f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 24.6MB
        • SHA256 90f5d2654ff6b368d772892999b5ca783b98d7bd5740da70d171b1bfe1f218f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 23.0MB
        • SHA256 7bf23e8519c31c8ce76e6d1e51fb4a0779676480c767df3c9f376ea7a07bc8f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 23.0MB
        • SHA256 4623fc1175c142b0ba971ca6c5e2cd81c645711cd89db8076432ebe22b4f4343
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 23.0MB
        • SHA256 dda981fe111a4d2f2a5d285b2a956b38145ac159c3bbd9ea549ecbe18798597c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 45.9MB
        • SHA256 a080193a3863f5dbae591202db8b4e44dae3cafc23dbf5692ae6b21bc47aa748
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 45.9MB
        • SHA256 05af4d678cac65c0543b405c800942e4cd4e35ea52987ec841092564716d2f5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 46.0MB
        • SHA256 7d4ae927bddd80c9fbcf140536b3213a898f386bcbf094c97a48e4e1fe6ed37d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 45.9MB
        • SHA256 76944578201e103495dbc6fa413993f632998d4bde6c76ce10ea450487c47980
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 45.9MB
        • SHA256 6b091fc9aa270e25d6b2d649780ed5f3fa42d99d648cccf0ac75b1485cf61c51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 46.0MB
        • SHA256 d78a85395f289ef8a81704e9e78abc1f57b0ede641b728ad8d227491f3b8fc0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 46.1MB
        • SHA256 12a98f5b17079e7f6bc5fcd26bbb304fe707380812942dc40dd01216c7d159a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 46.3MB
        • SHA256 8c9ea92c047e53511580bbf3540925192145260886b55352bdbdda4051f53681
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 45.9MB
        • SHA256 a9195705fa0f6521a8ceece8bb229cf90a436f2fb649a13a5e9a350c3e772ae4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 45.9MB
        • SHA256 edb8ab2196190cc16affc0a3952950126be50b92e22569907a353b1317241655
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 45.9MB
        • SHA256 1a516713e04e10a049c09f4902acd7faf5fd231cf6b819f2a232384e45c1deac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 45.9MB
        • SHA256 a39d26cc644c248e508b597f246519591b522c50ff1ba0bd50c24003293a7931
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 45.9MB
        • SHA256 a183aa8188062b577b6bb814a04eb4577272dd86bb9606481d34dfdc28d268a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 45.9MB
        • SHA256 249a33478907d98bea38bddfaaa98eac54e4a304dee9720c7e0738d85eaca33b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 45.9MB
        • SHA256 80627c398bc883edddf6bf933da1490d4ca694b650d6edcff91a65517f434f3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 45.9MB
        • SHA256 d3b7465b46f65ca2b7764dc7b2a5091552cb005fec2c42de06f272f509a6e36b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 45.9MB
        • SHA256 1896273de1a2c71ed4f0788bdebb7ea00fbd369f4e206380a5c7fe0b9be760f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 45.9MB
        • SHA256 b435b2b1099973b5218a4262904f98ce3ea1d085b0163fea1f76052fa17242c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 45.9MB
        • SHA256 77e11080c7c6f7bbf6ad614683967d0f825e8b183547e6c9152c7fae5a81eadc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 45.9MB
        • SHA256 ad3cdde48b29798bf017ea32392e8d73fe057d0c2dcc27ab4609d0f2c57d3adf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 45.9MB
        • SHA256 96814d13d6481a3105caecd23c2d1e1b8c9fc8157f49521f2842c77173dfa0b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 45.9MB
        • SHA256 ebc0e7dd777868c946d77c79346daef6ede8118d7eec6588a77bc10886f34747
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 45.9MB
        • SHA256 519804bda6c7501b5da0c3c1efaf8bfd2a3249881ec523a7a8d59ddf5eb5ce6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 45.9MB
        • SHA256 b02b37398a0c8ee1793512c8ccccacc3a7d59ba59709ed11f8fa1641b5282201
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 45.9MB
        • SHA256 d0d1d2b1f0c4f1c4c3d83e74a8b4f7d3f58601cb1ccf9409d153d2aefdc16a7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 45.9MB
        • SHA256 573fe3cd526350d9cfb29110d40a0f0cb7c1b9459e243d5a4da8282a6c218fda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 45.9MB
        • SHA256 a039427c9db7c2970229ac3cc0abd94d83e10eb3c48ac667d4db65b136c32e86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 45.9MB
        • SHA256 fa6662beea31d3be06e313a7cb7973caeac0f68bc733cd8272902fe84e6c06a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 45.9MB
        • SHA256 43c3291c1232de15ab516cf3a90d56a06ac86d419f111ca16f162cec3023ccfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 45.9MB
        • SHA256 098b58fc108a794a1900451d738ce393083a2a5f6536a07a5d86e7835ca694f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 45.9MB
        • SHA256 ced1a4652ea88efdf3d1002fa4d7de263ac8b07d8879105e34e202018655199d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 45.9MB
        • SHA256 90baf06b0d744f6e22e812dbdaf5d3a0ffee5a26971b48480b635230ed4567bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 45.9MB
        • SHA256 a52c3d5e2787b8217b5a39a187b5ca9a2e07d12097f11d0ff0639fc92e4f345f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 45.9MB
        • SHA256 08a905d351ad78929322d903921c488abcd4c9d6fd0c59f439dc14ce64e61f64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 46.1MB
        • SHA256 4eb1f59e5a3446647ba8a27e36eba43437178d68514842c3f5aadfaa1924110c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 45.9MB
        • SHA256 95c847911ae6cfbea225139eb357f740b6cefb8383e672e9c364f82eeabd2443
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 45.9MB
        • SHA256 0c1f8b881ae3e3a97fe9213ec9449232992cab6c878017a5d9337df74c4ede73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 45.9MB
        • SHA256 7bcc21c222afff098c486a8e311c735006796de451cdbaad5781c58e7785af29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 45.9MB
        • SHA256 ebe4ef9d71cef267bdf1c973940de908d626390c53eee573300691d806032f57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 46.1MB
        • SHA256 d6bc600faf75d183815ac3150222369eb8a8daeaf926b9628e776a55d66e0c32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 46.1MB
        • SHA256 5c44cfac451b234c17429a080d54539576dad88bb9a2e2354621d35d33364687
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 46.3MB
        • SHA256 613fa098b09b657671cbb30093dcd5d9acb306062255d02dce090fcad5497883
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
        • Size 45.9MB
        • SHA256 673e32df7cc41a5918781b47696d0bbb6ace05b185d1d2de04aac0bad1d3c8c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
        • Size 46.0MB
        • SHA256 884884ca0b341398ddb8c1af6274ce63079b062a64265d831f05d9a066b3b713
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
        • Size 45.9MB
        • SHA256 e2c7600eb8c95188be7d47cde588e19c6d33b7a9d35f1669279c3aa147acc2ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
        • Size 45.9MB
        • SHA256 8ef08ce67efe2bd2f6b1fb71ad01faf0d73aef53ad60a702648d4c006ffae0cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
        • Size 45.9MB
        • SHA256 f86c9707bb19e96ee1f9c6a07d2b6f368a828f2e35f526fc0a38b338940d94f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
        • Size 45.9MB
        • SHA256 afdc428f3528dff424bec43e98257f304158b888aebe84fe4d5621c469795807
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 23.0MB
        • SHA256 ef1753670593d609f5765e234e258d21ea6b9274348ff4af6f691b31fabb5a5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 22.9MB
        • SHA256 a7e9fffa7f008ac2e95bd0753036b50d0f061695fcfdb5bd9a55bd9ee4663a8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download