Overview

overview

8

Static

static

3

2026-05-31...r_.exe

windows10-2004-x64

8

2026-05-31...r_.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    146s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    31/05/2026, 19:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-31_529c94555241a37c042f7c8f6be323da_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 6.1MB
  • Sample260531-xpharsev5x
  • SHA256 954ef725dd1f13295911172a3b003bd256d9d8197b83d7923ddbe125c74269e5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-31_529c94555241a37c042f7c8f6be323da_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-31_529c94555241a37c042f7c8f6be323da_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4200
  • C:\Users\Admin\AppData\Local\Temp\2026-05-31_529c94555241a37c042f7c8f6be323da_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-05-31_529c94555241a37c042f7c8f6be323da_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3332

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 6.8MB
        • SHA256 24283603dd8bf366ff1d1448f73cbd1bd37d8b7c25e3466191889320983ffa8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 6.1MB
        • SHA256 5412678e7add369632f7729db49d3227f18a0aadcd5a43ac91ef5d5be7cd21cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 6.4MB
        • SHA256 a20951aabccb26db5c0d34bcb956b5c8bb2af811bd88fd8370c61d01ec313cc1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 29.6MB
        • SHA256 dbaca58fccb4ab7badf73abff3b5e99d2b1511630c6c5b62e4f32af18727b2a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 18.2MB
        • SHA256 5679f80ec87c22879d74da85f557be2c67be99b4ab0917e758f19ca3f7074991
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 13.9MB
        • SHA256 c63f9196e946033d4d767b030358c7175cb04351050b9e35b4ca6cec3d4e8866
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 15.6MB
        • SHA256 629459eb1c0064a9333d833b8d6df2b26ec721e4466f9ac7a5751be8fd4b188c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 14.4MB
        • SHA256 926562f077f9532fa0348b788a86762e006901cc86c523f5dee912fc6eeba697
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 13.8MB
        • SHA256 b22eadd7d5af7de7eb07fdda331d19a15808eaa6a14fb7679eabc8a7a8a7dfe2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 14.0MB
        • SHA256 a6d44f5ce69814a8425927534a66c1fbc9b98e3dba1020cab8d88c369fb37d2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 15.2MB
        • SHA256 6e241dc2e6601b3f4be59b1624da6970fd607b4775caa367546def9ac228cecd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 13.6MB
        • SHA256 c289b189b071e5e0fed87b85eea35f0a13dc8fcf1ea9926e1120b9d52378505f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 12.2MB
        • SHA256 be9b949ab8c2098786c93e63cf7d8ea83c0f65e45cc62bc07b6e1b550355e5b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 12.2MB
        • SHA256 fd1c899ea5a68a84cb34b19653f17282aef04f4bd6879aa047d765c92c2d90e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 12.2MB
        • SHA256 402b963fb77721615ba94c567d7950dc081381c02a5506efc2ff7dd27ec02a50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 12.2MB
        • SHA256 5342845953d2d0088a83e107360fd909578ba7b3a712e217fb29ce2fd73ad56c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 12.2MB
        • SHA256 b3aea277794a928e83f0dc7e694492654008b3b3e22daec5282cc76b77d80768
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 12.2MB
        • SHA256 11b792e44907108445ee4823ab31ce2620d00be99d48c80ed3a1bc3ba2548790
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 12.2MB
        • SHA256 25ce76c9cfbaa1206e0bc1b07a373dd6213663ea4134ab44512ebeb157345bde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 12.4MB
        • SHA256 8802a92edbf8c2a02a2f35f97a84c3e57a46a1d3dd4441f247565de79f52675a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 12.2MB
        • SHA256 d34d06b4bf183dadaa3432c2fb20ea59b96260f4d3094815361872296109b6c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 12.2MB
        • SHA256 cbf9178d0277f75037e42ada4a8e4350010a651717296e88dce7881138e433d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 12.3MB
        • SHA256 eaa1d67504cae3ed5f9c1a3f6f7642c13dd84a975118c58fdda3060d6d0b83ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 12.2MB
        • SHA256 bd4f65391f38f2deb7afe24ecf70917c97a6c1e50fadfad7347d36d70cd221b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 12.2MB
        • SHA256 368d11dbc26111ece2d46d7a70d72c01871e54340575a0d24e1d2f1d7a406dd2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 12.3MB
        • SHA256 cfbe9e598dce6da9b039defdbc583b85271fe859ad9a5de03a812252b74cd4bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 12.4MB
        • SHA256 febf923ca621ce388d4041bb73ac5540ca4019dc4bb8e27480e1e90b1d7374c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 12.6MB
        • SHA256 e73292c8ccd4be5d13d4bec327fa1185aa5842e285537cd471be15beab854d6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 12.2MB
        • SHA256 2d62eba2458a87f6c04c08c98e1852311d7cf3d711d4f5143fa9728efc30b8fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 12.2MB
        • SHA256 24ccc2861a82b8c6199271f68ac28b701f5eeefa619b1dae90ab17a2bac185f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 12.2MB
        • SHA256 7021593743d53ce2213906a09903454c1164b25b88c3cdb787ba952c6a14545f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 12.2MB
        • SHA256 40f557d84336a39ddf5b903002e44e6e8fc572c1c800ad35ebe39c747391216c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 12.2MB
        • SHA256 d74d81c9b5d51553e2e1b7a7477c6ce2647e9924d7aee9b030a0e75c5e5f6eab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 12.2MB
        • SHA256 6c1ad97d23097a4086641cc03913afe388e3d39eef50a7eefdf365ec043a35b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 12.2MB
        • SHA256 6b8d380ff28874849dc3cd3fb0928bce25a78744b374db84f2a141e51da2309a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 12.2MB
        • SHA256 8185dba6446e5974cbc807828a2dd96537c0c07277530d85e051d0cc67785b15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 12.2MB
        • SHA256 531d6b430f62eeb5ee63787f59a2f79f763b27102dd86de2b3817124bd30ba74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 12.2MB
        • SHA256 e16251960e7517b2a5025f90f427f26d95d55d64ea34d2b862b8d3a552f7fa00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 12.2MB
        • SHA256 dd4159becc06e68435a458aaf66f2da1a1330d2b0bf5d743d6b39ab17ea3e9cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 12.2MB
        • SHA256 e6b95594bf4653cc8a32780620768143651ba07e66b1768982723ebcd3c68b36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 12.2MB
        • SHA256 eb1187cc9ee35f95e55bb601cf25f9036be1f62fc06d39715f07c78a1088bbc9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 12.2MB
        • SHA256 b9ad0c0da67ffce51ebf319de63e213d6a071a935ef6b06ca00721bc6133b87e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 12.2MB
        • SHA256 a8643b71da4c2bc2cce18c30dd223d98cc42861ce0c3d1596c81cf17eeedb547
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 12.2MB
        • SHA256 f2245e586da076c4d2aa86b76f2211a9a06b615fdf8c241751f27442af3898d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 12.2MB
        • SHA256 4fdd7b49f63d09e546604bfe40aa5de6832dee4097dada0ffa9415a6cdf7f9e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 12.2MB
        • SHA256 6a39bd9863558dfdf686c3b3ab0a0dd7fd520fb10547f6bba1d7bc6f21c8ac3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 12.2MB
        • SHA256 37f6ba2fc67450fcfb637adb0a4a315add8f6a3062880f873a4a546c60e5556b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 12.2MB
        • SHA256 a7a48680bd2bae901fef3d1cac01b9e1ed277317603fa5ea761ee32a39f1ace7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 12.2MB
        • SHA256 bd4012adb76c6f6361ab255138eb4445354810111118201cb54f8ad394cb622d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 12.2MB
        • SHA256 352b2bf7b2c01b4710b0b17c7680fcafde8c08a0e36e4ddd0b272c9965ce947a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 12.2MB
        • SHA256 90fd6270c132ce95d154ee0d7e95f51a1acd1ff684cdf4c65a74900ff66b4b22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 12.2MB
        • SHA256 7780506a54be89023f008b9424d6a9d93754ef994483af698e1913e3c69c687f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 12.2MB
        • SHA256 4409c9f814e762ea347619152a9099ff18e10d3cfda29c9000e7277d65117772
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 12.2MB
        • SHA256 2ce8138a7aedca2f2b382b335729fce1a4ab752e0668adc1fa61d94c019d776d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 12.2MB
        • SHA256 8b191c0af4741ca8bce3d593d5596103ad1db42c7542314b6a1f975c4daae583
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 12.2MB
        • SHA256 4d1e9561fb5e5ce4f12e32807285990c81d9631486be603ca50aff050986721a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 12.2MB
        • SHA256 fd8327c95af3d1699ee790e3cc84af81c35a2f8ef663e9af2628cf0beb35d339
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 12.4MB
        • SHA256 bd6117dcd6fcff6f2f0444370dfc2f778e73eda5c14b6449f2f7224e31876112
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 12.2MB
        • SHA256 57ea34b957600d65db4a7157f4acc88bd0e5ec35e428f9cc43a6b7c06a57411b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 12.2MB
        • SHA256 473f845d806e6632f4313a6f7bbdae8f43c3c405dda9bc594f3491622098b436
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 12.2MB
        • SHA256 f3bd73825f0f3efe1b2fc4ac1d8d845883bdac80dfe3e4ac15b80560a8c51843
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 12.2MB
        • SHA256 70bee614275d0d2d4da0bfdf83b865441b64b2007f13cbd9cc238936b92a0be2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 6.1MB
        • SHA256 954ef725dd1f13295911172a3b003bd256d9d8197b83d7923ddbe125c74269e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3332-252-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4200-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4200-143-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download