Overview

overview

8

Static

static

3

2026-06-01...r_.exe

windows10-2004-x64

8

2026-06-01...r_.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    148s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    01/06/2026, 11:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-01_0584216054c079332b62b5017a15e02c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 11.4MB
  • Sample260601-nlbjdab14m
  • SHA256 dc3bbaae36db2965637739d9b671aca48e37dfa6dd0f4a166d630a8b2e19fe5b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-01_0584216054c079332b62b5017a15e02c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-01_0584216054c079332b62b5017a15e02c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2968
  • C:\Users\Admin\AppData\Local\Temp\2026-06-01_0584216054c079332b62b5017a15e02c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-01_0584216054c079332b62b5017a15e02c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2216

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 12.0MB
        • SHA256 57111892ff3f31bdb2bbd318a31a3184c5f650992ce2e7f8cdabdc5f7a272d4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 12.4MB
        • SHA256 ebddcb3564cbffa0e00fd8bf792f5198196aaab48e0ff4d0868e4a43bff54fa7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 12.1MB
        • SHA256 81a629594dd7006e9e79491632b6cf389d513e8bef17f57a0be4ea394b36f063
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 23.0MB
        • SHA256 2c576513328b09571ab5ce53693d53c46702d12cba13ada5404810646a7c4658
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 28.9MB
        • SHA256 055663b5a374cd72c07bcd4aa438c4a4c872f728ca2b5e371297fc717db5e436
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 24.6MB
        • SHA256 f0817809989f1864ea1b4d5fbab0cebdf19876002a0013196be5d6c4a62aaeb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 26.3MB
        • SHA256 cd9576f88da237a05e0401d3535ca405d3e498c905c6cd0920c3798de0af4c67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 25.1MB
        • SHA256 c45ebbf9cb243c482a716d6aab718309f7996e89acf5489a96716b10e8d6e4a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 24.5MB
        • SHA256 1f12a0aa495d0cf20113fd4d08e60452c897d506353a8440a373ca74511a15e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 24.7MB
        • SHA256 53a693545d5ff72da3be6ac8628e3bfd3ba0b6b24fa2a514c30584af99fa23dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 25.9MB
        • SHA256 90a27373a2d1dc9b589764470f7e0819620db40e1d5e71b51edc44347e676afb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 24.3MB
        • SHA256 a69e662faebd105ae5194c6da4c2894bb53b8cee9cf38e5c3cf63cc9d1f5b516
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 22.9MB
        • SHA256 4f628f4075ba2b14d600acffec3b80d00d47a95db2ddcb84b2563353dc349528
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 22.9MB
        • SHA256 75010f954ea02b559dc1ac45528a368a0b02b0795a1756d39a4003f92d7fc042
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 22.9MB
        • SHA256 34ff460ba59b4f0520100297d4c6d0a6d43041008d4ec698f9d106689f61a521
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 22.9MB
        • SHA256 0ac51987f5551ee5b09fbe59bbd6914ccdaf244c6e78ba57575828f4082244ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 22.9MB
        • SHA256 47adf153882a86f9eda4076d239638b14d0b5c5b2b277897a55726a599a83f29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 22.9MB
        • SHA256 24e6808e1e679b8c6591be352c29141fd83965ed5e8f5f7a27d8122fb127aeec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 23.1MB
        • SHA256 8de13830fdc3a6e511027ff0b76894e61c0054406f84b31b390a7d11c8dca69b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 22.9MB
        • SHA256 911dad4edd8b053acae950f97073e91a643931453c5bd6edb46f9d738d94dbbd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 22.9MB
        • SHA256 6e334a09e13d1a722dd5095a3d612f82ac9830cfe634fa9552357e6fcf98b82c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 23.0MB
        • SHA256 48756f94a9ef3f1791f1d4d8f3fdd35411e7063a0e740988c4d46b67ccd13210
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 22.9MB
        • SHA256 1adbf62e9448dcad46776a5cadbf8be25139d201808ad7992f9ff574599d141a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 11.5MB
        • SHA256 b4ed926e949c3ddf0af7ad5d35c6bb51c214f58d72dab983c2bb1fa044fce331
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 23.0MB
        • SHA256 ee356f12fa52a0087b4c93d9f775f257ffa856df65ac2e88726a553bf40fba0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 23.1MB
        • SHA256 586a1c5dea4e5cf2ded8ac08afa97bada2858b1c66b9e8fd135df764d5df41d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 23.3MB
        • SHA256 fe62837d1e32454b904a0ad77f480cc9561d1eb9cf46a8a39794464d4cada563
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 22.9MB
        • SHA256 98e62d406f32aa5fc2ff81ae6194d7546fb2dbd026f058eeed2ba329c5c6614e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 11.5MB
        • SHA256 eaa91c181ad78c917c49c0e800de879f73fb177b0c34cb7fc2874b4250a6b58c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 22.9MB
        • SHA256 80d231234d508f1a6b14ec9ee84184e370f676ea41baeb79bb56cb76f8868c0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 22.9MB
        • SHA256 798b519535596f86c860901ccef8e56b2ab800a0e2da1f25a01937410c3823fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 22.9MB
        • SHA256 495be64cea56d26ff65e0a019b06d1b983f137a96036f4bf8b6bb00395730b6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 22.9MB
        • SHA256 d5f71bc42e83ee3237777ee536e3ae2b06394b387d36639c3b7de59cc07c84b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 22.9MB
        • SHA256 d82da893e94b670b043064c71b81e6d890e84554e3f0a4017e9476a756264017
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 11.5MB
        • SHA256 b46ab6ce955ace8be8447f71306057796712e5bcf620c02164c59b151db20e54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 22.9MB
        • SHA256 4c019008942df7f1b9a780c55bb249fdf4befcb3d43302efb0a36d5304565985
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 22.9MB
        • SHA256 43e4f82c5f5221fa6adb37b024c09d00e88df41726c7bd19dd9dc4cfabe67f5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 22.9MB
        • SHA256 707af5c41008bcba3186f92f16844ba0f86cb3fc12e4780a5051c439bf55e82b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 22.9MB
        • SHA256 0973b56be8568eac024f5088f0c6a873655a667e0171eac8328607376b3ce51d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 22.9MB
        • SHA256 997c5ab8c85db9c3dc97a7b6c302b62a936dd555fbe59a8dc73075e0358bf20c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 22.9MB
        • SHA256 92ce5799ea90366e9e108240a64374f8ab5414eea5b6ebbb0e452187512ef5a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 22.9MB
        • SHA256 efb6849e9e84ea05f683807ee6d6d77565797340b1f0d8b81c964915b8882d33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 22.9MB
        • SHA256 8a648950b20d7a57e8ce45b6596771ca823ef487482275f66c8369b2eac68c6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 22.9MB
        • SHA256 c51d5b54862470118e07d2fab1895c72a5b1cf238e465467e9a47b19c7f00638
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 22.9MB
        • SHA256 da0ab010379861304f3f6db7bc3ad6ea005f28f6b21190ae969d9aac194e3090
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 22.9MB
        • SHA256 f2235bd27458f98254f9efac6c4718b54b3561138fc5c6e3416e51ca3e8eaec5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 22.9MB
        • SHA256 78ce9e9f0a8cf74289b99004474bc08f407d33ff6f72f2ee06460ea8c485214d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 22.9MB
        • SHA256 75119709ba1148bdd8ee4a02492ea7ce6fb0fe7c687e3647847bb48239af8e81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 22.9MB
        • SHA256 71f0900aa99df33eac72a84dfe68bfde95a35a59907f3fcb166987d4b1760931
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 22.9MB
        • SHA256 48c902e934452836ab488482b9341034a5666c0e8085385611b89e23898c9196
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 22.9MB
        • SHA256 68fc7938e14da46f6eaadc766d46d2c6f2b0092d31114fada997bb5cf90974f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 22.9MB
        • SHA256 b27c6dae966a3cfe7e379c195717d73c7f66b684c1319b163c8906db2cba604c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 22.9MB
        • SHA256 1d75087b23fd0467186372d59bf7dd09126d8b3a47a3bba61deb688c2247b79f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 22.9MB
        • SHA256 220a99cfa0c4d9b1760bd0155a9a89ce6ab0c76c23ec6b3110f1977e0747bdf9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 22.9MB
        • SHA256 52cf33ebc3deb7a48735fa45cd3126a8f65e44c348695d2fd8ffaace50fe5f04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 22.9MB
        • SHA256 455ebd14eeeea9907aa66f854458fe22347e4aad10d1b0a15daa4b20eb6a370b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 23.1MB
        • SHA256 587010199486aa511a51bf6d2df559e23b527245650c654415044e59ca463ace
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 23.0MB
        • SHA256 20893e014ba9516e20870b7e2c2cccd2e1535fc4ea95555911e6b97001062c3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 22.9MB
        • SHA256 cf4ddaa34c48d91ceb6bbcff69cb143d67f3eec076eedaa4f3d1d2393009448a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 22.9MB
        • SHA256 56bb9c57ca8999c2373006b22672ff05d2779251a34d3e4dc82883b7d0388a8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 22.9MB
        • SHA256 e1fc84024e75cfafb42e91530d6697f1aa4f175bffc364b5670937453941c638
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 11.4MB
        • SHA256 dc3bbaae36db2965637739d9b671aca48e37dfa6dd0f4a166d630a8b2e19fe5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download