Overview

overview

8

Static

static

3

2026-06-02...r_.exe

windows10-2004-x64

8

2026-06-02...r_.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    148s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    02/06/2026, 00:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-02_0c94efc9748820e4da36e2300e587851_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 12.0MB
  • Sample260602-a7ftbsbv9q
  • SHA256 57111892ff3f31bdb2bbd318a31a3184c5f650992ce2e7f8cdabdc5f7a272d4c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-02_0c94efc9748820e4da36e2300e587851_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-02_0c94efc9748820e4da36e2300e587851_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2632
  • C:\Users\Admin\AppData\Local\Temp\2026-06-02_0c94efc9748820e4da36e2300e587851_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-02_0c94efc9748820e4da36e2300e587851_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:800

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 24.5MB
        • SHA256 67112b9b66714598da0acfd96f816a886b7ba93983936443df8a8880aec3ad45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 24.9MB
        • SHA256 8c72b4078498abb97678d17e80db562b4607d9c6f4a07f100f4f8613db45a9f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 24.6MB
        • SHA256 27753da61dc1fabf5dc012e6cda890441beabe0f9715407831a98a285154a329
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 24.0MB
        • SHA256 858ed9f4d96a5287bf9242b2ae427da94f3154cb2cb716c0c890477816fd012d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 24.2MB
        • SHA256 76d199e3a2b584997b4bac4d87322a9997766c82528f06aa39e30f97f64a2dbe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 24.0MB
        • SHA256 9895dbfdd6a9f7993a3b1f2f8e74e601ca4b7170f833cde802c9eb3d9e16d45d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 28.0MB
        • SHA256 6b1dcc792fd06cb2ebe8bab6cd8511b47ea2e22360b04d226060db86fdf4d176
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 24.3MB
        • SHA256 88ef14b9fa12a48c4ed7430a805a4056ac7eb2b096ff291ab1067763b9455909
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 47.4MB
        • SHA256 8f644a3b9857757fa3ecda82d35fee3250a1be29c8d5723767ef465da4459443
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 24.0MB
        • SHA256 0e085c18b3d5120cd1f75a2f178b359dcb7ca6fa241281f20b5f1d12f4c3ceb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 30.0MB
        • SHA256 e27d1335e82f8266207d06338e02c03a68ce8a4de8f931ce34b049c6b3fca84b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 25.7MB
        • SHA256 7e9c76d1e98e013f7b69b6b9a26a281dc068a9d99af53fea0371d9414ef04f25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 27.4MB
        • SHA256 d942a3762acede62aa356a600c09ccae9208576359626201a4d5d9b4d3c2b82e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 14.2MB
        • SHA256 2290b276f2a4d759108f59c74e0d5365f1edc1a95d840a26fe271882cd91b56e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 25.6MB
        • SHA256 bfbcab1c5209e46559e629c8d863a1c11f25688ea5fcfac077e44474507e3d9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 25.8MB
        • SHA256 6c44e4a60c8eadc1570748db4e445eee74d90d37d5b0741226ec4485394d6cea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 25.4MB
        • SHA256 76d029edf72f8aa9618b0e67a61947eaa904756755d77af87eb45d9c8e757132
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 24.0MB
        • SHA256 ee0642928cb2f7cce69c5400ded7245044687b12faf9e14b1d3fd22d0c8de1d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 24.0MB
        • SHA256 533faa61a592c7e5ea6a38f1e65a482db1778a70effe869b2784b7e30bbbcd80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 24.0MB
        • SHA256 fc6b7d1c4e716a7e83d97e6d0a82dfc59b63a3de388d829ae872b580f7ffd172
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 24.0MB
        • SHA256 7c7bc80e127c90bac5eb5a4d6be5b667e8c42eef241facdacf046746bb65bfb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 24.0MB
        • SHA256 9f27d4b8945a49bcd178103fceddbeda22586a4e15bbb68c468fd104b2e02db0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 24.0MB
        • SHA256 2ab82762f62760908bfe47a5ca0c3d5f475c1cb4ab145ee0b22ef05c3f56f983
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 24.0MB
        • SHA256 e3ae9dafc788fad4fb9e76ee27f88de25afb37ed016d6ee1e4b75c6c3f3ebc7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 24.2MB
        • SHA256 25196f49580e8a9b04ad1e61f6b6f4b62643ccf4cb748c120db8a162c5416bd7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 24.0MB
        • SHA256 5a71be7da41e3b3522cbe73e770cac01c18abc94400e16b25ff07465bb1a1d3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 24.0MB
        • SHA256 fd63e29b1ad9b86f33041cdba466a40ccc403ce868b338cb462ce57b13f8bc2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 24.1MB
        • SHA256 edd36b87c6cc978a8c4abf895d41bc5e0322975592b0d5b84e5beb8867796f73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 24.0MB
        • SHA256 e3bec48cb2a255f59c70a547e81f245a73a446bc1a1d6adf0031bae8d9c829e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 24.0MB
        • SHA256 f9bc7be6e6c06d8b371ae83a1e2a61bf5b0f198f6087b616e045791e2a4d37fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 24.1MB
        • SHA256 da76efd050292ea7cd1e2f2bbdc83cd450d998d654513087b98d42e3d5de913d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 24.2MB
        • SHA256 907e3bc1f39cc41d528a83180c3b26f215bfccb3c8e0842a6cbaee88c3da6ef4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 24.4MB
        • SHA256 d3a17317d480e8999516a9e55275e8831490fc513947635283a5d5de7c720844
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 24.0MB
        • SHA256 cc5a813f8494d30d2016f06dd46e858580e731ffcad70f539981cdee4406bdc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 24.0MB
        • SHA256 312e1e852bfc70e94c6446b71e38aba7482de5bfb8f2ddde8562764b5780763e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 24.0MB
        • SHA256 333f9278dc8d60eefe7dd4c087ebf05a8d60c08e748a914ed6f0edc1ee7f2766
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 24.0MB
        • SHA256 1b9e371751d484b62ba96b82ae2fa939eb0a42bec2ff8ff553d64b36978f615b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 24.0MB
        • SHA256 f38dba9691f643abca2d87790afbfb823ab6c0cf247044153359187e071bde56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 24.0MB
        • SHA256 86d4f1c4a5dcdb7bc128f9a8d5dfa4842d691b333854ac1d535862bab6ee24b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 24.0MB
        • SHA256 ff9c702ed6dbc42fd42264e8b58ee5b56696a0992844146ee4c0ff59a09ef0e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 24.0MB
        • SHA256 3525fe15d558ba659c4238b929aa40a45ffc4058c6b95baabc5ed0a745118192
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 24.0MB
        • SHA256 dac6596de7beb94fff0e6b8ba711d57e1f8fdab8cc602778686b24bf041edb76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 24.0MB
        • SHA256 c78a6ab8aab53b056d01f89f99277d7cb10357b01795c7968bfc4f44ec19bc32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 24.0MB
        • SHA256 1f44a5b287a9afa8231ea06bec969ede74c02c0738c61762ec51e508a79d4a11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 24.0MB
        • SHA256 979a41e2ec91a3821492bf82030de78c619de3c024aefac13ab79e565ba740df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 24.0MB
        • SHA256 028dd125500ca0340162f235258e629165ea1e88ada27a56d8dd792c27d6bb3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 24.0MB
        • SHA256 43c7b24adaf49713b8d242c2b56c9acfa60fc7e0fceb165c9824c1704e175f3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 24.0MB
        • SHA256 a56609a7430546719706f82fa4876489090737799b8d1154ddad00f8ef4fd6fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 24.0MB
        • SHA256 f637d2996d967bd84e92191eb71ad1a15adddaed4ec29e35bb7bfc8849edd275
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 24.0MB
        • SHA256 f5f4380b8b9d99eee6ec969ea781e03608714b4f3ef6f006658014146461b535
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 24.0MB
        • SHA256 779c83116af9b850fc407ade27f449b51ecb4a87cf0286ea8717e6b8af07f3c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 24.0MB
        • SHA256 caf2731d8ad0da1e6a7d4a64bd3f40788a2fa868cfc8766d97582b741766232e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 24.0MB
        • SHA256 2f020477fef063260a5456a145eae647bc552c3262fd7c43d672ce3012a1ce28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 24.0MB
        • SHA256 ae78edbecfdb89fb3444391e11f038ad3af2f81112131ee6b2d1d8ebafbf02b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 24.0MB
        • SHA256 9518517dc041464184b2c7fd8f1f7894fa55415dbeb0e0d20efc5ca611edfea2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 24.0MB
        • SHA256 9a5c4e2deb86e209e7829c072b6c2de9ce8aa4667f74402c83da3ffd53bc528b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 24.1MB
        • SHA256 056a4563d7fba7e00f53b05493e3ca580333ea434adccf255e3e0f29796641e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 24.0MB
        • SHA256 4886208968344f3fb9c7a7793b05f63b875a0e0b3a1ef5f6f4378744dac233a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 24.0MB
        • SHA256 13fc9d852d66402e49b378f4922b51258483840a40c266171b66eca1b16c2b94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 24.0MB
        • SHA256 6877f9d4403ccde200bc5bdeba65b8d2065d8ae9c337bcb3a482f6daf2d16c9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 12.0MB
        • SHA256 57111892ff3f31bdb2bbd318a31a3184c5f650992ce2e7f8cdabdc5f7a272d4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download