Overview

overview

8

Static

static

3

2026-06-02...r_.exe

windows10-2004-x64

8

2026-06-02...r_.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    98s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    02/06/2026, 01:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-02_52634951b6f5fae6673f252d845046a0_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 29.3MB
  • Sample260602-brfn3aav7x
  • SHA256 2f40ffb96ca33b8dc254db5be265c37752607b557c1f860d5d94fcb7c0496564
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-02_52634951b6f5fae6673f252d845046a0_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-02_52634951b6f5fae6673f252d845046a0_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2128
  • C:\Users\Admin\AppData\Local\Temp\2026-06-02_52634951b6f5fae6673f252d845046a0_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-02_52634951b6f5fae6673f252d845046a0_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:468

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 59.1MB
        • SHA256 fbcaf320bea7194d647068629a6d0a1160d2143df8b12cab111d0123ef12cbb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 59.5MB
        • SHA256 d11569e0ef49c90deb1bcc71c634009a6cd4648070548eaa4ea07b4916d609ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 59.2MB
        • SHA256 6376817dac3f9e4636baf483d36e6982093e28ddb300ff8c2fd6b735b5b24a32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 58.5MB
        • SHA256 072553785ee2f486d9b9a962487e86eb4c3f782eb17d2211d98e3dafcbe21820
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 58.6MB
        • SHA256 670d388a4a5cedf55cc7aa1ad17d115533f010ad018467cb924a7522c642b74d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 62.6MB
        • SHA256 fa8c7c6d3a61aa47aec417827296eb6f85af8b649fc2ffd991adbc66ed867a0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 58.9MB
        • SHA256 a150feebc39d85bf230a6b9daa158b6b24936556060d21edd0a304c2d24ee5ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 60.6MB
        • SHA256 8937252760c2a5f0988970d673eed17850a93403084379acf7450a41769da292
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 58.6MB
        • SHA256 d62dcf597a9c18de239202d9a4e9bc3538c23a5de28f3f0cdb18a0318d35e544
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 64.6MB
        • SHA256 f1285893200aca3ada1974a647883f05c0c39a582f60204a128527cb50b25cde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 62.0MB
        • SHA256 0f1242894bb278d764d2f467185bcbb702a32c124791c9c53745b041c07e1257
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 60.8MB
        • SHA256 96457ccbc6a9bf0678cfd62d8a2b7d970372f876cdab2324b8b0387b83775f0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 60.4MB
        • SHA256 681f4b40a84e331b189dd541d9d8073df2a763e224afb2651ba0622a0dbb467b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 61.6MB
        • SHA256 a4c73d36c31c518d1cf57ad305e37993499bb89a167363508d77ad3c25f15431
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 59.9MB
        • SHA256 592fd6e4e18881af9592335448847e47f2a620a35fbb76547a984c281d06fb25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 58.5MB
        • SHA256 52c005e2f5e4e7fafa283cf18ec685a436eb1496df42024d3114ebbf828444a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 58.5MB
        • SHA256 6228de69e06b83a6cce0bcbd1ed7dd75a57c301477ca3c39fc32cc3552f84fe0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 58.5MB
        • SHA256 12586477dab17b2d6acaf00b8fb866d22b6b1d17a0a8cf94aba6d4182f89e093
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 58.6MB
        • SHA256 9745f0e532cced910d9229bf12c69e74ae51f4c7ce7a8bbada30fec074139c28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 58.5MB
        • SHA256 92b8951db322ccecb5459f561df9780ea4e03e8cdf78922b04a99960e9ae2002
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 58.5MB
        • SHA256 9106d99fce6f52ea7467139bf29cf51a511b72a63051f3cbcb9f80522bdec691
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 58.5MB
        • SHA256 c54ce1c953003586831abf560487067bc81574a18d387ebff1d32f5724cee6df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 58.8MB
        • SHA256 1300ab30d117c3559dd8547177e7631240c297d55e24f794d11baabfa070ea75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 58.5MB
        • SHA256 0a3e334498eb810267bf96cfc46bab8b619271be7a98fa2dce69ce31e285506d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 58.5MB
        • SHA256 dba669886e24193b97baa41b952606750abccb45a9dccf082b85a6a24244d2a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 58.7MB
        • SHA256 77a924373fb71289935208d93b11905d636ab634f6b130f21202778f603b7dfc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 58.5MB
        • SHA256 8a494f2ce9de401840b3a5c83d0771fd54f4bab091d754d43169252942dce26c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 58.5MB
        • SHA256 aba75036f51b44f09af2062e8416f84f9fc30556689c1988c76e8be32b70add4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 58.7MB
        • SHA256 759454b037f8d6306a81f980441b7ddcc7d81770cf93df8d1118207df5248f00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 58.8MB
        • SHA256 d31a216a5667b65d12379d0b08b5f095ebc8eab9915cdf4a3a61b1772ae72d68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 59.0MB
        • SHA256 eb77f2b3e86d1444e26653cd6ac43222f395d49d6ef508016c249250f50b6930
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 58.5MB
        • SHA256 8dc41c6dfa58736fb083031b3c315d3c06027c3dfc23b17e19f9ad92b5d7d6ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 58.5MB
        • SHA256 a8e505f0973cdb6d48c26ec53a54f0f9c74d929ecac98ea3a21c75dc15ddd7c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 58.5MB
        • SHA256 19cbc30b25482ead796f1bdafb2706bcb05f011f3e5b3e03bd99c5cab4795eeb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 58.5MB
        • SHA256 e7279a2bbb4d8faca4acb64c167c346d7bb2ef3bb8fcfabb875d632b21196529
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 58.5MB
        • SHA256 3001cffad8e12e5b81b57ca272a557b9a9094486aaef5ad90c3fcf98550c3253
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 58.5MB
        • SHA256 e9245877dcf9870de1609c5cedda16bc1684533961a7f6ff27c5a961ee22e916
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 58.5MB
        • SHA256 dd9bec86b956aee753a6067d79c2b05738b56b90c2f2348612fe970866a37ced
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 58.5MB
        • SHA256 181517dee7b0f26156be58b3262e081eb2b8366ed82af54dbe73d5c101e0c937
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 58.5MB
        • SHA256 919264fa8743f9ca4df46d2fd7eeabecaabd1ee259ffd882218f24d8053da8a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 58.5MB
        • SHA256 e635bee06edf2dc2dbe5f7cdb9788232db8484a7b49e3008035aa738b56b797f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 58.5MB
        • SHA256 56fc0017b28b43e27cc1b42f2ed0750a64ac18d8e97894224b2f66736fb1727b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 58.5MB
        • SHA256 0f3da816860e80d0d139771789315ea0f3afbd99cdc6bb6e370addf5d815e85d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 58.5MB
        • SHA256 29e7dd16657b76d3975895f48b5cc9b0ac2e939f43191c7b4240cc6f6f3d1b53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 58.5MB
        • SHA256 2e0a0f96ea74d326cef4b599ea48cf7f54e5ace6b162aae228da9668060233c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 58.5MB
        • SHA256 7cd8548dc2b4b8ebc853b59dd65ad029004e0add8061c2184c88ac2929331602
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 58.5MB
        • SHA256 3bc31a7789612a4542983b62065d30b7f866814e86dba852eac2ca1c98d141fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 58.5MB
        • SHA256 4c83adf3d0e76e0ef5fdb94e1f9543e672c851113d8f6f41aa068d151dbc7cff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 58.5MB
        • SHA256 770ee2770f25a92ff3acf2b751ccfd44d9c6b9434f8f15c178d2772f1f8befde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 58.5MB
        • SHA256 293c654e1bc3c0abe336989b958bb04771d7481bf959459735cd616777f1085d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 58.5MB
        • SHA256 bc08731f423b34072c1a341b944b3b87b93992a4f350c6110db3d4050264cd67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 58.7MB
        • SHA256 b918763632c0b89707925b03f699a29252a0ab036bedf276c070692e849475a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 58.6MB
        • SHA256 16a71faa7d97779dec6b1b392ecb08a1bdd8d775556ac291319b48891a1bf7ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 58.6MB
        • SHA256 783dc96dd9a8bc5792c46a19f5a45deb1f8bd2c97a2260e80f22d865a66cc1c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 29.3MB
        • SHA256 2f40ffb96ca33b8dc254db5be265c37752607b557c1f860d5d94fcb7c0496564
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download