Overview

overview

8

Static

static

3

2026-06-02...r_.exe

windows10-2004-x64

8

2026-06-02...r_.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    02/06/2026, 02:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-02_fc4cc054c35c80b1f3237937135a9717_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 5.0MB
  • Sample260602-c3asmadt4q
  • SHA256 92da86257627e9006f5c3654df13afdae5682c42be938f320e1028b674d855a9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-02_fc4cc054c35c80b1f3237937135a9717_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-02_fc4cc054c35c80b1f3237937135a9717_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2664
  • C:\Users\Admin\AppData\Local\Temp\2026-06-02_fc4cc054c35c80b1f3237937135a9717_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-02_fc4cc054c35c80b1f3237937135a9717_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2940

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 10.5MB
        • SHA256 19c804d39b41d52f4da83a28d8224d4ed8ec47dec9a3e31a343dc1023d58d1d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 10.9MB
        • SHA256 d17286790f66081d210386bc74bfe8aef080e18c24be111147901f2da57a34a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 10.7MB
        • SHA256 5d6018d3968503b17164ec662190be26ae3e686437522ef930249fa1e5098d5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 10.0MB
        • SHA256 ca59096e3417f97e974278a252c5ea77fc6f47970686caf064316577108c45bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 10.3MB
        • SHA256 6084a9728bfae9d8a41660b08775080c5faf04d15d2976f18f389f1b0a7076da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 10.1MB
        • SHA256 2b2a7296570239daf4489f75e8ddc62f8bfeebc4e054d62642062406019a9239
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 14.1MB
        • SHA256 7be80cac252c0a36f0a38b52d8dd4cbd2372f2217cccd12fabfa342ddfeb21e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 10.4MB
        • SHA256 906b4fab1de33545c6abdca4322a8378afa264d2f5c9b9aba6f39492087e405e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 12.1MB
        • SHA256 92908973d68e11a1c9e637376bd121cc31025e23cbeabf8db810d989cf025201
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 10.1MB
        • SHA256 031448649a876fe6468ff0c1ff53d9c8857270994af382916cee6cfade046bb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 16.1MB
        • SHA256 fe894b4929050ec5de8aa307a81e56909ae81a43c87495f7cf1081e8fca3b3f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 11.7MB
        • SHA256 b3d4743170fbcf67abf2f7eed29b9c2409abf4d17d3fcff270eb255d2928dd92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 13.5MB
        • SHA256 7cb47a2dda12cf6547f29329e9b8998b950458a6f6de207153c58bc429e2da59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 12.3MB
        • SHA256 606013439a663f8695698eed4a09fe56a6b64cc0f45b01c6071d2cea8baef6bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 11.6MB
        • SHA256 308e99ab92357781e407402313145118798afa2ca588288d01d76eb7c3f7b7cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 11.9MB
        • SHA256 0c3daabfcd97d271a6fc9ad5b0ade0a82c184ca0979d62b57dafe87cea9984e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 13.1MB
        • SHA256 b9d5bce0085d969835e076075c5ccea0c71bc4c82a4b56122c45d34e8617a256
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 11.4MB
        • SHA256 3b6238992f602e616ef697745ebb3cf38bd05cec95e0d284882a3d9fa81ca69f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 10.0MB
        • SHA256 5c42b854d7f334221c650443476d7ee7bb9334efff8942734db2b4c53ff85c91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 10.0MB
        • SHA256 d0abdc6e66479e7252baaddff428a55fbbcb8d634811f1b33efddff71f8cecc2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 10.0MB
        • SHA256 56b3178d43615323ffaa807176a453c8205e78f4849f036c2eebdc64fd1aaf8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 10.1MB
        • SHA256 610869af3c67e3c8e1e03688143d1a2f4bf11dd1baa35b24dca5f63d6dd0ac68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 10.0MB
        • SHA256 f188113aa2e08eb390a764e7c5592a1318af0eb2a1fcc9321be35deefbd1223c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 10.0MB
        • SHA256 7851a9bdb8ea30c15930bbfa19a37f708954ca879b94faad8834bcedbab9267a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 10.0MB
        • SHA256 8382861d728b8fc2ab95c7371d8fb61e1a552f6bc60996e55d8fb1244ff89935
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 10.3MB
        • SHA256 a5a4d1bc7eca24af828dae01e4da000f1b6da6c8bc8e84df851683f3592c6c1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 10.0MB
        • SHA256 0bda400ca9546d790957a6726b0572f1f00b1584666ea00695ad3ba279849e94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 10.0MB
        • SHA256 f5b77127867148f3770568663c2fa4cf931001a880aec8711eb27a664b076a3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 10.2MB
        • SHA256 c0ef1765dc24d7423845d88c6ec554764140144c0694fba2ca67cba64fcf1d44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 10.0MB
        • SHA256 96f2e29fc111b6e707a97717bbd4841276e1600a83a1352234163a5b9b5cf04b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 10.0MB
        • SHA256 11cb707c0d993787ab4623721fc855508b914e580c7caa6e6cd94b7c877c4e04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 10.2MB
        • SHA256 f7299aa9ab8ad7f5df1ac3eab01c30ebd0ed92400c863f54f15f99b69b737953
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 10.3MB
        • SHA256 f07ede82b8d1e6d11f108eb1202f53deb9277cefe84a755b09b19e75d693df32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 10.5MB
        • SHA256 95c7786a4b90486ffa578c0dc376d6f2f2cb498f17f5759e9867b5061d1a6ea8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 10.0MB
        • SHA256 8669bebf17a4d3d2bea281daa35f56ed0f579a9133302746c22314da4c0978c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 10.0MB
        • SHA256 1fd9662b41f1a3376a873044faa44c1b4e090d4a0303eeeceb99c6e2ea9cdbf7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 10.0MB
        • SHA256 4a97a988f33ced93932dd3b6e2fb6a614af20dafc0071bf5dd1946b705fd3044
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 10.0MB
        • SHA256 654a884957b56bb5f4f9f1857a8f542ad7a5c571838f16f2b550fb35843ddede
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 10.0MB
        • SHA256 ea0e99b6522a33fe3179d39ac01ef73cde8a46ea6e7c5306733c7be51be4a18e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 10.0MB
        • SHA256 e01d0ba50c6a440afa90005118e08dd28c3f455e88767596207a0576a452ef58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 10.0MB
        • SHA256 459e8a0b4f29df79e4e9db2b4fb90fd857f5d0d8edc2207d2e9a94c8bd66c453
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 10.0MB
        • SHA256 1651928d69617ffaab455a19bfdd552463604555e063423879e09d8d00954491
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 10.0MB
        • SHA256 e2b4d1b7c9c58763f5febd8c60893d0729e0276365e57e53a560afab3d46bf62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 10.0MB
        • SHA256 0813431b0fc498024079ed8b004452a3bcd48ff71b10493c07a3d8ae4fa1100b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 10.0MB
        • SHA256 c2cf6a16c0551d8dd5e3670afaea6f3bfda951a2e7bd5e35458dc09a9cd1f923
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 10.0MB
        • SHA256 03aa9706a56192d723b662ce59308f1d4b45d7329037f9ce2f7ed85be2aca594
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 10.0MB
        • SHA256 42f086ba1836452b42d15c84ddbf6a0c21e03ff7be5935866ffef8f0ce1c1237
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 10.0MB
        • SHA256 8c62fc08ce3d4742fdc76dd8801e3091aae06e3fbc13e0155ad5f59c5f57051c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 10.0MB
        • SHA256 5c0ec35a3ba2223c733cee6646a1dc788a78829f6996f0d2aad9b761db7caacc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 10.0MB
        • SHA256 796629858732045c2e70b8c4f48a85acba7ae3009026855d39b603a17c28308e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 10.0MB
        • SHA256 68568f7e9a15384248795116f913cc8524ed9f2f439b54f4a4b266d84d9ebe36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 10.0MB
        • SHA256 8b25a33dae597bd7cd051beacd40e637e142cb94a34398d37bea9939ef211408
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 10.0MB
        • SHA256 9ccda428a33e38c9dfd7ee8195555d07075c8537013f5218e92665a12cab6ea9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 10.0MB
        • SHA256 7c8f6e3b18f4803a3c67ea18e00ef0b8a24ad6df376f6e6eac7ac1c0ba2f3211
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 10.0MB
        • SHA256 b1498a6bb49b1f15375e8bcafc609de810212e86d6c6555100ff9b27a35d3b4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 10.0MB
        • SHA256 e7a9af65f3b365792a054ef98f03851ca8fcd38b2f182f7a1884eed3612112b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 10.0MB
        • SHA256 479e033dca47fc47660046f7a85d0e7f10e9a68b6f6754dab00707522d98227c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 10.1MB
        • SHA256 f6ce7fd0d33b0718a0b617285db44e4b430dc6bd6f71b8b190c9863ac7b5c9ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 10.1MB
        • SHA256 c2ef439d0e0434ed26e0220b237aa5c570b74f659c85842b3e18ae81f7e22ea5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 10.1MB
        • SHA256 c3f38d887563c2ec8c679b3326a9b14a49ecab9a18e75cf385640a70daf52fcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 5.0MB
        • SHA256 92da86257627e9006f5c3654df13afdae5682c42be938f320e1028b674d855a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2664-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2664-375-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2940-449-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download