Overview

overview

8

Static

static

3

2026-06-02...r_.exe

windows10-2004-x64

8

2026-06-02...r_.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    92s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    02/06/2026, 03:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-02_eaa89630fd49ce635e9ee62c9ead95dd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 7.6MB
  • Sample260602-d698bsc17v
  • SHA256 88033aa899177450e6823b76806c066a96ea71a971cd7b736059f1a1cc44518b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-02_eaa89630fd49ce635e9ee62c9ead95dd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-02_eaa89630fd49ce635e9ee62c9ead95dd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:984
  • C:\Users\Admin\AppData\Local\Temp\2026-06-02_eaa89630fd49ce635e9ee62c9ead95dd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-02_eaa89630fd49ce635e9ee62c9ead95dd_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3300

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 15.6MB
        • SHA256 7960077562226bf7a320a6ca4299ca16e102b47180d0edb9c354670c6bc32a90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 16.1MB
        • SHA256 b119f4dc17975dff9716a981fb8833f4bdf349726242ad6ccaa304a27b2b2f10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 15.8MB
        • SHA256 a26085a39e885c5240df85d4cc0775ee36b8107f7886dc4304c2c40712734f91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 8.2MB
        • SHA256 2719ee912d348a480570d70ab9f8f563d58d1238ce7a83edb436dabcff568ede
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 15.1MB
        • SHA256 f9786cc99374761f00c81efc7f96856fcb7677527da36bff2f72e77d83fa1f40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 15.4MB
        • SHA256 13e17949244e3ae5343ae9d8885d5d223d0af643ff290383786b97d411a62e73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 15.2MB
        • SHA256 e5902b2d7f841d976fdfc8ad55591acbf2f993e98d9fa6c06c1a4ebf1fc9d76f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 19.2MB
        • SHA256 95553190a64e96e783eb4ec48a4cb34a31d87876fdb8a9c754da18ee8673ed81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 15.5MB
        • SHA256 1f0637b1739c76954b3136499b92b650e8589c0758255c1632f704bc3d593734
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 38.6MB
        • SHA256 c7f21b3a4bea8a0adfd8829ddd16bc8fb027078024853e3538cf11d5b6ae9df2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 17.2MB
        • SHA256 0a19f0d70e64b9eb67a51267953c71fad5615cf0296264234f432e86416949b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 15.2MB
        • SHA256 5795ce06ee8c086ebe9f25476fb3ce384366b4ab9fdf894d575df2fd376127fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 21.2MB
        • SHA256 99e4ae40e1b9244df62761a5d927b3de005602c8eb88594e193d289dc39c366c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 16.8MB
        • SHA256 ec3f16e64ed729872d672debde721ca3985c7bce9a3f7f24cf94d33f644007c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 18.6MB
        • SHA256 8c0a7597e2b034a3a5a90d2c73584a7dc4a97451ddf4140630d15e922f1fedfd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 17.4MB
        • SHA256 bd734169c06f6183768d6d0824ecdb25d07faba3deddac39b0a0bc30f525e96e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 16.7MB
        • SHA256 2f6a2a48b7b8492bd74f72c2a84d08bd1cdc99194734e51f68701ff78d2cfe10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 17.0MB
        • SHA256 ef8b2f77f841cd099f166be7a92cafed8e87ad73fca97fb38331e9b1f7597b81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 18.2MB
        • SHA256 96b6342a586a5b65846f6c7d4faf864764131d6a4ff34dfc81bc91e2eecde1d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 16.5MB
        • SHA256 3ff0ee4046136581c0340b9a463dad6b48f86461610b95b258d69fdc09a3c693
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 15.1MB
        • SHA256 13255acf1173aeb0ae332b265fdf869b294f47a050e92b7dcfe5b911de9bb755
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 15.1MB
        • SHA256 8d2a59d502af196011fffe823b643a9e920accd2cb2910651a639d592ae54c06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 15.2MB
        • SHA256 02abd807ceadc42cd4d2c049f49529baba0f734f4e7b590b00b8b2b872a26b67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 15.1MB
        • SHA256 e594b71a69a14d946990510085a82d211d40e1b3dac29e1658341c6d3a0a37b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 15.1MB
        • SHA256 d5a6b568dbbb732bb6afe9e30366f53f8f3c37b62b1e8140baaef8807291fe73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 15.1MB
        • SHA256 fe528055c78a81c4b9561e0138e4e20325d1a8fe38b3b0ce3614f3d7de781c17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 15.4MB
        • SHA256 7b6ca13e4d787dfa93a1acdcb73915a1ddf8c18cd81cac9af0cf7119d70f990a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 15.1MB
        • SHA256 38396b2659809d127263cabf5b9cf29d13b0e79c61bc39cc4d5b52ff763da7a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 15.1MB
        • SHA256 42d02a2e78bef5a8fc2aedad46e1ebfe23e267484bbd161d45ff3d9f85dcd0a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 15.3MB
        • SHA256 d5b2026aacecebeed1cc3d5fe504ada14d93ad0a20a31022eb09c330e1a4b3d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 15.1MB
        • SHA256 66f670da6bb012b3916f19f0571b542763486d116b702e322d6459870efba155
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 15.1MB
        • SHA256 70ab0b0b5b09173a8ece50be6cbd92d9baad511eb6f6f11be9eeb11fc2a059d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 15.3MB
        • SHA256 78833fdd337bb3901f50223e5c50b7ff721333ccd6bbbafc9b95ef99ede6e351
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 15.4MB
        • SHA256 92ff5bd8dd07ad74e459a755116ede4ebe94222f8007d5770c897e4ce0d56179
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 15.6MB
        • SHA256 cf7f189b234dabc996315af84b2f09e88cc47aa59100466a10fbfb22c8acd65e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 15.1MB
        • SHA256 e5281b2892f2e51544350fc12a95ad73966db22599d07520b99acfd05d838452
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 15.1MB
        • SHA256 fcf8273b10f7082781358a1ffeca1fa323537648b65f916b89ff9a092d56ecd1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 15.1MB
        • SHA256 9f8188882c878c5363dc8cb5e63efc98cc6d75945bdad46c76024f5efbe64996
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 15.1MB
        • SHA256 4ce132c8e3c002011e9e9a4bffd2d0814c26aca9ef2ee84399ec2622e4912889
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 15.1MB
        • SHA256 256f7553bec1ea999e8610e10d5aff01c52a6c536da642d42ef9f8e0985eea90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 15.1MB
        • SHA256 f291edf49afee7d3c3f1d51480b1a8738ea6d08c435e2becedcfa12dd35e40e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 15.1MB
        • SHA256 d22f9798286d77a2ff5f7b504e850d2dc5717e895d69e9785475625526b6a8c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 15.1MB
        • SHA256 44a79d4fbc1dccfef681b46224047e5b4a81990927d161b0bb58a985dc14ce9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 15.1MB
        • SHA256 1a582ed1d746d15de23a4aadb765881af15bfba4d450456b595336d56012a367
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 15.1MB
        • SHA256 9c61c119bca70964910a6c1c6d01506cce56e6caf1abced48872f2946467bc36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 15.1MB
        • SHA256 ee92ad3d53d0d6f5090d6caacf0c16a3fc6e0f8a3f4af26c1b7d0460c29be30d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 15.1MB
        • SHA256 7d27715013952b49c7b1e61e5fe3612c33fc99718f2886fcf99b935d81419602
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 15.1MB
        • SHA256 d602c7bc81b45e91b1ce2774bf9d7107a9018dd3c6fea6cee5bc0fc4df9ab7c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 15.1MB
        • SHA256 7585c976d5e12abd7299072c2e818707414fd78154028ec96ab3470d510d3ed6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 15.1MB
        • SHA256 3dca93d1f5fcaa8542fe7581531159493fbe0b163b749c0c14e8a6c5b4a11c27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 15.1MB
        • SHA256 689f0820ecd7bdb7d870b0b7cde284cb71e1c622b5993bbd57a792e632cd8e01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 15.1MB
        • SHA256 e84a6bd5fd4a7f07a4d37e8810fa08939d1b6cd45db75d3825e73aa736d7f59e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 15.1MB
        • SHA256 d365b93d145f9e7a72ccd805223a2859c0e02a615300d1f742ab3bab97bc7f6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 15.1MB
        • SHA256 71069950df8ae799728dca7ac156f232fda358f2f58234b9d0127f7d3d5901a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 15.1MB
        • SHA256 5d61f13be2f8b451fc1a2ac29ee8f06b0f25c1f8c7f18863bd9e287e56775c74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 15.1MB
        • SHA256 96aada251deaccf24de27f1eaa6ad13e306439e22595d8779f7401f34852b784
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 15.1MB
        • SHA256 4bbf46dffb2bfe18b09bcfac8a4df5ec662f6cd047952958c4220c874c537119
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 15.1MB
        • SHA256 b374f9c56b5b634fe60acf1b43766241178265bb94b5deb87d77076265d85b99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 15.3MB
        • SHA256 ceb54bab9b95af4327d8660edbb0881e3601617fe5272fb38a2d3b3b5c8283d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 15.2MB
        • SHA256 98fe89295c7d30096d113fe047c0c6208f7027e1e4b5accb1e7e2db7fe68c94a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 15.2MB
        • SHA256 26c4875054d55cfbab093b2a56a49d481f12fd83324c7f94f2067b78fd56f3c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 15.2MB
        • SHA256 3392b6de5cfe77cd5885bfc4aa5ccd64ee204fe3259f10351803eb0e547d7cfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 7.6MB
        • SHA256 88033aa899177450e6823b76806c066a96ea71a971cd7b736059f1a1cc44518b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download