Overview

overview

8

Static

static

3

2026-06-03...r_.exe

windows10-2004-x64

8

2026-06-03...r_.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    03/06/2026, 05:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-03_ac1e3a2633cb37a5714332ea3c9c6a5c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 30.6MB
  • Sample260603-fxbphshw21
  • SHA256 af0358383efee2768bb2b42eb1228a582e148a97bbf1f0cdc225235075a1e6aa
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-03_ac1e3a2633cb37a5714332ea3c9c6a5c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-03_ac1e3a2633cb37a5714332ea3c9c6a5c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1036
  • C:\Users\Admin\AppData\Local\Temp\2026-06-03_ac1e3a2633cb37a5714332ea3c9c6a5c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-03_ac1e3a2633cb37a5714332ea3c9c6a5c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3756

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 31.1MB
        • SHA256 b3b1a68fa8c895cdb94c68e80dda84f9e9f64d239d0bf381f8b56d60fdef108e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 31.5MB
        • SHA256 14e13cb91f75e3029d199262486b2597f5555677b44ab18bad0b41c55df68401
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 61.9MB
        • SHA256 fefe7226b442a137fd0f006cbd9e5a1bf76ccd380bc5158bf0402c7bb965f6e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 61.2MB
        • SHA256 a1c3fcec9441401698d3271071262c5b24cbc666a2b5ebb121d322a09a3fee3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 61.5MB
        • SHA256 82fb0ee96b35806a5b611ef6c7a4b629ff161a52035e3b1983624509971fa4fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 65.3MB
        • SHA256 c1ac8a76aa189c903a6d31acf6fabb457b5a74432a243f32a71ecb423e49f535
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 61.5MB
        • SHA256 16ed18b2c7bf293e8908523957447549aa27490dd7d76898ee9e7e0d3a9d5ac7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 63.3MB
        • SHA256 b9676feaf6b03c11391542b316f16a166f4910d6836456a760aa1a0b4b75af48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 61.3MB
        • SHA256 3776a3fe4979c021aa5caeee9341a918c3e8f62f599088e9e39fcff777a5201c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 67.2MB
        • SHA256 b12fa43dfe1d71b028a1a98d5254bd458901a6120e9f02c2930fa9edb45f12ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 62.9MB
        • SHA256 7dd8d5afd6ad1562c3812537f9309bf363e0315766442b9d0d59d7f066f3d1b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 64.6MB
        • SHA256 3e7fe0bb4e2e83797f421587b0cb3005e510a012ef0bc2261156e025375709eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 63.4MB
        • SHA256 0df6e1093e5a2d4f528c2784876985c09b6545e90af4f7754e030f76cfc0eecf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 62.8MB
        • SHA256 4e386832e6e5c0f12b65235396d8678963d0c803ff0b9aba7703a989058af8b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 63.0MB
        • SHA256 0f6dedc1327a7f06a8e08b5ce90276914d2a291e0686a3e5d5ac175a047808e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 64.2MB
        • SHA256 9ef93547db2fb6841724453f519543abe16ce5209b7834b646c742c7ed940aef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 62.6MB
        • SHA256 f66f04e61833d234d97ef02675277510eacf4629c86dcd6e3473a50745a11c7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 61.2MB
        • SHA256 98c71a2fd5d536aa0c8b2f68f0097938984fd097b56a0b37da52b71bccfa2edc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 61.2MB
        • SHA256 a14d868e41d0b2513a52fcc57a662b13ead4d3f31b07e2f939afd9074ab2d54b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 61.2MB
        • SHA256 a4c1b5297b4d15a0a3f59a0cb9cd8460735c377772ef30ccbbe735fd5b11f1fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 61.2MB
        • SHA256 463f32ded12aed5dd033e1a42366b9c515d44e936d1768610971e86279d76c12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 61.2MB
        • SHA256 d149f6d468fd081e657a4f949c52e22fc5e41f401ea3407838639e7628520d84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 61.2MB
        • SHA256 d0816f58ec81f8cfeee78fe11dd9e85967dedcfb279c975e5d2cb868b98ecce4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 61.2MB
        • SHA256 de2f09357690d125c3acf59d760bf5428519fd48ecf44988d756d20cbf89c64a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 61.2MB
        • SHA256 4d0e0862c558b218303135c317e2f933027b723b2c23afee3011a4399dced8f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 61.3MB
        • SHA256 fe99571ea56a6c0fe4a793cf3ac0c8cc9eb6252d76ae2828a5e0279e3339d30a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 61.2MB
        • SHA256 7407ee70b9ab67dd73cc2ffa9055749f40a6416613a1729e10979d150f4df73f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 61.2MB
        • SHA256 cc6c474a9db73c1c29fcaf8bc6409d8083860dc5712aa796e15e98dde5aaccb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 61.5MB
        • SHA256 537826a0dcdcb4bb468f5fe3663bd61d1c13d9b87d79736a33e94b865da68b6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 61.6MB
        • SHA256 024e52473fdd9ffff6c40b8dac070c7154962c704f326e715dd57c07b7e610c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 61.2MB
        • SHA256 705b4ac94757705b0df9883e6a32a8ad96232f2cdf93ebeb667d92fbedcb8736
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 61.2MB
        • SHA256 1806ba01c2401850e450f77c4e36028c388a7edbe49827d8443b7811df546807
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 30.6MB
        • SHA256 af3b4f7a44e57e1d186ba9a2fa7ff14f87d6969e5b115227bdf5aa5f5d0424d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 61.2MB
        • SHA256 3c0acea2cbbf309e90da229e7bf22a8aa6d93c9d311d372e87143553098bf90d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 61.2MB
        • SHA256 b541ac02a7bd29a5961564da4a34d58cc3aa3b467e50143e71601fdda1d58821
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 61.2MB
        • SHA256 602a6b40b763fa64fd50da19555237f0995dc156d0eff43808f68d047320f781
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 61.2MB
        • SHA256 a979404e26e3575b889bf8ad90b800f00a7e02735274bd6d6429ec85bcbca18d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 61.2MB
        • SHA256 a54dfe9da52645851ff99ee9de52be70c82e85b971a557713a5a6747f6a195b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 61.2MB
        • SHA256 de8e7db5d40c08ecfb7738c49fee2eae8a619868767e8b5fce9f23ca149767a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 61.2MB
        • SHA256 caeb72e2ecb83d7afe28f9492ed9fd05545c0bec46202371b6970d2e6f53c23a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 61.2MB
        • SHA256 b43c42176b5f8ed4418d050115dd7281de0cf5d2fc76508f552ad841312049cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 61.2MB
        • SHA256 1bf7aedd575eedd03e6be3e6bd65393bb7baba2eb0e35232ac4b7868040ae788
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 61.2MB
        • SHA256 29fcda13ddbfc89fd5a69b1a499f11698fcb97afeb7d970b00a13a18b603aa78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 61.2MB
        • SHA256 78cc0fa8768da3821be6fd0ca724a3b70dd93d7347a9dfe9b75cee4ab12115fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 61.2MB
        • SHA256 8685563f573db26ba5cd7342cd3a1dd83974d243f82258c98708a42fb28dea21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 61.2MB
        • SHA256 a147460de487d3ac19013f47079b4b51ed0c44827a075e771e65eec027e570f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 61.2MB
        • SHA256 08412925ef307727301bb03c9f339b7096365a19f4227d65c0971f5d25d273be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 61.2MB
        • SHA256 0388aac0bff5d5ddab0179184969302a0b24d8dfb3b0fe3e1033d954053140fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 61.3MB
        • SHA256 7004d6d8a49ab91d1316ac35aa6ffd493b43845751a4a012d5ddcde245e24f64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 61.2MB
        • SHA256 6ce3278e827588dc98689343d35abdcae36b309b76e48f138392d34c4bc37ffd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 61.2MB
        • SHA256 2970d4c3246d512447d21227d7e05a3f88b7646ddbd8e290b5229498aad25921
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 61.2MB
        • SHA256 c3a124541d4d99e6edc83d7c080e035495e7b029f4396674b53629cdb320150b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 30.6MB
        • SHA256 af0358383efee2768bb2b42eb1228a582e148a97bbf1f0cdc225235075a1e6aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download