Overview

overview

8

Static

static

3

2026-06-03...r_.exe

windows10-2004-x64

8

2026-06-03...r_.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    148s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    03/06/2026, 05:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-03_ac1e3a2633cb37a5714332ea3c9c6a5c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 30.6MB
  • Sample260603-fxbphshw21
  • SHA256 af0358383efee2768bb2b42eb1228a582e148a97bbf1f0cdc225235075a1e6aa
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-03_ac1e3a2633cb37a5714332ea3c9c6a5c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-03_ac1e3a2633cb37a5714332ea3c9c6a5c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4576
  • C:\Users\Admin\AppData\Local\Temp\2026-06-03_ac1e3a2633cb37a5714332ea3c9c6a5c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-03_ac1e3a2633cb37a5714332ea3c9c6a5c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4032

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 31.3MB
        • SHA256 c19ebf650a045dba04c3ac58882a8e640725a27e7301bfa4d1012f007907ef0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 34.7MB
        • SHA256 dc2d12efaea99ab60a48bfec25820c32c62f2ad626518450c1ceddc438de95cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 30.9MB
        • SHA256 07bf7bdf5371ff7237fe2eef08f6aac49c5b1f0aa7a26fd534967c0067d5f031
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 67.2MB
        • SHA256 b12fa43dfe1d71b028a1a98d5254bd458901a6120e9f02c2930fa9edb45f12ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 34.0MB
        • SHA256 d62a5e1db390db7b5ffd3a7d75cdf65639b498eee5b36b419f32a75fb46221c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 62.8MB
        • SHA256 4e386832e6e5c0f12b65235396d8678963d0c803ff0b9aba7703a989058af8b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 63.0MB
        • SHA256 0f6dedc1327a7f06a8e08b5ce90276914d2a291e0686a3e5d5ac175a047808e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 64.2MB
        • SHA256 9ef93547db2fb6841724453f519543abe16ce5209b7834b646c742c7ed940aef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 62.6MB
        • SHA256 f66f04e61833d234d97ef02675277510eacf4629c86dcd6e3473a50745a11c7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 61.2MB
        • SHA256 98c71a2fd5d536aa0c8b2f68f0097938984fd097b56a0b37da52b71bccfa2edc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 61.2MB
        • SHA256 a14d868e41d0b2513a52fcc57a662b13ead4d3f31b07e2f939afd9074ab2d54b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 61.2MB
        • SHA256 b376e20470d93dec434f18493e51a30f1483616384660f0b3b21624671680eb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 61.2MB
        • SHA256 a4c1b5297b4d15a0a3f59a0cb9cd8460735c377772ef30ccbbe735fd5b11f1fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 61.2MB
        • SHA256 463f32ded12aed5dd033e1a42366b9c515d44e936d1768610971e86279d76c12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 61.2MB
        • SHA256 d149f6d468fd081e657a4f949c52e22fc5e41f401ea3407838639e7628520d84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 61.2MB
        • SHA256 d0816f58ec81f8cfeee78fe11dd9e85967dedcfb279c975e5d2cb868b98ecce4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 61.5MB
        • SHA256 a200184391d006aad7c5cda16de48634444ce19dcbe87d0647719525cca25892
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 61.2MB
        • SHA256 de2f09357690d125c3acf59d760bf5428519fd48ecf44988d756d20cbf89c64a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 61.2MB
        • SHA256 4d0e0862c558b218303135c317e2f933027b723b2c23afee3011a4399dced8f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 61.3MB
        • SHA256 fe99571ea56a6c0fe4a793cf3ac0c8cc9eb6252d76ae2828a5e0279e3339d30a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 61.2MB
        • SHA256 cc6c474a9db73c1c29fcaf8bc6409d8083860dc5712aa796e15e98dde5aaccb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 61.3MB
        • SHA256 74443fa560a4fb0273be271cf11973d8af92a35acbedb60f8bc5f59c64a38b07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 61.5MB
        • SHA256 537826a0dcdcb4bb468f5fe3663bd61d1c13d9b87d79736a33e94b865da68b6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 61.6MB
        • SHA256 024e52473fdd9ffff6c40b8dac070c7154962c704f326e715dd57c07b7e610c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 61.2MB
        • SHA256 1806ba01c2401850e450f77c4e36028c388a7edbe49827d8443b7811df546807
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 61.2MB
        • SHA256 6b2d77c2f5b4f82a2738805f101d958e091b8d3445eb864aa3d1b32f8f43ba56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 61.2MB
        • SHA256 3075acd906015db1fd1f273b7775da1055f23ef5ee57829ff4e9abadf9703b5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 61.2MB
        • SHA256 1bf7aedd575eedd03e6be3e6bd65393bb7baba2eb0e35232ac4b7868040ae788
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 61.2MB
        • SHA256 8685563f573db26ba5cd7342cd3a1dd83974d243f82258c98708a42fb28dea21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 61.2MB
        • SHA256 a147460de487d3ac19013f47079b4b51ed0c44827a075e771e65eec027e570f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 61.2MB
        • SHA256 033952da81eae4cd02e6f8f48117fcb247c84ffa2d5a15036559fef79522f2f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 61.2MB
        • SHA256 08412925ef307727301bb03c9f339b7096365a19f4227d65c0971f5d25d273be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 61.2MB
        • SHA256 51dbd0a8c82631037cbc7997303f61df927f542b3ee91db236fcbc5b863ca0c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 61.2MB
        • SHA256 0388aac0bff5d5ddab0179184969302a0b24d8dfb3b0fe3e1033d954053140fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 61.2MB
        • SHA256 feeb73be2a0f2642bb4b2a4d599c3d9206d216f07907894fe72bce08c416ecde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 61.2MB
        • SHA256 0546945baa812836c7e74e92701dc24d26a11e5c7644149654299abbd4fe6e03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 61.2MB
        • SHA256 34b3c0eda97049345590c769b793d88e2078bb8e937084de8fd161ac4b61188d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 61.2MB
        • SHA256 9380359ce893d7a910dc4ff105859fe5a6ffae11475d58a9e4f73cf0e14bfc23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 61.2MB
        • SHA256 febe4fe5762e37b8a8dfccaa45e59e27c94f612cce3ede5d44c4c39850f7ee33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 61.5MB
        • SHA256 307f46a360db2f071f7fd3e6c8c045fa14c0f768a34f7ca51781adc9f190590d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 61.3MB
        • SHA256 2036be98feb7597d5cd5442e695a4cfed40a320ede86637497819e3337a0bdb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 30.6MB
        • SHA256 af0358383efee2768bb2b42eb1228a582e148a97bbf1f0cdc225235075a1e6aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download