Overview

overview

8

Static

static

3

2026-06-28...r_.exe

windows10-2004-x64

8

2026-06-28...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/06/2026, 22:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-28_619ccf04b3e85524e6dfb9947d01b34d_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 8.5MB
  • Sample260628-14cklsf14m
  • SHA256 e37c2a3c1e238c9d54d0a991f2b4cefcb853923703b5eae7e9b4221de07365ea
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-28_619ccf04b3e85524e6dfb9947d01b34d_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-28_619ccf04b3e85524e6dfb9947d01b34d_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5216
  • C:\Users\Admin\AppData\Local\Temp\2026-06-28_619ccf04b3e85524e6dfb9947d01b34d_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-28_619ccf04b3e85524e6dfb9947d01b34d_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2528

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 8.5MB
        • SHA256 e37c2a3c1e238c9d54d0a991f2b4cefcb853923703b5eae7e9b4221de07365ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 17.3MB
        • SHA256 004812215262b416795cd285dc3e6803ce75b920cb5062dc58636f485f797512
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 10.6MB
        • SHA256 e59f344a73f953de4096de49b60beb45aa9052e0c05c0e69973f94890472fbaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 23.0MB
        • SHA256 53662c1dffef42b287142a2d5504701a41b6190c5a358307d8de8869c1e30e0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 18.7MB
        • SHA256 d732cca1ec08acaddbaa3495689d5d0528698370d775c7be2805b220c4402b2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 20.4MB
        • SHA256 955c5ee94d593ff9744147092eb8fd8f1d155c2a87b7a734bfc2e56122d29397
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 19.2MB
        • SHA256 3a5d0cf45f0433db5326990849eebcea080781d48ba63b9c396c349dee857d52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 18.6MB
        • SHA256 6ce9ed4c004d670de54c848c17f4dc9a32c81c5e0cb563e91d9d753224576a8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 18.8MB
        • SHA256 25453d7f52237f70c51a1a1ecaa8d7096f88abbe11b49dd4def3f1aeef2890fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 20.0MB
        • SHA256 e01814f30650e2e9978e327f80fea0eacd256f50e14bba3a9529789f47035212
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 18.4MB
        • SHA256 287883903710fc56b4a3cdd73c0be4c70de2501d6b4a1298cfea7ebddce9dfa0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 17.0MB
        • SHA256 585ca1123d8f4831793fa57da115dfb2c16ace1b661cd2d0335a0ce54704ef6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 17.0MB
        • SHA256 760bf6525599ee1221781de3c3db0c1fa0a2d4c1eb23ec6d8ae34d92f0347776
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 17.0MB
        • SHA256 3bb778c009be9281c5bce7fbc79983dd29330fe6c6f3a1a0c6117ae0fe5a4178
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 17.0MB
        • SHA256 ab8f5978578201c355b1a235695f7e18aeb2f0997a8fe40a101da09e0ac13efb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 17.0MB
        • SHA256 d3b31d9db33c49402718997faf1f7301daa091a89ca96575af120100f79cea58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 17.0MB
        • SHA256 38b98a7981e2304d12ed675c5113f8b47fefe2c8a46748be4a39fe291fbc8ca5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 17.0MB
        • SHA256 72f79fbc82ca4e977ed85876f2c66c2896f9672f8866feb92b18b75fb3ddc5c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 17.2MB
        • SHA256 ab234869d1436dc2de7fd93997642d307a3bca6832eae497ed2f18d0c6a3578d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 17.0MB
        • SHA256 0cfd688c6f11c05b8d286956b2641a82ea217806819e76f4067e18adade0a8b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 17.0MB
        • SHA256 1ead48b9c3133e68d646c23526f6affc12e8db9dc2a4599bb0130cacce719c28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 17.1MB
        • SHA256 c2925e366f7f07ce0a16ce07b674e2070453d2c5067c24278c4af4385120219b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 17.0MB
        • SHA256 48366197f9186c89a78e52422dbbe422e66aafbcbef65c93755b8dd4692ea4cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 17.0MB
        • SHA256 2936a83c3e7fc31501919e2a74d2484b9ae1b2dda33cfc15c5680ea91e78e7dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 17.1MB
        • SHA256 a719f3caededa7909554fc67f0f55536405141f87e3cb52005d1604f3aae49c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 17.2MB
        • SHA256 ee777619946afe02391d6d5cb9ab842150294d35b493bdb5ae2233bc1cfc470d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 17.4MB
        • SHA256 6736cf179ad3be5efa8ef0f7c7ae4221ba10d2a7ded73c06d58d3ba44d85a21f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 17.0MB
        • SHA256 bf6f3b772410e420f2286809bc58e237a3be628004b0721e7be0549478926691
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 17.0MB
        • SHA256 5a2d48bed2129658bb79505c6f1d04c0cc0d38cc2201b9f0768a198013408f91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 17.0MB
        • SHA256 ba9a83be048996335bc29a33123ef60080524f0bde335caadf0964cb4d05ebe3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 17.0MB
        • SHA256 9d50f45adcb56d1bf3c9261125f3ab0594f16ac68d6e19a7e3158a0cb9fb78a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 17.0MB
        • SHA256 71b79fb7ed0e4a43863f4fde56576f84a9299c65baa4a65baff84c88e7a829b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 17.0MB
        • SHA256 eed73e41a43a12e901baa1ccd2ee6e5da67191efaeffa0c5388663cd36e385ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 17.0MB
        • SHA256 fd9b16a3e2f7083600b754d79cc4ed71dbdee297d68ad0da4238a18361d18e91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 17.0MB
        • SHA256 48bf7f8fcac346fdf9838cf9aa2b902444806d53cd65948536d64f51af7fa5fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 17.0MB
        • SHA256 13551e33f26bc4aa0cdd4f307987d79c7621123ddbf8a6f8fed4b824edfb42a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 17.0MB
        • SHA256 b3de89aa7bd99efe34e4a55245f9a48a4bba088a5dd2bda5a96a2a2f33d7f0ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 17.0MB
        • SHA256 b4ae6ec7982e42d17fedfe553a8f38db053525ae9b10fb565445ee530ccbb528
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 17.0MB
        • SHA256 1eb3f2ab10e777ce9afca2906999c101e26e11067a43bb60da62f58b1f3a39a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 17.0MB
        • SHA256 4f4d97f0e0412a080dea58beacf53aac404034efdacc2fd2826a56b72cf597f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 17.0MB
        • SHA256 80cade67041d0e475cf7096db55ebf389c604ba96ea95901e3a7640eb21c735b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 17.0MB
        • SHA256 6a72b7c64769247a52dcfbe28ccddbb3d7a611ea346b7a3c58b7bef61284af6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 17.0MB
        • SHA256 c90ac7c9bd4c77cfecfa82cc30539f2ded0c54c2a7bdaa6c11ee6f22577b7df6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 17.0MB
        • SHA256 8b336040fb49cc431ea6683b801e1f01dc4273e37feccd26ecf3f5f0dfaa51c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 17.0MB
        • SHA256 a94ce8e78ced29a9c1e3211e6e4323c746b26f452c6544caa1ac995aa3369661
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 17.0MB
        • SHA256 9df9d233f75ebdd14a510f1eee3d29d8d3176e7e316c981ce0be488374fedab5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 17.0MB
        • SHA256 3f97971ba22e39d7d2da1e631acdb39b4700100a438e51729e98cfd74aea3a33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 17.0MB
        • SHA256 446470df0bc805f5f2621ece735e9580324f8e6eb4af8ee121ffcdae09b09864
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 17.0MB
        • SHA256 9cd50577b02df17f90da5077ff14835b0a49c5b10a86e8d63747d2b9e1c028b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 17.0MB
        • SHA256 8604637dede64f403f88205290e8651ebeb62d5fe786ce8ce583de9198725fea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 17.0MB
        • SHA256 fa6e6366b529a4585366a83ed585b9ce5347ff02805d8e048bb3c2eca45dbc13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 17.0MB
        • SHA256 c48abe3757251eef5f1bab882ba2b33acb51c62b8187a9b43f1ba7fba05cf2dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 17.0MB
        • SHA256 efac4e03b18a3d66125f7ce770aaa995cd9bec4907417bdc913a31ccbb95734e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 17.0MB
        • SHA256 bd75ef7a094edcc1b69aae852df0064e4c4810115f6e8e8e2cea7cbe029b1ce0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 17.0MB
        • SHA256 32adde10ae2b85101c95a5bc0cf8fe847f214b0bc73a16a8b2f570d35249dea3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 17.0MB
        • SHA256 e2a98149688d020d520c202fd521851b302ae06754cd438e44118db4121fd5e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 17.2MB
        • SHA256 d416fd8eb8cb08d2afa96fa6e584fe45f3c8236f870f2f52a6ae0f41dff32cef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 17.0MB
        • SHA256 c74ca90d4553c1633c1c9cebe9bec65bbcc4e70ee30f54979cd85032a19fa84d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 17.0MB
        • SHA256 34471298ef0699e4954a99a02b3515d7a70f893a8fa6ee87084bc59946d5dfa8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 17.0MB
        • SHA256 ff6d300e367d242c9b9c7903758861177cbd2df5307f71cead36a38174f0bced
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 17.0MB
        • SHA256 9fd798b368897e2b69411f2858c9fe53b27deb6643b03b39921a18b45895fc17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 17.0MB
        • SHA256 5a727bfa0015a9747233ba8184859c86edc97c1453f3824e8691c83e0fe6f9c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2528-47-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5216-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5216-15-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download