Overview

overview

8

Static

static

3

2026-06-27...r_.exe

windows10-2004-x64

8

2026-06-27...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/06/2026, 01:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-27_f62a507ada00290dabd64348330504db_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 9.5MB
  • Sample260629-bmvx7aas4y
  • SHA256 e3f09deadb5f600152165d00a99ec0a73e5d48bececd83450e84320df17dbb73
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-27_f62a507ada00290dabd64348330504db_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-27_f62a507ada00290dabd64348330504db_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3208
  • C:\Users\Admin\AppData\Local\Temp\2026-06-27_f62a507ada00290dabd64348330504db_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-27_f62a507ada00290dabd64348330504db_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2364

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 10.0MB
        • SHA256 6e0b3e3da743a48fcb2315708668594aba8d1cf2797d4e1063bd17c20d3b25ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 10.4MB
        • SHA256 253a113cc5540936a859266c5dc6af887531cf784c61fab2c78c3c0baa59f4ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 10.1MB
        • SHA256 a12b472319a64f1b0e49b4aadc758706ea9c487bf414c3b124b1d3be6a5c7fb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 18.9MB
        • SHA256 af46a869dfa49bb55db912ca60011ec79b4e356e367ab348cd163d83a626a48e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 19.2MB
        • SHA256 d62a1870adcbfa17c22759f9d1bc892efc5773f2cb59bd0a76b4ecfaa48ff431
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 18.9MB
        • SHA256 784ab00b44020b9efce2d1dee1a7c38fed896414a0c28183b7c1c0876847252a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 23.0MB
        • SHA256 37569122b09103d0123332883d645a46c93ca530362ef4b6835db5fb27a98377
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 19.3MB
        • SHA256 f63c23c4443bc1aa41ed247356018a442a9a47d8a5c8cbe70907aadb1dc1efc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 42.4MB
        • SHA256 ba10af7fce16a0da171ffe8932f093e8fc1c8455f81ee45e5ca886a7ea2b0333
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 19.0MB
        • SHA256 c825c742a2635faf612d8daeac0d86db9c9bf5938b93109a3897b2a86888ed7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ConnectUnblock.htm
        • Path C:\Program Files\ConnectUnblock.htm
        • Size 10.1MB
        • SHA256 8ce745a5de763babf8004924c8bdda74eedd150c55a0762aad2cf341164027fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 25.0MB
        • SHA256 a04b424acc2d90979f035d1415dd5e30e0d48215a1ec875259a219a8c9aeaad0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 20.6MB
        • SHA256 1de0f8e39d3d3af7e6fe12372787c61bcae0f175f47e2cf04729e660dc26ac28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 22.4MB
        • SHA256 11f554ccadee7fca3402861b3d864c8c77cefc193ad04948a33add2a76bbb1c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 21.2MB
        • SHA256 ed1b838aac0ad7f0c9807e3e9f85b1945751d50b5d48caadeddc37fcc06a54bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 20.5MB
        • SHA256 08db27ac179e9b5aac3132d20a40cc068260fd74f838b72990b07cf466e328a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 20.8MB
        • SHA256 6107c34479a7c6b81538934c703fdfe09283ce205c00772c39b7593b93bcac27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 22.0MB
        • SHA256 91f91cc376cffda438476fb1e1e6757c5f7450af33b79cc8b0fff5d03f4f17e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 10.9MB
        • SHA256 b31b399f39879a41dac6ea8676cb410c01c64d2d33f52f881cbf34952956be3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 18.9MB
        • SHA256 0532dc6841960a0ecd96365e1837a308b8d4b2d49410dc8d2feff6a9052878ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 18.9MB
        • SHA256 bf519152b9862aff58aeb3e6e4cc01055e1fb9d1ccd987ecd7cf54f016376855
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 18.9MB
        • SHA256 5444d34cad65a4ee3337172c2ce422be83b0c20c129c94e99656485e6d5f0f50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 18.9MB
        • SHA256 97310d2b417ec8d7fc88612ef586442842587eb9d5727b63676aed72619fe7e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 18.9MB
        • SHA256 d232aca213840eba9aa7634919c6cb6e55e8b5b1feb1aea8bdcc0cec2620ea66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 18.9MB
        • SHA256 6d2542927e1fb2cda025cce1809f9e79136924fa6c2003e4e3b14af44e1323d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 18.9MB
        • SHA256 26aaa60fc18c9ddbc09762ea4c8586a73acee6fca0fe4a384559500c12ca63a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 19.2MB
        • SHA256 a441c7538d3f339fd0a71da9f1bb6cbebfa77d15f225b3da3ac503a26d2220a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 18.9MB
        • SHA256 32c23be555a1d782250d7161e96e51024bc17ee3c183d74a682cfe03a48cdd0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 18.9MB
        • SHA256 206bcfc49a6f956a68615cff770306e8fbb302b4bd5d4e7040c55a84f472133b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 19.1MB
        • SHA256 2c4fcd3567670874df8116f05a7515a2c1c9fd4f36357735e67218961f760ca4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 18.9MB
        • SHA256 7cbbdea58bec73e84899c283aa56ff77bfad47615e11376684a3cc2ed78fb083
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 18.9MB
        • SHA256 444fcc90aa12021aaf949b5529be627030464d8e1a17d3296ecc57222a05e11a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 19.1MB
        • SHA256 f3986079469693c1d9e92871842e5203f0ae485046507c96b5d6c506df2da253
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 19.2MB
        • SHA256 8f5912d849aaff166860d748a68e192dd0be763722a02e05b3a62024cc93f8f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 19.4MB
        • SHA256 1da00ee3d8ff2081ed3a5e5ad5fe1af1f76e06367a2b76adce6c4b0e0de6c209
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 18.9MB
        • SHA256 cf537ca9a68dc285a2770be1f25795a59b8e66c2d727d505b8c0affe7d0d2dd6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 18.9MB
        • SHA256 0de2675700482f56d08e8230191b49017dbce27d0180a250dc36fa57c1537c66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 18.9MB
        • SHA256 564baf9137169c9aac31024389d65ff29049bcc06cfa2ab6d53e06f804bc8916
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 18.9MB
        • SHA256 f49408dd2aef0ddca31451043328a3224001edcd9410b966714ecf4866d91569
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 18.9MB
        • SHA256 c72d809f30fab83d8f6ccd8be9449077bfb7e6495a4d8efc975bd957cb32987a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 18.9MB
        • SHA256 1fc8c18a329197da7412239f69032770569a82ce81516dd39f25bb140c263701
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 18.9MB
        • SHA256 2baa2c15651669bf2ba4d47f1e52f30160d2d8413cab354fa2d59b614425a158
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 18.9MB
        • SHA256 2e7aa8f6d9556335c8c8c2744a428b2c59e10d1e9c949c15b01ee909a3f40cba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 18.9MB
        • SHA256 818e52455ebcdff82dbeb4d63e961c688dd89cd65dfaab130d25f8ccc0b348ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 18.9MB
        • SHA256 75ff640b5e43c7f66ac08667190a027782f545c6617c57bff68189282acb74ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 18.9MB
        • SHA256 1fec1ea7d7aabb3514a85353e98f80b51467c3ad5ad6497f079f54010b3ecf35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 18.9MB
        • SHA256 e27ab38e1aff10bcb510c1d91f8508d60c9ed016bc3baf331e6989cc2d179ac0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 18.9MB
        • SHA256 14709c6392dfa09da8066fb0b16fc9bbe8cbf9c15da8a6a2ad12744de06db7b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 18.9MB
        • SHA256 c88969eb936fd2ed40a2c8b90ad274507940ba50faa936f0db873db3855ff0d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 18.9MB
        • SHA256 9b88fb60197a83bcc226545b48af6b33ddd34a50250c909ad9505544c60ccf39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 18.9MB
        • SHA256 31396adbbb9e1ee42f1395af3cc4d2ee73c260fe239e977e97366c539593e355
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 18.9MB
        • SHA256 5d7402458c1628e122b41fb5aee8e195eb2e52b3691655b48f8e3d7d5319aebe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 18.9MB
        • SHA256 123617749a2948274526c64e8d5b1ccbfdc78a3adff4d54117b9eb405774057a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 18.9MB
        • SHA256 8bf2ee6f6d170265cd0be640239f024606da59c2463254a394d5d68a8b9fc580
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 18.9MB
        • SHA256 ab1287f65615142cf424832a63fc2d47a84d38dc163c8ac038e66c141dc1ea4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 18.9MB
        • SHA256 22664b6c82f6305ce5b3ddca8ea8c20c07e3ad23fc30069c5c51a97f8d6e4e01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 18.9MB
        • SHA256 2f62f67c29fa3e5bcf932911b92a4820afcf448aede9a19591a9a7063e8eec99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 18.9MB
        • SHA256 f298a9ba2b12dd2f717d6a537f6d2f123101e076936728290ff63a1265144d24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 19.0MB
        • SHA256 575458346051b7451651168d79e61beead1d9e88b6fc449dbe8699a3205a46d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 19.0MB
        • SHA256 281fedd6a5dcf0aad8c97a887ba3217a4d352b87477600ffa853c56b408b15a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 19.0MB
        • SHA256 b228f55c8c3bf4a1dee24c82421cf765224202a536575716a7e49f9c558ca1b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 19.0MB
        • SHA256 f8ac42ae97ef956b606586518282e42b32e8f2f79d6d42a6d74b062bc49423c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download