Overview

overview

8

Static

static

3

2026-07-01...ij.exe

windows10-2004-x64

8

2026-07-01...ij.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/07/2026, 22:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-01_3c29cfa2c8fb97c77a0c2e53bcf3a635_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe
  • Size 15.2MB
  • Sample260701-2a8xdsft8p
  • SHA256 1e9494d22cbca8a4fd0e7e19682ad677deff5badea63484a71b288ba41006eac
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-01_3c29cfa2c8fb97c77a0c2e53bcf3a635_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-01_3c29cfa2c8fb97c77a0c2e53bcf3a635_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1980
  • C:\Users\Admin\AppData\Local\Temp\2026-07-01_3c29cfa2c8fb97c77a0c2e53bcf3a635_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-01_3c29cfa2c8fb97c77a0c2e53bcf3a635_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5652

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 30.5MB
        • SHA256 5bc3067ea0b778e29f16431704db6bbfd17134f15bac7b8c940ed970812a4ee6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 34.6MB
        • SHA256 4a818a1852ddcbafb937b56bf62154dbe19c9cb50859b6f21c358acd0bd17c0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 30.8MB
        • SHA256 4e2828e42412971ffa1fdf3c74098cdbcb7289746cbfed92e62a0836816362f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 53.9MB
        • SHA256 5cdd3dc629d2e1aafa333c681413d860741febcf47e2b48fa43d64052f848e00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 17.4MB
        • SHA256 19a85665c13d0cd70c7145a73d022b51c1e08324b05afaccd06cc694046737ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 30.6MB
        • SHA256 1656c41aaf11c2ade19ad3c6180d96aa39a200026e9f2f1ae3dc5afc98e15340
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ConvertClear.htm
        • Path C:\Program Files\ConvertClear.htm
        • Size 30.6MB
        • SHA256 d4f7b8ed9f55a1a8acb4e75eab269e6273f5f02d1ed59cea9f04851c629f3db7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 36.5MB
        • SHA256 763264d72275ab0c67bf5ceb1f058cdf47994f65b09ce30cc046d49175bc2e64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 32.1MB
        • SHA256 7d1deed8461b7295f13a74d68f72a3b7ebf90050449402db65274eeb5c645d4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 32.3MB
        • SHA256 aceb213493fd21687f69be53e007740e37ebfab60fef942f3ff71c2b01d00ead
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 33.5MB
        • SHA256 76ce1d369e934be935c6708ac61b34adb0b186c97aa78037cabcb0e344ce8ae0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 31.9MB
        • SHA256 f6d024beb0803d1b2c1d466ee2689f767316efe381bf3ffc49670bdd0003cdaa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 30.5MB
        • SHA256 c27cc093311993173a02933806e7a40d79108e1ba88dbe4e92e8ed12388cd86d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 30.5MB
        • SHA256 1cb4f63751a4ff12f0bedf57c24d22c7a410ae19e0f848ee33c25045e39728eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 30.5MB
        • SHA256 0a568d1942037a7ddaa984b5b4ffce64fcb90b5cbc3b80ee0a44f0e4449ad5dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 30.5MB
        • SHA256 b6efd460ace9cff93b64add2dabf1e7aeb5810589a6b49efa565f61baf7c6ac2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 30.5MB
        • SHA256 990558e1b9b935751bb34780197fabd0e944a2804c6ca1651a97daa908e2b7dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 30.5MB
        • SHA256 d4a301c6a1b28293804d99d58c2fa25c5a9f9531cbb14ba22419ddad8521b898
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 15.3MB
        • SHA256 12c2c6153115bb853e78a7638feb1093c28711fa6e29658d6188b0f6a5567bf1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 30.8MB
        • SHA256 3b1305aabd4304ccb193b1443e295d6423ee42267308364f454d92261dd57a4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 30.5MB
        • SHA256 6934a31e36e5711d978ea2c36e1436d139f56328dcd1ddcfb847bbc99bb80424
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 30.5MB
        • SHA256 69c0db084967cf9bd35100f0670b2e4fffe4b9219d12990a10079424da561180
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 30.6MB
        • SHA256 bb365d2b2b572b6f6b4b0d8e2b2d9c36c44d77e330acb51fa49a299d39ef05e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 192KB
        • SHA256 56d5b720b4307ef448fb38ef6495ea0a6fb25e8bfa8f9c140729b820c8e0cc1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 30.5MB
        • SHA256 fb4ed12cc191559b7746119fc94291692aab0fc601228591f4d0efa1536eb681
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 30.6MB
        • SHA256 4ab9a471cf3586937e448f59b50c16bcb5ddfa51512d022c56963816fbb75c81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 30.8MB
        • SHA256 befd94ec6f513f27eb2d7b6de62aa7540cf57395d905314eac8b27231ea16fa4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 30.9MB
        • SHA256 e296bcb094e61e3e1b6d0a477787fc3e0176e097984a017d7282c0d413cf4b80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 30.5MB
        • SHA256 496bd9214d2e1c510d8016b62d61d4b25c77cab637403c6d9598350b9c68b5fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 30.5MB
        • SHA256 cb371bc4e5ba40a977c8182da55e4d63eccb46fbdb89e0fd506a39029495c4a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 64KB
        • SHA256 79a0b1f3b0958e830806c9254c2ba2af079ac99713004febcc3610200c9f504e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 30.5MB
        • SHA256 f21d330e46915b1ce9a3af9bac889a6db23d1d6980318a75a39d68d1af212068
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 30.5MB
        • SHA256 5dc9f59c97eec085c752635d0a252299e7fd8296c2f2dcbe7f319f8835a0ee98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 30.5MB
        • SHA256 9b6f53d603845d55bd226a46f5a0489579d1b128629fa360bbb44413b3ed3444
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 3.8MB
        • SHA256 53f7a1d6f88df93874b03ba4d732358553853f5d2741c6f577f07c8b75234e4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 30.5MB
        • SHA256 b0344a8151bc94a65b01910ae4960e4a25d17b302cbbee1b1c4f0e1c3d04aad4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 30.5MB
        • SHA256 c79a20ede4fe79ed9999968aca3479abaa2c3c6df1fd985f7673837ea4bb8754
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 256KB
        • SHA256 6adff2403606f3fae51ba272308ce91c8124c63f116c3d886a5a38b4ccbce497
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 30.5MB
        • SHA256 ccc1b9b04327f35ef45f785e73d4a98bb847fd40a4616913554ea274eb2d91d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 30.5MB
        • SHA256 e39e308281d1dea15d961d2675df97950b0d53ae4f887e334fddad808773d82e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 30.5MB
        • SHA256 5f0bb602cfbc5c60ce4f56a56a38378b2e5fd2a5e1818f982a60ccf3b9c522bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 30.5MB
        • SHA256 469dc68e1b9b30c5de253ae0359122c8ebab89430b52861291db2effd841b8e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 30.5MB
        • SHA256 ebfc91963311119dfe4272aa8d76b58158a6cc76be5b3492c86205e9974dd1fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 30.5MB
        • SHA256 815bd4348c23f85ba6c53378941ecb5ce25fa92d740ff0ccb4f98adaf4f6a54e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 30.5MB
        • SHA256 a4c5f6ef2c0a7636d99a72e2c9a8b58a64a5c985da2e9f95e9dac97b507586b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 30.5MB
        • SHA256 3064d9a4c27d1dd924ab69452db47c4042058b9af8ba9800fd565839454981aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 30.5MB
        • SHA256 2149f7d8498714609d58ab4ed2d557d42d12bf349c6102679137a2f671cde2a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 30.5MB
        • SHA256 ae9bbd69631100d06cbfced438058f60e1a7686f721c9677f9bcf6b991fd5e2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 30.5MB
        • SHA256 0d509cef1089466847890a50d51eb20b5c8e0773ab0fa6b14aa3f0ae14e90f42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 30.5MB
        • SHA256 cc35380a13d9ba2c4eee1310c3818d6d9a5d046a7fa9c370d319393eb0a0c27b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 30.5MB
        • SHA256 47c4519ecc8b9c0e53d2d91c50e3fd63968292645d04ba2f7027ee8752f7178d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 30.5MB
        • SHA256 2330f376e1aa7b275bd9a7a3b5c105d453b169f67b78744b257f102f9cadea67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 30.5MB
        • SHA256 256d4783fec5fde43331319bd1b14a25ee2fa3a2d90f3101db02e932b9380dc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 30.5MB
        • SHA256 e723093e84122621a2f383e0af62c29b22d6304175e7099f985fadc48718c090
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 30.5MB
        • SHA256 0a761a64a12f597942199371109ecc15ee726ea47d291792d7997d3e65ca3b50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 30.5MB
        • SHA256 1914b29db9d2936fdd42be025dcb01a429e18010fe64195c5418f806907e44e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download