Overview

overview

8

Static

static

3

2026-07-01...r_.exe

windows10-2004-x64

8

2026-07-01...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/07/2026, 16:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-01_eab25b7fa8764f3a1905e6b85caee18b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 18.7MB
  • Sample260701-tx31naas2j
  • SHA256 bcb534ffdd625581c2f8f57e889070719d3a7fb2881170155dd41eef77ff30f4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-01_eab25b7fa8764f3a1905e6b85caee18b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-01_eab25b7fa8764f3a1905e6b85caee18b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:6108
  • C:\Users\Admin\AppData\Local\Temp\2026-07-01_eab25b7fa8764f3a1905e6b85caee18b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-01_eab25b7fa8764f3a1905e6b85caee18b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5952

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 19.2MB
        • SHA256 607bf47feb0dca669ce3b1a99059c799b08fd8e6ea6da1f7beda8a1128c4aa5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 19.4MB
        • SHA256 157267aed123a88f63ac54dfaa546570cbf3534a638af4e9635635b55f89ebeb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 19.0MB
        • SHA256 bc3b205ea44323c192fd14bc861c4eac37c40276a315c66a7f84772be3f4708c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 19.0MB
        • SHA256 3fe67028eae1ab5a19cb920e228c08ac1c6ed70637c8105e00420a6fd75cd2df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 42.2MB
        • SHA256 7be0ba01d88d5d4a2dadf46ac4ff5a21ffd8a31c9be096f7dfb54ba4748976b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 20.8MB
        • SHA256 e343e3a7458188b08760c1fc50a3260b1c6fdd19be194ac344ae6b41860be287
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 37.5MB
        • SHA256 3c0a1789ac5f7af137ac0e08de21c0b9f5b1b9bd116dcf686a8a7a74e7a7351f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 43.4MB
        • SHA256 397fa8bb793d39429b158c9d5ce7aafc531ae0659dae66034f4d4d6ae5ce5b4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 39.1MB
        • SHA256 d6277b8527df2589c1dedf0e9d63c8ce6cba37f658930082ec980406dcf3573e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 40.8MB
        • SHA256 f0093dedea24e7e3c3219c9b8fcefb1a49084020bd072479b65444181db8545b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 21.0MB
        • SHA256 c5a926ab327a9a6763d060046b72599a4b9275f8c183c8f24b4a803c5c925d5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 38.8MB
        • SHA256 f2a2f6ba4bff8d4f12582864da01bf46168eebe6f28e36db0904ba1eded2768f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 18.7MB
        • SHA256 599208b280a180df14fc3004735c55e772ae80d650a30c0e88a71aa0a794f0ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 320KB
        • SHA256 363d8bcebbc5b12363d0170b74c75e244be34429994cda946f54b9498c281b27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 37.4MB
        • SHA256 81f9a30adeb919e5adc5246a6a79d00967a6d3f6543d3e8e971dd6c21966960e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 37.4MB
        • SHA256 0c9ffa2ffdac0d974d0142b488eadc4e6a0535808629ad252863149a26239e1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 37.4MB
        • SHA256 8c05b961e3ffdc64a72a7428a3e0deccc47fb19e538ab4017981f352aa1bdef3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 37.4MB
        • SHA256 e4346002a2c49b0c6ebbc289c9029146f6009217b12eba9b728856aeed0b0676
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 37.4MB
        • SHA256 56c8f6989eaa8c85d0b0ff95e2e7fe35910f670e5270ab436884924ea88f5429
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 37.7MB
        • SHA256 d19f9d40022c8d64655c08878dda555a9e8bf2e41a6fa3c86e34ca434cca9279
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 37.5MB
        • SHA256 b7d533c78549cc755e3fd53f37275fb6531cceaf2fe256acae57c38272ba1ed4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 37.8MB
        • SHA256 2858ad65c6f649b7defe02935e81e9922211c271fde4dff32bfea9c4cd092278
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 37.4MB
        • SHA256 a9872c4772c91d4a4f47da316c131c44536b3a1c7047547e37eb31e504460c14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 37.4MB
        • SHA256 8fd9cef82bcce2ce0d42d50360506601e02d92db9dc5e38adee784dc7bc17ea6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 37.4MB
        • SHA256 ba2dd23aef3ef94090609fcaf2b1898195a753a709544329fa167c465dd87b32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 37.4MB
        • SHA256 acca373b9ba4cecb91b7537c7e02674f4c6b382204a0dffae571f23b3fe6df86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 37.4MB
        • SHA256 7815953e299f608e8329440e74f171adfa23a85bc6682bc0530841eee7d2645d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 37.4MB
        • SHA256 15ab809a4ab449ccc6f55323355901dba6f198c05e8d1e8549a83c271ada672d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 37.4MB
        • SHA256 77a12d161adcbd669f6c5372d1200258259d70b6525d8e3fea6b33540d7316ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 37.4MB
        • SHA256 1b162d1850a504b2ca8d5be7463b860326857287c8ec365e7181f46ee995ae2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 37.4MB
        • SHA256 bece0ac5ad77e509dd396ee9c1faf2b9422d35c34ae342cb53dac68d2b8182ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 37.4MB
        • SHA256 aff22ec350f23e7f53470fefdbdee18c8b65e8ebf32162677f97bd6e804e09f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 37.4MB
        • SHA256 b52c466edc7ea3b50072ec52acfa0fa20ceb18228e39dec5840096b1bbe7effb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 37.4MB
        • SHA256 1b9345e12876192b18ba3f9a01b3c59c720a2148b57e621a69dd7b4d3a97a52e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 37.4MB
        • SHA256 55c38f234070043977b268d600cd607c796bee6f268650d76914a28d942c8d26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 37.4MB
        • SHA256 5363ce0062b8b805df2eb7854f780139a9f1d2cb73a1b1ae870a4c6a40e06d0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 37.4MB
        • SHA256 e2f31c3bff712e77f9e08b0c526e286e283ae112b0a0ec46ec304b501c4cf42b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 37.4MB
        • SHA256 8f513a95fb688dfca3f4b671b3d7435bf9b4b4020f98005f80646a27d0fe14f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 37.4MB
        • SHA256 efda312be6c9d3719dc1bac1acbe35343f02a369093f0ad3601f634ad8e76541
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 37.4MB
        • SHA256 cc84eee1a7997de305fc0663e0a597035847556bd7512a9b7347543e8d65cbd9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 37.4MB
        • SHA256 39e2b17ddb2e7279c4a07c82b3a834a42ebda150814dec63ca547248108717a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 37.4MB
        • SHA256 51f95826aa2b08af27b53931691aa400a1e385cdfe872fcf0ababad8c2ec5927
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 37.4MB
        • SHA256 6d885262dd83f7f96afcb6547f9b1dfc16334be77253e67a68b79af3c28ac663
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 37.4MB
        • SHA256 1f4280fa918257f65bc962ee3636b2f97f5918940560165d06fd59fff83e388e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download