Overview

overview

8

Static

static

3

2026-07-01...r_.exe

windows10-2004-x64

8

2026-07-01...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/07/2026, 16:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-01_85d4284ae7e9139b706fafa20a08b9a0_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 11.4MB
  • Sample260701-vf5nlact6t
  • SHA256 d97bff938858df1e30eddefee947fd85973e24ad190983eef1586d0eca659a14
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-01_85d4284ae7e9139b706fafa20a08b9a0_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-01_85d4284ae7e9139b706fafa20a08b9a0_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5144
  • C:\Users\Admin\AppData\Local\Temp\2026-07-01_85d4284ae7e9139b706fafa20a08b9a0_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-01_85d4284ae7e9139b706fafa20a08b9a0_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3920

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 12.3MB
        • SHA256 72a71b00ec0f5fab96a3abc9f7ed6cc79b29378c25bada4024f666f21dd5e926
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 11.4MB
        • SHA256 d97bff938858df1e30eddefee947fd85973e24ad190983eef1586d0eca659a14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 22.8MB
        • SHA256 bc3334a70a4f7cbf83b0074d6566c063319508b08aae344ebb77015a16d70aa8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 23.0MB
        • SHA256 6c9eed4d82438e2dc4fa896776267b25e5f490ee0bcf6cdd25026a57b58a1096
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 26.9MB
        • SHA256 d0819c67bcd42d852c2aaea4bd9c6a1fbbe9892989541e2aff4388ea21afeb22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 23.1MB
        • SHA256 609a5bfa7595e3b763dd42f34c536ed89334f1377e42589a774f34c2e7741402
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 24.9MB
        • SHA256 0c0793d9c62521b4bd6a8d50437dc871c81d7cabbf893ade8a7ec7c2b0beb54d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 22.8MB
        • SHA256 7d158511cad044d373d75b67903f3a5ea4e8f518150d3adb8d2e2ddf442649ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 28.8MB
        • SHA256 cf95201e111db2bb225e7f49bfa2286066797b6ae4b88c28218f3698af16ffb9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 13.1MB
        • SHA256 925ebe133c321f1946d695d57301d31e6803f527acba067797c39bb8c95ce87d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 26.2MB
        • SHA256 47d4ba672ec3c482c8970e162f9e1b816ed5f13687bde1d49c56bce951765d71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 25.0MB
        • SHA256 72064cdf81edb5811a30a14cb264e31d82c03a688451603ee0ec7d4e71d0344c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 24.4MB
        • SHA256 f5bd7a52c5c5e4fe417212c0376ebb5cf29ce2726cc5062f798f68d6a47f718b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 24.6MB
        • SHA256 f19767c29d1f4c5e1d96f19ec06a4aeec1e674235fff0882edc108b4b54ee506
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 25.8MB
        • SHA256 14db1e1249c5af4c699d723b0fb9ef0f8a338a483eaac674ba7e54d271c34065
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 24.2MB
        • SHA256 c2c3d3465f50a4a7772dfd21158ac18623da4f384247a4185e274f945f933fb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 22.8MB
        • SHA256 b0a422b2f9092b5ec154493cb05c7d6351a0c187b373b83881c0079b633c9811
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 22.8MB
        • SHA256 bf0dde1308430edaf7508ddcf369194c4c0dafd52fc8753214a4e0d81de1ce94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 22.8MB
        • SHA256 06f76f5d36a5c1f9116233023d61f44dc5f8f3a4c651bd570be41f72664463fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 22.8MB
        • SHA256 18d87acd1138afcd0b76e17c49b919f06c568152cf2583f69fe2ffe81ee9df82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 22.8MB
        • SHA256 78f1bafdf3beca2c88a801aa3af9f30ae81c43378ab57a8a7b844946849700f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 22.8MB
        • SHA256 422b7289bf1e3e95e8995bc0cf9dc1527692375b090571f98cce6c03bcf30e64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 22.8MB
        • SHA256 d4eac183c387aac6dd2d62c670549d45691b4e80f948049d88c5f06094e1f90f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 23.0MB
        • SHA256 210ae586004f4a113bead6431893248c5eba23559cec136664a112f5e042a195
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 22.8MB
        • SHA256 1dfdfb86877f9c53daa07b53ffd0e3fa20be18844e306c0547ae184033f89644
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 22.9MB
        • SHA256 4a979143af3b3ff6e5bcac9e19221744f08bc7728f287681c9af7dad3dfd524f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 22.8MB
        • SHA256 e0f4c5fe0c91d23577cd602e860849c88c6ea2e0e43eecd0d76f1baa08dbc0e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 22.8MB
        • SHA256 eb3c2a7bb2d44fe33f62d7c8134121956bb4dddbf6d47012011684cd5e928034
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 22.9MB
        • SHA256 b4e66a74929cc7192de547f128e1460c394e950a93ae7b786330a86f1f155aba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 23.0MB
        • SHA256 0c5730d3c33a53ca0c10cf0f1414e7d5da6038927c372818285dd5a86e260ca7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 23.2MB
        • SHA256 174591b5d5073a7b6dd788f12e2a65c9ed18816817b2e4108167f1db012fb597
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 22.8MB
        • SHA256 38cf4f09bad8ac72eb5338bf37d5e46aefb74702e55d37c268763fb8c2750319
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 22.8MB
        • SHA256 35552d6b47b2ae589f40f7304b090d2c14d7d2b467d467647af29eaa5d910cbe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 22.8MB
        • SHA256 d80524ebfe05aa25704fee18a4419a8dba3b90bc66fb580a2d799a57afd3cd29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 22.8MB
        • SHA256 597887bac60b21eb2e3f645b246138d2de4cb5df004f0c8c78a31ee59eab56ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 22.8MB
        • SHA256 cdcc4d03686fcde499202b91af70ab17ffd99dac4dfeb41124d34ddafbde7810
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 22.8MB
        • SHA256 ab9b92de303c19540a56f041b210e17a3b65af643a45462cf0fdb9b48fbdeec7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 22.8MB
        • SHA256 36785146ef06ff12999b43767f8ca3fe13532b4cb4906e9be1b973bcbe1e49fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 22.8MB
        • SHA256 978ad0dc1b9919073b50483f995d57eaa719584ac97c65c78028fa57c0c04422
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 22.8MB
        • SHA256 e4431cb12c5059cf6612d4304bb4e92a3eaf34ef42dae67c8b106759a3fcab0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 22.8MB
        • SHA256 de4bd8ffe679821b1e83999c81075aba349f609cb18343602a2ff5f6d343d1c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 22.8MB
        • SHA256 95a892f6b974a40b213762f8a2c3fce62e39d27b77deeea657f3fefd793cf88a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 22.8MB
        • SHA256 b9037814cca3d0c9ba93786c2bf2394f0084bf2d7c2615ac116b4461ccddf4d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 22.8MB
        • SHA256 9449c52aa5f3e90c8138173380886ff6dc87e9575e61c0212fad8ea2f10243dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 22.8MB
        • SHA256 16122896829827c6566076d1eb0984540529c8dac324147296423ad2b2f21100
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 22.8MB
        • SHA256 dd1a17b7a08637a31ff5c157497ed93b38be093c14a527cc615767bda9df2310
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 22.8MB
        • SHA256 a0d2f6a5aa692ddac3cca5e5840bf7efd4d17829b4e0eedae5d093aae7121623
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 22.8MB
        • SHA256 466ec1fbbe1a8296597ebfef54359db2f647c4ea288928fc4b49bf72f106a780
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 22.8MB
        • SHA256 0898681725eaf6d79f9011c2276c41efc184c99024f903706dc6ad59f829d183
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 22.8MB
        • SHA256 a0bd2f12f68265315ce54b7e0435eddaed3e9ea202f7e14b61cbd17b4b3f3ea2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 22.8MB
        • SHA256 a7b5aabcefdcc82a49a999ccda42649ad6daa4c689ccab55da9bb9ee26911292
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 22.8MB
        • SHA256 628fac6319723a1200a0f4c2f994c5d4f5dcb97e21f119e8d61454d32bf84147
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 22.8MB
        • SHA256 fc8292f89581768f04741223e80ba1d56cee7aab1e2ef489d5ae9d429fe3ff87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 22.8MB
        • SHA256 8dc3c8e4e4d2a9d740eded60b6d7c0160209c02f82bfbccfbe9012e8a6c280d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 22.8MB
        • SHA256 75d23ad6cea6a0f5f47b86e94086ed821cbfe1aaa8e376b16d84dcee4a858199
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 22.8MB
        • SHA256 a88ac80d16735e3061838be8aac80172964dd96b15d32ca6b5fcc319f541dd8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 22.9MB
        • SHA256 6c216f326dc18e67f4b65e837debaa035b3d317eb35ead4fbd3c4340cc9586b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 22.8MB
        • SHA256 439fd42aa633c1263fb5a22e5397911115c365a3461e4dbb19806b68087adc89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 22.8MB
        • SHA256 99de92f6f412ff6c2e531e31881fe8fde64b4d4f0d6025319c039d045265d2af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 22.8MB
        • SHA256 ccd065ebd55b571bb6d133b46f362dde9ba7d1486f970c463450fc0259d33160
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download