Overview

overview

8

Static

static

3

2026-07-02...r_.exe

windows10-2004-x64

8

2026-07-02...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/07/2026, 18:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 10.4MB
  • Sample260702-wycafagy6m
  • SHA256 71dfcbd909f323b2b2b35b424f796a0668a4ae61abcdd6c531f225267493f624
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4060
  • C:\Users\Admin\AppData\Local\Temp\2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-02_1332ea2d2468273ef2933e85d35d1c5b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2064

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 11.1MB
        • SHA256 18deb11afe84cfde40ed0c108645b9f7fc58b2d1808a97199e592bb560c3cbf1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 10.4MB
        • SHA256 71dfcbd909f323b2b2b35b424f796a0668a4ae61abcdd6c531f225267493f624
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 12.5MB
        • SHA256 a27a2526d3043b29010d613dd3a56385261d33e2999ccf28ecdb3c4aa93552cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 16.4MB
        • SHA256 5d4213241b1e93552d6b15d427a2709f248e79a7c233c08bd712498de7dda229
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 12.6MB
        • SHA256 84505089b05f30aaba9a7ef1ab9b51e2743f041ee23cc00430f358db525d355b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 12.0MB
        • SHA256 8ef2ae0a8394ae0a93375fd9324f994977d2bd89dd113ee5550f223272229628
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 12.2MB
        • SHA256 e8dbe93cc0a9c49b809885a7d4a32b7d8b47878795bc2fe8c76877fd10eb8849
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 13.4MB
        • SHA256 155d13d09e62580497e3cff63f94f58bf37fd1e0310ed981fbf762776b40bcf5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 11.8MB
        • SHA256 8a07b4d2363eea7d855965d1ad7bc05db08b7d5cf8edead3b97f19f7fc5e5d3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 20.8MB
        • SHA256 78a826e0c78ae25d2eb8bb93f3260750d0d11c98895fa22eb6b1e1c4cd0b7ea5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 20.8MB
        • SHA256 bb115c8b8484560f2e3a37d5b277a85892102d957ed8670a6110ee05bd18e69d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 20.8MB
        • SHA256 35f63a46a10d7cfd2b63da23b4bc8bb6cd3570414b6d6899befaf60c3c766e7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 20.8MB
        • SHA256 fea91fe622a1f79524e32ee0f5a59aec8343923abc3a423d43fe0947f7013fb8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 20.8MB
        • SHA256 798ae1d8c122ccb8341cc94d4958e456fc0bf4d47dc61d8f9c935c0d270bf6b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 21.0MB
        • SHA256 7f0e48c5a5f6faf5c3dd0185d0d1d6a9f8db0baec3c04e644cf1f33dc5b91396
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 20.8MB
        • SHA256 90ba76e8ec0ee5d9090341a66897770897cc80c5da315fcf48b60e4d5c24426e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 20.8MB
        • SHA256 419c07a5c92c89347f81ffb4a28a2e167d1a88d8a32e789833066f2089c9afe3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 20.9MB
        • SHA256 e031bd0aa69a6808c4967ad1e1293cf0378083ce7d4e70aba0bda1691080b550
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 20.8MB
        • SHA256 126924a429db9a023f7268e26a0221aba16f798f7ef564548f33786a1e714b68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 20.8MB
        • SHA256 1c5f0b38beefbfcaa7e0459cb5285356f06645a0b04e4b80cf8b694c1b2aa634
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 20.9MB
        • SHA256 046fbee05bd754549dc6144ba253a0b44d467591d79dfcfc53e1d575f4cfc96e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 21.0MB
        • SHA256 33ad2ebd5df0c9df57d524d59642d75508bf65fc59ce46d9c1481032a8d9c489
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 21.2MB
        • SHA256 d5fc732ad1afa79e8514b1ecbf50769da45562ea80e1739ed6bd4f4a46c3a4e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 20.8MB
        • SHA256 9641a84fab7342b9903b347108c0b187f13a97d938194b9040d90597d46ee3d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 20.8MB
        • SHA256 36e0b2e10b9307d78d28fedf2f7201654f85bd98e9362244cc0299c03673cf89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 20.8MB
        • SHA256 e4a7db570b39f5f068fc913d4a09fef7df435304bbb05e0f55d2f0e807b10b39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 20.8MB
        • SHA256 97b2e0e46911d89c97945d889029ad7e554eec9bf7167ac620bd4acd248de545
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 20.8MB
        • SHA256 5eec1103eb641c9e533dbef900e5e0073f6fe531326a0fdf712f8e632d4613b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 10.4MB
        • SHA256 3bbe090e80e1c3c527ad104e2dd26913773b21c5e876620f979d11233383acfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 20.8MB
        • SHA256 aeb492737a3d7e533203c4d70540f8d6b496a483d2d431fc0df8efded2fe9ad2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 20.8MB
        • SHA256 af5a8e1925dced986aef1922e730a9d6a553667e508e96e2f220d678581666d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 20.8MB
        • SHA256 e1f84cbafc74c753ac7f79c3d4cbb2425719c6294e9659584fa39310f5e67260
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 20.8MB
        • SHA256 09d1c9d8e626c23f4973115a963a09c54d462fa64ff790c9ce2d750a25c42ab9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 20.8MB
        • SHA256 b690358996b0cec4b43d609b03fb92563be0d95b4188bcfec988fb660f09c119
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 20.8MB
        • SHA256 95b5e5fbcbf03c5dc383a7a552aaff509f6e2d0b5b229619a51e2249560901f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 20.8MB
        • SHA256 4db70774f5eac0c0a718b451391ff2746ab018fe226145d60d300b2cca201b0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 20.8MB
        • SHA256 8ecaac331ce73daf8843f4c70b94b96b201851f79521000e420a52b94f775c1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 20.8MB
        • SHA256 9790d8e994e362e6c5b3336ac35fc34866250f49fef75c1ddf01a96c34e6b9ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 20.8MB
        • SHA256 849d52682f3d904f5789a428b65e065222371356957a67602eeea4f2b099d8ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 20.8MB
        • SHA256 c766539d5becdd209a53e4b5cafa44ed5eae67d73e59eb98501350a5d5828eb9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 20.8MB
        • SHA256 fd134d40c9923a2e37a8aea4025c6f69c21f2cf0bbbcde8efb242ae5ce8755fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 20.8MB
        • SHA256 c52f30cebbaf3960f85ae4031f038120e46a0431c10d7f2380190f89b95b98da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 20.8MB
        • SHA256 2f1e0c692179a5d2c2f96e2dcb18c791bd06e5c7ffe83ea3cc783620ce27a7a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 20.8MB
        • SHA256 89fd56afa4a5f095554aa0b6701acac6abad30c7077fab338e076cb5662411b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 20.8MB
        • SHA256 ecb145fddc6e009dbed513ece28674e37f1d078c31178f51caa86df2dda94372
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 20.8MB
        • SHA256 ee9cee73a807a6220ae80eaff9c295e96bef364131a31bcb0c8ef43fbf1e9dd3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 20.8MB
        • SHA256 993f201042c6ea6502cfdca3cd69d941a218e4251d72a6239f6e19fd0cf13028
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 20.8MB
        • SHA256 992eb0d02f888643c01acbea2acd288aba03987e354f8d2a94d8aafeeb49f43f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 20.8MB
        • SHA256 75bb19c1d06f01ba1aec49f809acf63efb229c07c7b4866ff958dd272e3fb75c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 20.8MB
        • SHA256 062b6c75e34e7ad99bdd9a4d0cb6af1389a14847b1743112866acb8808136765
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 20.8MB
        • SHA256 8c7780b670800e2d250f3ee307fadac336e4daaa6049c6d4cce52f0e3fe38b02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 20.8MB
        • SHA256 0319927d132aeffd29e04e3f14e29c8525695726465b6d47dfc4d656e56228be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 21.0MB
        • SHA256 35724b51912f2ef6a87d51175c997d6a10ec82e8d68a06a4e6ed6f2c6ce21450
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 20.8MB
        • SHA256 654296e0f872b34d5d4d7632545d014b8814e601750f2a87d8bf3bb3f60e337a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 20.8MB
        • SHA256 a2d81e51596c7d63750cdc6f5d73a0272751968800c5ecb049d79bb49a16fce5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 20.8MB
        • SHA256 dc1f08d0e684634e89fc832e01db16559479384cbe67bf109454446f048378e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 20.8MB
        • SHA256 e73ae11a3bff6ebd86c85bd90ebb5261ba62c77b9fd1bcc6af790455aba38727
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 20.8MB
        • SHA256 085e07e33803ec588e35c1385e7ec3e42531b88f4cef3116344973249e24641b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 21.0MB
        • SHA256 66ba889b2c219916c1cc484b6c4db7b32e7b462e8cbc40f5effa8188805dfdb1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 20.9MB
        • SHA256 84cc41b787e9da783fac0ba8fb237b94973ff7090b4e04fd25eb09f40f02eca4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 21.0MB
        • SHA256 4ed99886b68f8c9e11f4107d7fad6fa1332ad688615519aae1a980ac66e82163
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 10.4MB
        • SHA256 44033144ecccf07f03ff77ca9707e07f56a6d4b90ae8446e7ca37ac459f447e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 10.4MB
        • SHA256 2327c6710e9e8baa2e626e58cdcd0488d2dbf5ab940267aa92480f48defa0897
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2064-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4060-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4060-4-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download