Overview

overview

8

Static

static

3

2026-07-03...r_.exe

windows10-2004-x64

8

2026-07-03...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    125s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/07/2026, 02:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-03_8cb2c5a0f604a7197ff318024a371400_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 29.9MB
  • Sample260703-daw1tsav8y
  • SHA256 965e9b0cafb682a4184e8dfac6dab41b8a8db103871b43c0ea81068d93b7151a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-03_8cb2c5a0f604a7197ff318024a371400_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-03_8cb2c5a0f604a7197ff318024a371400_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5276
  • C:\Users\Admin\AppData\Local\Temp\2026-07-03_8cb2c5a0f604a7197ff318024a371400_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-03_8cb2c5a0f604a7197ff318024a371400_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1268

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 29.9MB
        • SHA256 b320d97dc7c48a7ca518229c85e07ea231d3a412163b3bbded79feaa6bcc4a3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 29.9MB
        • SHA256 965e9b0cafb682a4184e8dfac6dab41b8a8db103871b43c0ea81068d93b7151a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 53.3MB
        • SHA256 5927d5972969417fb6bd104aaa3b927f5a1cbda1bcfa562301ff114dea3ff215
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 32.0MB
        • SHA256 34cfb0457d70c1e393605cfe58eb066f7ef49983d013d35b4ea95c0a750a92ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 59.8MB
        • SHA256 67dc0a8fbdd4361c653cb43312ec5cbf0253e724a9472e60e3916be79301b4fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 65.8MB
        • SHA256 ce361a13f923111a56e521afb70cfa4da780ce5dec9390a02f978d8bd2bd125c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 63.2MB
        • SHA256 dbfafac7a4e97a461e10f802f1c518b3cd81dac3aadf637b1b18b48fe244ad9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 62.0MB
        • SHA256 de24c89ead79c22fe20d7694424274818f388fa82536d093cd12b0c2d0a886a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 61.6MB
        • SHA256 5e908bfa05d7f523cb02adb090a73ffd5f85c09e7a9a96f587735d896b389e05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 62.8MB
        • SHA256 d5806711baf46e1bbfcd5e1ff11c234aa118d7844f38f14f58858ac5dc680f61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 59.7MB
        • SHA256 554d9fc78de183a7e755cee48121775652b298fa05158ccb31f02c4e0f8b755a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 59.7MB
        • SHA256 709c09d4e0ab26a501b2ed835b343311cdcb20cf1c91040408af7ec6f1bc2f2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 59.7MB
        • SHA256 0609bd16a8d141839acf702b0bbf6308df950006f8b548634b220438f358c13c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 59.8MB
        • SHA256 7ce6feb96aed14d06a9d9c9f7ba6726a6d23f12b2d981e47dfe6f7b6acbaddc8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 59.7MB
        • SHA256 ced6da2e4caba1b18c7ab68b0d660c400f45a4c7abf38613ef442888f64a9e24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 59.7MB
        • SHA256 13cda0a5d2b55fc3500b1a27a57ce1be267c3cd1c6f1f7f2a007f31122016845
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 59.7MB
        • SHA256 c9703882346602a32c04f1d49d23739d7af4ddfd9cfc2cd67cae9ca03451a6ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 60.0MB
        • SHA256 0dcc620dd7ef274d6fbd78654f47c60451e6eee5255fb6299176ea6e4de1e748
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 59.7MB
        • SHA256 2b4671e4f4c4b50bb3f26f7fad067a9896fa665a87b0384765cb4e30c70e1d74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 59.7MB
        • SHA256 d56ece1cd124bd3b98d29ea512084c57599d1d015cec8944cd28fdbfa7db862d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 59.7MB
        • SHA256 aedd13a26ff3d4111fbfaf020ba7cb3a5d7d653ab647a5a09520cda8d7c50aa3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 59.7MB
        • SHA256 ff14cabf842c53d9a03b18efacd7b6ed19487936df754638e72461cb5d8f8030
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 59.7MB
        • SHA256 638c5fca37642d7466db699098dee7894e271f6ee99fbe2dece62d34406a3ad1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 59.7MB
        • SHA256 b5d0b6e1029f49c8c919d2a73eb5943af5dec5560077653fbfa4d7c3718773dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 59.7MB
        • SHA256 a66a55069304a37e30f7e4187bb90c4efa45f9ddb02a3fa387beeeb0771f3621
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 59.7MB
        • SHA256 50f14e13c4deae3d34c81f48761ecc6e3efba5837b32bcf7b7c4cce7248df3d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 59.7MB
        • SHA256 4ba7421db2040c483689411440109880945e92935137d1eb19bae8239c861cef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 59.7MB
        • SHA256 4a55b2d6fbc1fae05a122caf941eb0d1377f669a174b79afe1b1a49d1881aff3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 59.7MB
        • SHA256 26a0890792cddaa75d1dfd9e80a4a932b6ce2ea8d97010695727a98b96674352
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 59.7MB
        • SHA256 02a2b84521765dd65dd465db5f9b0c989bda357ed75a9be5e30d1cd1e2333814
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 59.7MB
        • SHA256 c9ac0d47be1a0fbb629f4069be74ce6a46696674dfae398185a5e8fa665a4cd8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 59.7MB
        • SHA256 76f739a776a298f576a69fe5dd53af4ebed30eff3c2a4e683b7c20443c11bba3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 59.7MB
        • SHA256 a86445a2e89bd427e98f4016819c833f2b2a2ce1a67a67a4d49f48840d87d467
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 59.7MB
        • SHA256 58b37f5a74b8bac6097848acdab548f454ed9ae2196361296343bed501fa880b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 59.7MB
        • SHA256 58a45e5ae24e357c1531aaea42ec0bdc36281e36b013ce754b7987de7c45035b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 59.7MB
        • SHA256 dede46045f0f754039325381c68b6c1364047c82ad077bd51f5ae581e5861926
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 59.7MB
        • SHA256 4e65977c76719adfa863606bd3fe5a2b12cc6963de990b764625e3fd95c59d36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 59.7MB
        • SHA256 89d7232f226e124db09bef67902851e3ffe22036aefd1491cf9dc39bee822b81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 29.9MB
        • SHA256 179bd4fd10a86549d9880691301d4b4d248359dfb888e8674bb784748d44eda1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 29.9MB
        • SHA256 b20b3f72cf6c5a2daf0fed0075fa9628223a415ea286ccb7f7834a397f17528f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 59.7MB
        • SHA256 6423a6718e6d35a5a1d66302182f1f6cac76fee2690f573d5067240521c608ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 59.9MB
        • SHA256 cf7771655fc19acd1842dcec2b7ee622451b77673dc8c74120c70e825ede372b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 59.8MB
        • SHA256 6aeb7658f5270e0cd4ee4552e1e47fc5ffc681be6085831cec88592fcb753b5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 59.8MB
        • SHA256 186dad596c3775b1576589e5db988bd10456722676c62cca33e9ecef3c29d731
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 59.8MB
        • SHA256 851cab4d0ae648d45b71d8a75945c63a63e70e66ba9cb3887e4b32131d3e3275
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download