Overview

overview

8

Static

static

3

2026-07-03...r_.exe

windows10-2004-x64

8

2026-07-03...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    03/07/2026, 04:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-03_1846c53fcdc72e53f86352b0c78f2b2e_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 41.6MB
  • Sample260703-e4xd5abv3t
  • SHA256 7ec80a86b19cd4e3617a143232a148f55ea0f698dabf68bb0940d46921bb1867
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-03_1846c53fcdc72e53f86352b0c78f2b2e_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-03_1846c53fcdc72e53f86352b0c78f2b2e_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4640
  • C:\Users\Admin\AppData\Local\Temp\2026-07-03_1846c53fcdc72e53f86352b0c78f2b2e_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-03_1846c53fcdc72e53f86352b0c78f2b2e_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4744

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 42.3MB
        • SHA256 cfe5af4eeb8b4d992e8eeadc580961c442d2da032a40f06a0876ed757d3a5125
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 44.7MB
        • SHA256 734260d9817c08ce28a76051d56cb2555ce75587cb86dc09c641cfef18000303
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 41.6MB
        • SHA256 d6dc35001a45d7c40ce28fce26ee165fdeb71cab46bd35e2985f0f62ef3acde9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 41.6MB
        • SHA256 838109df57b2c572f7292990108268232d8907cfb21b2ba770903e517e250e1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
        • Size 41.6MB
        • SHA256 a5cc93a9b27bcc0218ddba0cc1b9e652062068d12a37c6fcf7ace0ffd57f2de1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe
        • Size 87.3MB
        • SHA256 62c29cc9739e4d964bfacb3efe3c4589f5127c79e9ac8871d6ac437cba0dbb68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Common.DBConnection64.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe
        • Size 41.7MB
        • SHA256 5fb1e0b0e778b15b2f8f0bc5f55f6650d83809481e74238e7bec793a057fe0fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        misc.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe
        • Size 42.6MB
        • SHA256 e5c4e2a411eab11885da124aaa0eda8a5e408f08cba23f70f21ecc9f7a095724
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ohub32.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe
        • Size 43.5MB
        • SHA256 a49caffbc741ad30032799830f147c6cc77fbf111592c7a34d3d1a020b3fc41f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xlicons.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe
        • Size 45.7MB
        • SHA256 5d2fd74e3b519d41d5fbb88b25cb40806f1618eb45d5faa2f46a1bf49d8a41ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        misc.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe
        • Size 84.2MB
        • SHA256 27b1afda5e6daaec8d8b48ffe07fe1f9d001e9537881e05a0afc5d8bb71bd715
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        crashreporter.exe
        • Path C:\Program Files\Mozilla Firefox\crashreporter.exe
        • Size 86.6MB
        • SHA256 48a490dae672885d4bac096101fb3a7aa034afcc239510f35f7a39cd82112e01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        default-browser-agent.exe
        • Path C:\Program Files\Mozilla Firefox\default-browser-agent.exe
        • Size 83.2MB
        • SHA256 48ed6ed12fbc828721b037a78b542f3855fdd1742d102aa2d4753df9f8abff29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        firefox.exe
        • Path C:\Program Files\Mozilla Firefox\firefox.exe
        • Size 83.9MB
        • SHA256 4e78745ef25cc8464c832a724d75d345eb9399287259d31bfcc29a093a56de37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files\Mozilla Firefox\maintenanceservice.exe
        • Size 83.5MB
        • SHA256 5fc0e19d0e91b95e974f166894a7e70642439fe6e2717625ce17f3d4a0b80e70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice_installer.exe
        • Path C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe
        • Size 83.4MB
        • SHA256 9d7156eb0057070f9b58b91220a5234d463f731707d500140ab62ad916f3e438
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nmhproxy.exe
        • Path C:\Program Files\Mozilla Firefox\nmhproxy.exe
        • Size 83.8MB
        • SHA256 77d4a60910e163a6c691101c75b5c1743bea7a34b713af87eab6779b5b6b32a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pingsender.exe
        • Path C:\Program Files\Mozilla Firefox\pingsender.exe
        • Size 83.3MB
        • SHA256 5826f4fc84fd55421408db06cc41b92b2549d18efc6490130a32a80972b2989a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        plugin-container.exe
        • Path C:\Program Files\Mozilla Firefox\plugin-container.exe
        • Size 83.3MB
        • SHA256 e0e06488f8108bcbe6afc5e83759089f8461abb80e0ff778f84ff1d2414400f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        private_browsing.exe
        • Path C:\Program Files\Mozilla Firefox\private_browsing.exe
        • Size 512KB
        • SHA256 fded04c6d782f8085d397cfe282605c1f1fba531c6920ee79072db343ae14316
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        helper.exe
        • Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe
        • Size 84.6MB
        • SHA256 a8658c02e637ea1cd6afaab161f3e3a5648f8cbdcb5326414c7cc1b0de852480
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        updater.exe
        • Path C:\Program Files\Mozilla Firefox\updater.exe
        • Size 83.7MB
        • SHA256 0e2ebb40e87c5f31199d9de25c83063f0604cdd7c4ac699b7098921d055396ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        uninstall.exe
        • Path C:\Program Files\VideoLAN\VLC\uninstall.exe
        • Size 83.4MB
        • SHA256 d7e40f95fb30c35f01d8fcb249147df41d79216613f4db2673afeec62a16599d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vlc-cache-gen.exe
        • Path C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe
        • Size 83.3MB
        • SHA256 579e7a015b30d4dff0489d583fa8af6ec083b5c875b768f5e2715df3fdd0504c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vlc.exe
        • Path C:\Program Files\VideoLAN\VLC\vlc.exe
        • Size 84.2MB
        • SHA256 28d8f99d0abb5dd4fb581c0e8c7e32e22ee453acbd13e9bd076b20297c2259ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 41.6MB
        • SHA256 7ec80a86b19cd4e3617a143232a148f55ea0f698dabf68bb0940d46921bb1867
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download