Overview

overview

8

Static

static

3

2026-07-09...r_.exe

windows10-2004-x64

8

2026-07-09...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    139s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/07/2026, 16:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-09_cde48021b3fd21b7f9df9c24872ff391_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 16.4MB
  • Sample260709-tx1wasdv6m
  • SHA256 882f9b37fcc392e0f27c39b4e1246f0245725a1124dd222693cb34f34b933241
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-09_cde48021b3fd21b7f9df9c24872ff391_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-09_cde48021b3fd21b7f9df9c24872ff391_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5108
  • C:\Users\Admin\AppData\Local\Temp\2026-07-09_cde48021b3fd21b7f9df9c24872ff391_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-09_cde48021b3fd21b7f9df9c24872ff391_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3008

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 16.4MB
        • SHA256 13cecaea2b2b16db8a4f6f8653955f34c45b52d69605d06dd1d43f22eda97535
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 33.0MB
        • SHA256 fb9837dca68d381b7a302e53fe0791c3bcfbb8576dac1ecd5096d43ea2cb88bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 32.8MB
        • SHA256 cbf2f8a08e85cba767fea4036f73372139054a6d7efb6516a5b84e126a02273d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 36.8MB
        • SHA256 3401fb8bb06ff5bb46761c7793096330c8f1789369774e2927daca1a90ddcbcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 33.1MB
        • SHA256 d21c15fc0f1ca9d8a01603422c4a58211c938b33f0147d4be2a97a4a6d00cfcc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 56.2MB
        • SHA256 07a9dae1bbea68c82acb905a1b8083e7f187132088edde8a26f7c7a8f1852864
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 16.4MB
        • SHA256 882f9b37fcc392e0f27c39b4e1246f0245725a1124dd222693cb34f34b933241
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 38.8MB
        • SHA256 81ffc3e6923107b4ccc0bcd8549d3be0f3ec4d4afc82d962885b5c2500f4ece9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 34.6MB
        • SHA256 30ff8b98407b7f18984b0eaef46c1ff4e20aaf7769a790844786a49699caede4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 35.8MB
        • SHA256 54e18b92681f02e985874abf6bfc10e8e9556c9d9a384462c5b3dec5b71d29ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 34.1MB
        • SHA256 7b3b4923746c0e7100889eadc0196960ebf77e12393c50586b34b0813f0f54dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 32.7MB
        • SHA256 271bfb7058dd30bce491c445b3492eadbed0f1c38dec6ecc3d51fa990ed88aaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 32.7MB
        • SHA256 6b1721b1e0cd76fd550c5882118b26c072efbb7a20beaedb77837525feea0250
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 32.7MB
        • SHA256 d51c1819463e52bc3b9a0469446d12f2b9adb6adbf063c9368bc3b023b1c4ea0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 32.7MB
        • SHA256 9816f9334728437cb4c3061eadf5153cd086acf02f4256959500f7c5579215c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 32.7MB
        • SHA256 05cc8488518dc0df11ef908a184e9c7415e4069c9f714eb9be0ebd9b5fe351cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 32.9MB
        • SHA256 437af0bd33d5bfeb547079b7104a34e8870997584163c6c0bef8adb069f80a8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 32.7MB
        • SHA256 d4faa1bee9c99657f616603464bfdf3d88c9f6743bcef138e05e7ed85ffe6b40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 32.7MB
        • SHA256 6d442e90cba1281c2f8b2a5d15e95adefd2b57174f4eb6a96d37a11143ce8f87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 32.9MB
        • SHA256 19c52898da824e36aba7cfb6d7792001c64b2cb04892ca84e59d47f249f4f199
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 33.0MB
        • SHA256 45a06c1c99e92de117fd639193a07bd418bef3cf3bf009877b321de11769e9b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 32.7MB
        • SHA256 0ded206bdfae2961aec746ab926dc627942c25f9940efb8875a6bebb8a189cc3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 32.7MB
        • SHA256 47086cd02bc20146a48ff4d24e82d9212aac6d22c9dd0c982756d825b342e1fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 32.7MB
        • SHA256 ac36827fa0e1a5a097e856d8d5ad2c8d30fb75a29db03bf07892c61e70d3d239
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 32.7MB
        • SHA256 b31d6dec8a201681add2afd6fd525371e7b99dad8f498728717329813a372c17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 32.7MB
        • SHA256 4169bed22447e874c39852945ce37d0f28ccd062429bd1e05139f794f12f234f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 32.7MB
        • SHA256 383dfe23128cef7b1498b96238e7a357da13bbdd94ce9126f4e03ad8b249887d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 32.7MB
        • SHA256 069fa4d6bc54ecc95f0d3116c641200ceced323b64dc6bd4e70d4d9866a4365d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 32.7MB
        • SHA256 917fdca1de6cbbb4003e78ee8635b95396a373845aea1ab6a5481e8abdc7b917
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 32.7MB
        • SHA256 4f2d7e896228682eb5e31903bad84d69db1109e7e1f980f8ddf1fe000ab1fd21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 32.7MB
        • SHA256 0e9d7efa56d4c67ad9c043e18adab86baeab7ea8e93ab187b5bb3014add5fffd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 32.7MB
        • SHA256 c133fd8c093b8b24867f7b9fcf026bafeee36efc523186afb9becb95ac22ab5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 32.7MB
        • SHA256 578f618a69f3e053c0abf80bf64f8b66ae363c8689bf8512cea68fabaf289fca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 32.7MB
        • SHA256 03a0f004046f26b8472e4fb4cbc54516ecaf4a48f12b3eab65cd132aa2132158
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 32.7MB
        • SHA256 e344aaef1c13fbffd62f84350c2850db9ad8e0ad3b67558f74812a7ef2826412
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 32.7MB
        • SHA256 1e1f91109cb46b061fdc2bb330699cbb1035fa905bb7d7631a668604c17a6c23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 32.7MB
        • SHA256 13e01cac5d38231a1eea3063e47269eab0d18f3f1328f8da236872b203e2c72f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 32.7MB
        • SHA256 030d9cab9bb6112031f17b7288d4c0fb57b548880b40bb669f5ab78b52c0676b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 32.7MB
        • SHA256 4265d86d5c257e6a85e30a8f3ef220b6466f0d01a2a19d740c08bb8dac716053
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 32.7MB
        • SHA256 9f81c6369f611069b418bf96fa09807d318a0a0d023cc3a226d9df8d361807e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 32.7MB
        • SHA256 cf30569f899205e4ad661760db7f7aa4b9fb3d48a0c1fe37eb4525b943fe5226
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 32.7MB
        • SHA256 010aac1920b9845281d25bdc6a19289ed403b1032025df902366b1bb8b0019dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 32.7MB
        • SHA256 a49ea10fc9c3a2177100c63d26955ddf3976af63864d82ac639c416d0e91d3a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 32.7MB
        • SHA256 79a11a9334c2bf9bc933b5f75c92477e0e6ffd18d7c9510c094fc627b90f9a49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 32.7MB
        • SHA256 2b99fe0c138ac400925c44e33b507dc3831648efc1d1050cfdef425992d2bcdd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 32.7MB
        • SHA256 fb6b7b30c8573c4417b0b5d45eb664e1073bb6f6bb81dde1342b13e0b77b2fce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 32.7MB
        • SHA256 d35dd923e40cee9d540977861587e1a33735fbeff28dedaa8bb8363fa6df35e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 32.7MB
        • SHA256 d45241ced41ce132752e773347b1016a1ceb3d147e16863dee9fe321d081d8ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 32.9MB
        • SHA256 838d93580a93ae01f3fb90affbd52a755a70ab941cbd30882475c31e7d9fad99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 32.8MB
        • SHA256 2a7734fd560c5339a13a7219d63cb4f317e97935ecfd0bfeffef42f1b7cd919b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 32.8MB
        • SHA256 ae92108fc1ac923f7c5e6efebb4495f372a92334b6341ba616485efce302a53a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download