Overview

overview

8

Static

static

3

2026-07-12...r_.exe

windows10-2004-x64

8

2026-07-12...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    115s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    12/07/2026, 13:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-12_23fb4e4af9b7b9d1fec60647f48027e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 5.9MB
  • Sample260712-rap46sds51
  • SHA256 4c1de637db20c0795d0175818049e6bb3bf3cd55cb1b47c02f4c2788f949559a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-12_23fb4e4af9b7b9d1fec60647f48027e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-12_23fb4e4af9b7b9d1fec60647f48027e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:6060
  • C:\Users\Admin\AppData\Local\Temp\2026-07-12_23fb4e4af9b7b9d1fec60647f48027e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-12_23fb4e4af9b7b9d1fec60647f48027e7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5672

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 6.8MB
        • SHA256 c187a67f3d1b8e200c9710cd1452fca4a7351ad2c29d4eb09f3aa1284999ab1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 6.6MB
        • SHA256 5863ef77e543897a33a1c09818c5c6ab9a68fc568310821571ba7949e7d511ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 11.8MB
        • SHA256 299ca545ad2fb40faa42725905c81b83bcf4e020c67ede101e0aee0dcf2e0652
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 12.1MB
        • SHA256 937c17a022627f50910b9c9d69eee8b517ea360ea3b921f51d929b831b1e10da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 11.9MB
        • SHA256 269997b5c9e28d092cb5c9ab73d3afb314fb5543a8ad447b15076eeaf26f1860
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 15.9MB
        • SHA256 cb826b1294d2c68eaa1309765064192ae2f89db3629699a7a2fc7b5742b53f04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 12.2MB
        • SHA256 87880500a8c70dbec55a926910db227b41077bb8e21862792eaa8ce517e3fc21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 35.3MB
        • SHA256 642d15b7b00b390b6143b7045da9644fff2b9ca2bcb7f38dfe8f617d8c5db05b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 5.9MB
        • SHA256 4c1de637db20c0795d0175818049e6bb3bf3cd55cb1b47c02f4c2788f949559a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 11.9MB
        • SHA256 2b66a906c343188fccff39f9c5cf9488eab39b7e9a21a00971658671407f6f3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 17.9MB
        • SHA256 4fc3e4f51bde2bed5115d963b168ced5716bcd9803caed81380469c3761c88b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 13.5MB
        • SHA256 4fbd18d43607a49a1da1b5662728994381a655a830d3da8abcb3c920fa8b7716
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 15.3MB
        • SHA256 e88cf705c8b5f63f1257e6d8d818d14242323fae779d5ca4e94cbf92bdd196bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 14.1MB
        • SHA256 3e9cd7db140fc81c1f20cd17f24eb9415fc384d7f4a0721da8d3c85cd0551e07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 13.4MB
        • SHA256 556565e5d0ec6816f0f3fdddf0f1d4d02353bdeaa6e12fd016cb3e30a804e448
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 13.7MB
        • SHA256 2d6b94970dadfa1ef95712ad4484f5c68ca730651c74fe6a274e1ee64aa7d496
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 14.9MB
        • SHA256 cc0cffc00c7524ff2dc8fe19a015d2141506764ded689691d678356a9f7a5813
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 13.2MB
        • SHA256 95982aa884371aee26043490e13540720721cc805fd12bb031277d12ddb9a147
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 11.8MB
        • SHA256 31fc4876959dc5fc4b0a5a04fed2eb2afe4e740ec4d76875029b8384930296c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 11.8MB
        • SHA256 0215f5f3fba0ea168adaf9e4e780bb980ce4eb3c8a94f645d57e5f23e0a628e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 11.8MB
        • SHA256 b653cad10eb00187748e311e00b292f4d8da022217cf57bb08857c288afdbeb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 11.9MB
        • SHA256 90fa0b5cfda297b1f05d73d9d407ee47ff30fd2bdd136fb718e33930a89d3d12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 11.8MB
        • SHA256 edc7cf3f00d591edccf47216cd08e795db74e03bd4247d5af87ea956bce28562
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 11.8MB
        • SHA256 19496390d2bb5e404d46c84ae01b0311a6e8205b36793c0e248ca33785f9dd24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 11.8MB
        • SHA256 34c36ffe368a0f87e0e930632638e84d05d5234174159caa2dcaad81dec101f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 12.1MB
        • SHA256 4c5b2907ca14321d88723aa32768459ababb3a16b9bfa02ac001221bbf513181
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 11.8MB
        • SHA256 fe50123b5231863f4fdaf7fcc84331136212ad0c7c31ce2875124e56f40bebb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 11.8MB
        • SHA256 b6cf49738a2a2697944e68dd8eb3168f45ebb3969d117006bbe80c53c0b43c36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 12.0MB
        • SHA256 dca0c60d7d35f2c77e2fec44fe5c8024466b3d3d98a08eab0c37f552b6062208
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 11.8MB
        • SHA256 8f0f5577ca687120ad681162780fefd05cf93670d82cb769aaf4f0ae50643e5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 11.8MB
        • SHA256 04b1f8f2285b1395be440cffb39e6574241a340db9068c9ecaa35e0251a27615
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 12.0MB
        • SHA256 495b8253f528541b41f764db19bb7b31ce3e13785c170e7aebe80536f5c6fc36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 12.1MB
        • SHA256 5463d26eedb4d787f4cffa8315c3e8c3194d65144ddbe999a6ef15b07dcd02b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 12.3MB
        • SHA256 a652d71c22c51f5062d14037ede671c129dcce1d0d4ac4df7dca0ba53798ee4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 11.8MB
        • SHA256 53e4175757d14ada42057db0c7b1a552198f0fb8f68d7053ee0059b5bafe83a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 11.8MB
        • SHA256 de2b7305a855acc8194ba0a5ee43bedbca7db4950409100388284afdbba62617
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 11.8MB
        • SHA256 7c4c73d389588d6a04da2ca756db33268d65a66dec09fd545fe282f9f1f0c43b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 11.8MB
        • SHA256 d3f9ab4d0ac6b39e4f9898bde399594fe4b342036615995aba9d98e3a9c7857e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 11.8MB
        • SHA256 1b530deb8880580fe4359b507b24aed1f05466a98017ee92ee78b457250546d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 11.8MB
        • SHA256 2293cb5d571b60ee8598e47ef7f45daec6dd0740d3c7aa7676986f5ddbe4a731
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 11.8MB
        • SHA256 207b852f26d724f4caa35543c220c79c9fcb4ca9f3175a5d9512fbebef21ea27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 11.8MB
        • SHA256 cd07a0baded1c284a762cdd3b1a1e1c8f23439905a5d605547b072fb4f6ce0c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 11.8MB
        • SHA256 73ab7c7d3c12398d4f4332f6f0653f0e1d16a9462f5f252ec66460f872ffecc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 11.8MB
        • SHA256 b49a0447ac1961387f78f3be596a7d98b330ebfbc9746f963ec9586d3bcce089
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 11.8MB
        • SHA256 72b059aca65c6b70fde2b11efd7dc75278b792329009c00dadd7d31826fb3f91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 11.8MB
        • SHA256 c8b8229b473df555f52796913e317c8eee0776df4c65ec6dd6c9fd0a6691b8f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 11.8MB
        • SHA256 d4d17976a4726dc9b8959cd8d4a9368f0047fcc8430ac155351325a988decc12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 11.8MB
        • SHA256 aa3031a488cd1b273ca42b1d9ea5a81aa882f7cd97bf7f6b2e889318e9ff51ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 11.8MB
        • SHA256 299767904e7164e577450dfd57de4510bb2d238d990bd44ca474abc97f10a8b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 11.8MB
        • SHA256 ac02a3489a86e638af10d3316957ee66bea7c304c78591aabac8d422fe1ff570
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 11.8MB
        • SHA256 341070d2cd684b4be008e75209798c071e92cb5212bb0aed87fe8cf363ea9259
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 11.8MB
        • SHA256 0e70cea2bdca10fcea72bb3c55c4b248600e7801971d39fbd78e61001249332f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 11.8MB
        • SHA256 c78b17706a297598754176ae1fe8fdb6dd777f6703e8e36b06a0558e02c68db6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 11.8MB
        • SHA256 d2b8c8d7a48977a6f600ada129cf56dbf3c9ba3686a28b9c3c23db448cc8ff2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 11.8MB
        • SHA256 122d5ffdc2a7e1f920811e99c4d89b6ef89e8762cf94e45fffd8ea16cb919efe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 11.8MB
        • SHA256 45f990ece978f9e5c234fd63ee41e4ca9e6bf7b8b2927a5ac0596dbd66a36bd1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 11.8MB
        • SHA256 664328cdc6e9192e3588c3d8afdd8262a5842207c7942a198fe33dd42e49ace2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 11.8MB
        • SHA256 0810a16316059e9462601c718b461a7f14b0d6ee007b7849e63728947d3a53db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 11.8MB
        • SHA256 369ae089300e83d65030d497952316df39f43ebe0c9d9531f5fe75e84ccee878
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 12.0MB
        • SHA256 9ba7bfe074927af2fe8ea6faa14465e6a77491b550fcfc73ac4db5afdf48e128
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 11.9MB
        • SHA256 b757236e219092b1e2d38135dfa0fff6bb379a8ca8e4f4d56ceae4f9b3fa19f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 11.9MB
        • SHA256 4e8814a9c77c6c927cd32f597702372f7f772d5d2d100657e730b1c3679f9eae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 11.9MB
        • SHA256 fc9372fe17089141bad08d49648188378d5a0113a23b9e184fb735f9e8fb7145
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download