Overview

overview

8

Static

static

3

2026-07-13...r_.exe

windows10-2004-x64

8

2026-07-13...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    114s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    14/07/2026, 01:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-13_7241acee94ab3f007ea027af181ba21f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 16.2MB
  • Sample260714-bk433sd15v
  • SHA256 582a7d761fdd48e1b51c2182debfdfae76feba64c27cd52c362fb1f441c1121d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-13_7241acee94ab3f007ea027af181ba21f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-13_7241acee94ab3f007ea027af181ba21f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2516
  • C:\Users\Admin\AppData\Local\Temp\2026-07-13_7241acee94ab3f007ea027af181ba21f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-13_7241acee94ab3f007ea027af181ba21f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5844

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 16.5MB
        • SHA256 cf601ca7409043f9a0ae3cf89c9052449979af3a4251ee3bda6b44b4849f46b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 32.4MB
        • SHA256 6e5f56e6f5cbff9dfedda9a0adddb6561481773f1fcb623f8284b2881a523456
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 36.5MB
        • SHA256 835f342fc7d70709e84b0310daada479dad2f06fb14e5e9c3d12ee628bcab2e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 32.7MB
        • SHA256 4247c8a76926e71604437554b451fd9db9db0b47a3a367346cd49f6a46f11f9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 55.8MB
        • SHA256 1c06dd9d61e45d95ed6bb0b61350535ac68de604f587cd3dcff87d636747c3f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 18.3MB
        • SHA256 197d1b5764ea8a708823fd9744d83c51d147f8b1f67b7f54449fd92a0e82b74d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 32.5MB
        • SHA256 cab0384c0d9abdd566eb5a05d2927c410298a4584cfb722763cea51a5319c297
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 38.4MB
        • SHA256 f1ff5f71c292dc0696c28545b7e1ace17aa66b6ff72f6821d0dd806b9a52309f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 34.1MB
        • SHA256 94721a187565808b2fa01405049582fc9810e8427f832e7a70ccb0881150ae81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 35.8MB
        • SHA256 0ca57f1f5020df23e67d66f9ebcf5664e9361f01ad4230b7662744bc7e649f4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 34.6MB
        • SHA256 4f940b854986c3f060141cfeff88c259453f2460b76dd5083b2799ace475afe3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 34.0MB
        • SHA256 71e4eb6f1f1fa04192cced843167717b1703f545882782f950f3e9f989a32d58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 34.2MB
        • SHA256 3a23a8c11618c7a44ebe043bd987acdb8f574af3f8f0035c4c182d9e01959a7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 35.4MB
        • SHA256 24eb682ce0376a4e56d03a5552481a35bc1c8d9f72c8b69a710e110d78288d7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 33.8MB
        • SHA256 6e4761ea1f1982ce6f6fe684864fd582d5c78d23d92b73f39795d236247165e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 32.4MB
        • SHA256 b7cf114edeb538a80fe278a1817a33ef71041b9978a018e666cb4c025c393fd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 32.4MB
        • SHA256 4ff0f6dd391507ac46e029a7d08db003d53b98305d00f05a1e9e643756fa3b10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 32.4MB
        • SHA256 075d9d257a4c7a1ae221455949def2f68190643e4a9b2272d4b36fcbe2f1b581
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 32.4MB
        • SHA256 7d30810456f542c071a5c438b7491548e32ff7ad093fb4f004d13feb60d21e15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 32.4MB
        • SHA256 22a21a747b0d687de57140a3b9cf8b00b69ab9d98266dc53db32970982dc9b81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 32.4MB
        • SHA256 9cba5f0f10305e49add41a055ea1c6d8c1e94ffaf88924448c5658e9416d5657
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 32.7MB
        • SHA256 fad6fd9dfcd8a7fc302383a8e2b50e18749383deec6d16039265ee66c852bc25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 32.4MB
        • SHA256 b4551ca7749f92cf4c8f72780a536308ed259b29611718ee8837994380556a49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 32.4MB
        • SHA256 f9ad584d6b4f8288bbf69043f96b54839e0c785b60ab60e7bb673fa86ad0bb5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 32.5MB
        • SHA256 24e97bb8672a834dcefa00f705a8897b3d28be47c0d08b6d9191cc7735a7ab80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 32.4MB
        • SHA256 75aa26008654fc9dc0525f1b763e6909cda54c8b61451e175b84387b569e5f5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 32.4MB
        • SHA256 50e8206f30f016cde840f43d067f13710b2afe7abb4741612ad8db994af15384
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 32.5MB
        • SHA256 3ad297810d5a403a5e1c2bb623f1fd8f8b8f16cd929279c575dd59544284c80c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 32.7MB
        • SHA256 f7da44fed0a656e0487947b3f10a307c661a9ae1e7384cdfce85e0c73fc151ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 32.8MB
        • SHA256 7bef6ccb722ff44aa828a4f222bb3785314c6019640d04ae9199ecac61232673
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 32.4MB
        • SHA256 e138c603935d55b73d4e99fe81818b0a5bdf83f3732df7e54650a40d83959e44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 32.4MB
        • SHA256 868d4da421cdcce37be30b4037f5b54e9c39887195fc8f2ed68bc4728089f6db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 32.4MB
        • SHA256 fa64cd3cab990916e790e1da8f5cc9cfbfaaf0c81888fa93fcab32472c78904f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 32.4MB
        • SHA256 3bca85a76c8fffcd47afeff45267b564614ac6b2339fc07020ff5a9b49629ca4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 32.4MB
        • SHA256 fd000c0cbeba82c0d6cbc5c4daa1593de3bf5d4c5136360361464d17b105626f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 32.4MB
        • SHA256 0ec4fe853dce58ec1f04fc436213e72a7531652c7a0683ba6e12badbc98ebcc3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 32.4MB
        • SHA256 d788ef512f8fbf44425f210cb234d17feb4e9f30923ba49d4e9bfebe27ffeb88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 32.4MB
        • SHA256 1906291919f65cb0b44c976a0f0550bbcfd73cc6182959553228bfd318385b39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 32.4MB
        • SHA256 1c4cd935889701ec6cd7e0ee37a972a87c4239bc7c000b168987c87db2fda9a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 32.4MB
        • SHA256 52f86faa0b0f497bf6bfb28b642dce5bd3c80ea01ab52853e7ce85be7801f2ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 32.4MB
        • SHA256 54e6908667b74ca7034fe48c80ed67a362b31580ebb85fdd76b2e460ec1c0d4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 32.4MB
        • SHA256 a58078e9de9f18e26082d1bae6e3fad202cc55b8e76e85ac2285b8ea9be53405
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 32.4MB
        • SHA256 41c8c0189b36ab668c14c84624e1407889bb114d612fdd726d5e4fdd65c36f13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 32.4MB
        • SHA256 d2c63c9945ceebf72f71980eee7294e0e65c002a0e49a2b7aaa61d23957efabd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 32.4MB
        • SHA256 314d05d7ea3d1682be8029c3a5426bdc51d2d2ceba6f7f65c20b91178f5e84d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 32.4MB
        • SHA256 1e13fab1cd1ff06433f1c9ad0d1c0e88ac2faa0263564da538b708a5984154d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 32.4MB
        • SHA256 c2ccc4caa62cae129a584201fb8e4fde468c53d8e3a215077790ede946101fb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 32.4MB
        • SHA256 24e3ae5fc539c1139fd0f09eb471c5249a50c103cb0b1391889fa00e16a3d447
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 32.4MB
        • SHA256 26e0e394bcf8e39d9ebf80b1df48c5e9508167f86d83fb3d946c744820e50c22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 32.4MB
        • SHA256 138815d60eca0f31391c43a84e6dd697d48882cb28b44c6a901def5bb7ba9349
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 32.4MB
        • SHA256 6634a36011a9d7cbb3de28b0c159d7188cdc05434c2a637d11e29b1ee817adcf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 32.4MB
        • SHA256 2abb999a573bc98f270623cf42fbd69167e637f6a97f24e12e8c4f22b486466a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 32.4MB
        • SHA256 7436f9a6c50ab21718fc085e87bee1c893e14d1b4e899971621d1c5db52efe3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 32.4MB
        • SHA256 ee200f33fe2790d6cf8d70df29c654c452592ab941179e37b66495492d38e218
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 32.4MB
        • SHA256 b28b1755b145fbf5bfb4d6cf9e57883fa6d3005314306e059c9f0d57d5697a61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 32.4MB
        • SHA256 ddd9f6b9e34532ccf2af100a6f86d38c2fdf7d90c71506bcfdcdcf4dc9ef0ac6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 32.4MB
        • SHA256 37bd141e0c46e460d316d5a4f5d1b9bb929408dacabc383da627f0119d03f4e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 32.4MB
        • SHA256 8ee1b520cba2a39b8daf1ac0fd637fa01ea3f2ed6899f12e175991310f7619c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 32.4MB
        • SHA256 7051311d282cad0be081c3bab52e4cd2c4e26425e0b730f622bcd31276c1c82d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 32.5MB
        • SHA256 9fcf41c1cbbb6727d63d267cc0c7138c8b6da0fa3f248666aefc14e0411c2397
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 32.4MB
        • SHA256 9a791b53e112e23234e9a55582bd0e797c95b137a4f66e339a5eca8286714f81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 32.4MB
        • SHA256 072687ac83f886a5a35cbf65145cb77b4e62d294f81146acca9f783846e1c195
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 32.4MB
        • SHA256 3007b0f0d68b24018812a08533c3c9633acc10eca5c5b489fb53acafee4bff66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download