Overview

overview

8

Static

static

3

2026-07-14...r_.exe

windows10-2004-x64

8

2026-07-14...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    14/07/2026, 02:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-14_e8679862c57978895e0ff1b79a249356_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 14.1MB
  • Sample260714-dar2waez71
  • SHA256 e343c4086912fb4dcf5c963c20d0a1eb35b3da796007f2c4e1cd5e87304508b0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-14_e8679862c57978895e0ff1b79a249356_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_e8679862c57978895e0ff1b79a249356_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1096
  • C:\Users\Admin\AppData\Local\Temp\2026-07-14_e8679862c57978895e0ff1b79a249356_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-14_e8679862c57978895e0ff1b79a249356_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5052

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 14.6MB
        • SHA256 478c2a964ea54f33eab9cb71efeeeccd89f16c157dfddd659f90262d19fa3220
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 15.0MB
        • SHA256 932a6aa167255340c91b10e79262b01321f396a7d035d4b697abc6da4bc9252f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 14.2MB
        • SHA256 282a46483582cba61260bedc274f71d204fc4bd288e716c217facccf934f4b8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 34.2MB
        • SHA256 60eb77ab548905da8160f87f8ac825c408ebe43c42051e5abaa3ffba831a4cd3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 29.8MB
        • SHA256 2295c69f3d8b711e635e3b689b3c99c269c7a1815fc0627309d5f150e0901a12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 31.6MB
        • SHA256 73b266af41eb50f01038759359026b1df826ffe5f3e52f3fd402d6ef1e8da83a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 30.4MB
        • SHA256 ae7167499601142555d7af27d11e65d2151e9755044f2189ab014eb25eac414f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 30.0MB
        • SHA256 61f5499401e84b65dc0eb653ffcaf2f42b483464e89d6a4f1eb2821704091027
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 29.5MB
        • SHA256 449f5243df3f186ec7d43a5e533e08221cfe76482891b4fa9c96bb5123233a9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 28.1MB
        • SHA256 f6d277a7925380ee9a3cd53a8f9b7e381f0fc2a5f3930da3b5519585fb86275b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 28.1MB
        • SHA256 7afe5fb297e1a1012ed845c496b726ffdd384f540151e957a4808078203b34a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 28.1MB
        • SHA256 3f2a7ed9b1dca22c0c87f6317869608bdfd62155e3756741351ab74a365a7a39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 28.1MB
        • SHA256 354996d98fde3aa9b939cb2ead21b691c9927dd267c38466c987b4ae38fa1c97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 28.4MB
        • SHA256 89bb8a4d0a1fed6c2933a1316fe082bf7f81906d97e466f55d452761f9d39238
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 28.1MB
        • SHA256 45652b574725ae6699185e79c872e3c4630130c6c4e2722d065208818ae9b9ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 28.1MB
        • SHA256 e251cf85ff3de7db3a9a871a6ddd5df704d3f296c938fdc8dbca5574856488ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 28.3MB
        • SHA256 2d01af8802b3092a9a453ef18c2f193a7c508aa9e39088f57471911020d548ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 28.1MB
        • SHA256 cf874eaebbc66a6f71c0fd7be388896cec8ce40b03c80bd74399cb3772655d89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 28.1MB
        • SHA256 32a4fa43ac1fdef947ff0f4e6be32937959cf2d2bc0467264a72d0d0ed67ce81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 28.3MB
        • SHA256 353f53f95d7fcc788a604029f2bb6c0b664e65e069dc0d7f3dccb54ecedabb22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 28.4MB
        • SHA256 7eb3d98466f92b3563b63b8f2ffffce18a33e4db8d1a7ce682ffff727166b018
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 28.6MB
        • SHA256 6716be1e961ecc3d66c619ac5cc2355dbaef96640983012c06074621eda376d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 28.1MB
        • SHA256 2ab6aa7e58aba67d8ad0c3cd0f9a1c43c3d4e06aa1877eb4d3cee4fa16e8a759
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 28.1MB
        • SHA256 5ae3eac781ca69249c14daedaf6878b7d930bae444f979374b787bb50f2e0ae2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 28.1MB
        • SHA256 1d1716e5b3fa16bd7bfe1474e47a4a6a4f5f97b782ff77c833bc0d154cf32b07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 28.1MB
        • SHA256 80c28a85803ed2588d93d509e539dd9f159f40e62d9533c993e9c155dd37e6b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 28.1MB
        • SHA256 80b07b609c732b32e3f2a27bab462b37721a679094372fb6679556898da7b66c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 28.1MB
        • SHA256 f3311b9a12a21b7dd16a29389e62bdbb8a1c2f780c478156b30c24b11e50acfd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 28.1MB
        • SHA256 52d5165365368b2362d4a5431d3197caf4d1eaba63be93968cf54d278059d77e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 28.1MB
        • SHA256 d5e5581c6e869789cba312da653a9be285bd80d57fe8ec2c4c72df36f0cde440
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 28.1MB
        • SHA256 fb8115d332df60faf7d14b603db27d37453c58bc23dd361b2c2f67dfb7f30c9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 28.1MB
        • SHA256 a015ee9f86b60e5f71ad2414eeaac589989df1bafe1c59e88949c76a46f2258b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 28.1MB
        • SHA256 9be8e5435c2a51ca0652543b74b6b28307f7791962b3eb29535b9b2c24897818
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 28.1MB
        • SHA256 36fb630371b81e07c0a1c02b1c72853367a9e910b952056a3879adc78300eb87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 28.1MB
        • SHA256 a2489e631c64d2d6fa9d5f85125a655c926ad76da1343963397b04aae607159f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 28.1MB
        • SHA256 be6ca1b46b08c90fa23575d9661c168885f77cf700233f79339e4239f4493c24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 28.1MB
        • SHA256 4cb185e529a426a47db4eb308930e1e41886304e91923df6e4119c0cfcd88137
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 28.1MB
        • SHA256 f461f45c7f0d29afc78d5b12984c87724690c2a0cc5f0d97897c0c6371ef8889
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 28.1MB
        • SHA256 2334436dc35a6f6fcca10011f7d22ce98eceb55dfa32f43e8ce7206ad35b22df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 28.1MB
        • SHA256 2d340c221526be04b4ea9cf21e2eee9b57aec09ddc6b39b6db9d5924c16a1469
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 28.1MB
        • SHA256 d3cdb7f1a37c9ee131227df5a4e921d217b87afc55453ca9ab098e6f8c34d324
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 28.1MB
        • SHA256 590d7536dabfa03236dcbb0683b0a78c47ec70348d174d7c55e0fb7a61c0efe3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 28.1MB
        • SHA256 3759e9d63caa8b1a491a532958632582bf44eba16c70dbc280b6f6a78e770a4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 28.1MB
        • SHA256 20a0466de31cb40b74b60d713a62bef8b4b2d071e17da12deda9e34eaa5992bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 28.1MB
        • SHA256 d9e763757fef1468e8724abc1f976c45b18429ec4cd6d9baa8514a34e1b0e566
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 28.1MB
        • SHA256 754198e55a51e999c30ed7838cb7861b8425f7647162d614c8df81f2421db047
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 28.1MB
        • SHA256 605e8a417f380d039d685c69a5322b6bff830db6793ae3faa8aafa4c7b39a404
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 28.3MB
        • SHA256 6226e32002251714f3ad88b6fef01c8ddc03b70904783296ee1ff96df304637a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 28.2MB
        • SHA256 5bb77c2f07807f083c83a24afed7448b3865cfbc1326a00e4b5bfc2c7bf27058
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 28.2MB
        • SHA256 fac5659fe5f43aafdcf1be5abb6c928051ce2e1dc9167f9c9620c629bbff69a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 28.2MB
        • SHA256 20fb5bfd5cb273d833575808b94f84ab08a2ac99e9cf417a8ff2f13af0cfe2a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 14.1MB
        • SHA256 e343c4086912fb4dcf5c963c20d0a1eb35b3da796007f2c4e1cd5e87304508b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1096-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/1096-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5052-6-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5052-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download