Overview

overview

8

Static

static

3

2026-07-17...r_.exe

windows10-2004-x64

8

2026-07-17...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    144s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    18/07/2026, 04:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-17_3f670903bec88c7cb032e4a09f6d9591_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 18.8MB
  • Sample260718-erfwlsa181
  • SHA256 dc720f760590f191ea8a5f12814fcba5c3a2159b568634d91633ae403a802ec5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-17_3f670903bec88c7cb032e4a09f6d9591_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-17_3f670903bec88c7cb032e4a09f6d9591_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:988
  • C:\Users\Admin\AppData\Local\Temp\2026-07-17_3f670903bec88c7cb032e4a09f6d9591_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-17_3f670903bec88c7cb032e4a09f6d9591_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2948

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 19.1MB
        • SHA256 9beb9183af17cb7bff701d54e1dbf7ab30a9a60e1af362f132067192c51d4387
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 42.3MB
        • SHA256 33fce4f828e817d9a3b6b378b34aa4cf9a489c88a21b1d5269b60e0f9f8684fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 21.0MB
        • SHA256 6ab46b689cd597c2e664dfef62b1eb8ebe0a6991a74f8afd2130fd760d106eda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 37.8MB
        • SHA256 30fa9097f72a6f4af423d5c868a99d77a468cac5a4aa0b60a437c90876bdce91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 43.7MB
        • SHA256 0f1ef88279f159a682de0b69f84fefa7fa8a15e1268612aa9d73a819bc3467be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 39.4MB
        • SHA256 6422f9bc8d8aadfc1040a8a1939b15bca23949e726ef2712997f3e1956ebaf98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 41.1MB
        • SHA256 2fde2a488ae687638157df82a38d69335865cb1b9015a4ff93618f3c7f1a4de4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 40.7MB
        • SHA256 df33fb114b0423da376691ea4a8df0c6400b4e3255ce81757365671896c74318
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 18.9MB
        • SHA256 d836f7ba3e857791b653800752a2159290ed06724608fbc0d9685119ff930a85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 37.7MB
        • SHA256 2d00a71ecfff0d8aaa1ad987fe6afbe8bedc80bfcc0a9e0fc0f37775c59318a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 37.7MB
        • SHA256 4627a992f9101093134f295c503d57edd57bfb67c1a8baeed1da8a362067ff0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 35.9MB
        • SHA256 639bf50cfceb7c1d27cdbb5b2d8b7240b222e318ca376834283d863991c3faff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 37.7MB
        • SHA256 b6812f57808c35510dfcb759fda25eab81c8909ab10d8a960eb112af3552b231
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 37.9MB
        • SHA256 f1b89ea86f32ef554b386a1dfbbbc3dbe1253a3ef607dedca3477d5a5b6c8c91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 37.7MB
        • SHA256 b23a665be26271e9bba45afcf073f52e77ef1953f68ea668b6920fc3febaa8cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 18.9MB
        • SHA256 e5a8e77163673c6bfcc75504e797692290b1f4b1d2ffe96fd91a4932db834584
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 19.0MB
        • SHA256 bd78d98eafce08c6ad164ebc805113450c6b4f51b39ddc581edb333c8462f794
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 37.7MB
        • SHA256 2f38fd4b243765d0745e5241ea0facb6d16d7d679c6c4f76efffe652b4380f97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 36.7MB
        • SHA256 960044792a87ed136ef3c3a82909c61321c952d62d0bd2098343f0278d95e6d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 37.9MB
        • SHA256 1e6ed40292e742eb06b16f592b5ac0d89497ef0119a45bda6d0478648667a8d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 35.1MB
        • SHA256 6caf5ee996a2e4dc3d67bdfe7c0e9b46f93ec98d2b218c17143074b9e4f8aa21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 35.5MB
        • SHA256 9e5444d1e579d5fc7ebb0766aa6dcc443a7b3456ee68397caa36f176edca52ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 34.7MB
        • SHA256 6b73cc78b2b273879b591f4a842ded8be82665bd92003ce08a6c29ba852a7e7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 34.2MB
        • SHA256 bb320ba98ae36893489a1ec8a0dde1457618f5dfe8516ce03d0722d3f9abaf6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 31.9MB
        • SHA256 d749b6e075b9ccea97b09fdd0c162a06069be5319cd59a33a566cfe4d3f7c6f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 34.4MB
        • SHA256 266e45a707b818ac31b24e198a4d3b2e9cd58a43173dbfbf7c4f6eee59fa7c85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 33.6MB
        • SHA256 6054ce255116ee9aaf23bae4a5dc9c0d70c084f5299147b3315858ef883085fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 32.9MB
        • SHA256 7af0c55c9227f8e4cbfa91976b26ee1b7519152d118a0923fe92c8c3d01b4e23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 33.4MB
        • SHA256 75515e783d30213f9d90e10de7a1e6e2ae826b30884523011fea0ba45c10ee25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 31.5MB
        • SHA256 a1c590c2b7e336dfb440337d6e5515017b03ced0d1399776c1aefca53bc6689e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 33.2MB
        • SHA256 c894d1b968fdcb3ee7a08536e53cacdf4deeae521b48a9957859d68de9cf88b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 32.3MB
        • SHA256 6b75e2dd18548618a0a6ce658ea6febde3a7ef110e2494d71032d61996cfd985
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 30.9MB
        • SHA256 60a9c15f9d2bab6fa44f1fbc733db86898c8de5f93a3568f5cc0e47c394942fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 32.2MB
        • SHA256 89af22c7a36798b32ec47413afeafbb420070925ce5df62f0638ed7f348dd749
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 31.7MB
        • SHA256 05e5296fa8a8ab4039834e083cc87ac31cde47fba2f9fb50014bcd9b6ac45735
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 31.6MB
        • SHA256 6ca8e3d6e6bd10c1afb9b8dca58a28876657e0266b72b452058314a1d932ae10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 30.8MB
        • SHA256 8a1f5605b17f66c37bfa82aea7477aa7892303471332eb479bedc45790a39759
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 31.4MB
        • SHA256 71c65fae564aed71215e43f68570394763ebdf8af147f282f221d376ac023800
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 30.6MB
        • SHA256 d45bceadb77bdeaaf1deda76252065fe636f10b3af2734004a4d4fe84d605be3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 30.3MB
        • SHA256 7d6b81f553994577d279233927104d7b8f4492f5eefea4cf3ba572d9cc45d4c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 31.8MB
        • SHA256 621fccdfa2d0909851dbe536ddaeda61e5ee51eab126fe2070cfeb76bb2a6b4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 37.8MB
        • SHA256 b09924a1f172fd5a5d24c9f1542fe1ad300133f78481d2d5cf456a1fad6c3f39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 37.7MB
        • SHA256 162da74fa7fd73e5c81c9e44f0ec8d4bcb51778ebc47e53b1179200975966fcf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 37.7MB
        • SHA256 ce419e03e00218fd70634e3fa87d2c808a69c9fc0a9e6b7c9548c397a92d8e0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 37.7MB
        • SHA256 904395d74ea3b2479a7d298978f4f5a9dd6b265ca45674fb05364d3279bdc0b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/988-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/988-3-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2948-14-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download