Overview

overview

8

Static

static

3

2026-07-18...r_.exe

windows10-2004-x64

8

2026-07-18...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    133s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    18/07/2026, 15:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-18_6e2f07fe210893ba2b03cac23699ee4b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 13.6MB
  • Sample260718-s8k4jsh19x
  • SHA256 9ea276f6826daab20e916382949a039947548ff5bacadd194bcdbd51ebb83fdf
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-18_6e2f07fe210893ba2b03cac23699ee4b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-18_6e2f07fe210893ba2b03cac23699ee4b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3564
  • C:\Users\Admin\AppData\Local\Temp\2026-07-18_6e2f07fe210893ba2b03cac23699ee4b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-18_6e2f07fe210893ba2b03cac23699ee4b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2716

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 13.9MB
        • SHA256 5f9e6401e3db7c1869e2a6071fcb3360280c7fa817cc2da9c449f7f26a36fbaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 27.3MB
        • SHA256 6b1965cf49e1b62b01355abaffc52b62424e695112891d7ebc767a61a6977b51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 31.3MB
        • SHA256 10b4bf02215a8ae6ab88c8745908b844600c39ad580a44551b37d542e3638071
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 27.6MB
        • SHA256 1213b3825c21e6e3c4b89557b7350f7f3b65bd1451845f3d93242b99b36e6034
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 50.7MB
        • SHA256 fc9321f9791202fb7510bc1afd28e4188a05181f6d2c75d7dfa9b3fce3c9116c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 15.7MB
        • SHA256 640e8baf113e7c378aefa83ee3c1299a6c2fc30c33cc374daa5ab9e4983b027f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 27.3MB
        • SHA256 713f999059a97b3223e86f6ccff3bb41e0d68f58b66c9834850b876d4e7bd7c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 33.3MB
        • SHA256 0c8e505b0baf27d70e2a93c203ed87bd115b4646e237137a10147ff6e60375bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 28.9MB
        • SHA256 8f55dfd3d4c5c1e847c0194b984547c3e9f36ead2d25793d343336cf6836651a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 30.7MB
        • SHA256 68eab8f5657a3a755e6d8ddb6613ca58ee0b38666dd3b0350323b27dd6ee3f90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 29.5MB
        • SHA256 76ea124366aab9e9cdd1a7899c0320bba8e5906cd54b996f23b9cbb10891fcd6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 28.8MB
        • SHA256 9424f3db092c6b54d7f990d0c137b23040c15f4d9f01524f1b342282ad6fdabe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 29.1MB
        • SHA256 f026d9930d94721816ab52df2a4281215e3602eab831565f59ab9009252e341f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 30.3MB
        • SHA256 2fc108c0e39311737e1f27cc7ad19a4c62ab7a5454ccdc832aa48e1b4b7ba135
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 28.6MB
        • SHA256 6edec39a9d893d474a6f9495a2566f19cb16eabae71826cdcdf7fd20d940f4aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 27.2MB
        • SHA256 a60edc6602a94328456e88cb3d4470c79f76cda4000608336c156d028022ea7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 27.2MB
        • SHA256 be4e42a7f648659f85c917a1cc7f38ea308b84e26d682b8ee615be77d073c256
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 27.2MB
        • SHA256 5ba5cd352fe13ca2d897e1a02951be1d83b5fb0d88d93f10c5006e0fa63528a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 27.3MB
        • SHA256 d7f5af72364a77e1357c560b368bc1e7c1f7f7d7b43dc548275fa5e442de4498
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 27.2MB
        • SHA256 93514b2b917e77b9fb1c314e9b08b0a3c59cb25e4349a122aa96a4c8ff14ae00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 27.2MB
        • SHA256 7aef3c8dfbba76f7833b0d84c99e7760ce4cc3700b96ac0344b3f2296e5fa45d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 27.2MB
        • SHA256 cded0433f06dea94d55aed160a88075aa1e170cb0bf156a3de5742407663916b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 27.2MB
        • SHA256 8693d1cafd9895f5d7ae46d2b7f70162f939796e43828be7d6bfe47f7eef6437
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 27.2MB
        • SHA256 976f1f3a63e7d6387f483f13e623738408df3ace406f599d873fa78f7745e836
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 27.4MB
        • SHA256 228b28a91c7429d3c36da9eb8c7f6611831f88ab5958448775e5346dd5bdd866
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 27.2MB
        • SHA256 59cbac5a25e3a87bd9e71dba42916de3afecbdc294904b975bf31bbda31849af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 27.2MB
        • SHA256 de0d8e6e21815af8c1ff813673f85dd5f06bc623142af8b81cbf6769f90e79e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 27.4MB
        • SHA256 26c2070a6c04ec8ed08ed0c4acfc72ea79beaf492665d32c8301fbaf7725b3e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 27.5MB
        • SHA256 ce342d825ce4ca322e47eebe4859d3948df69bcd6d9ab62cff13c6897d6869ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 27.7MB
        • SHA256 988604331eccd09d63917c31e25d78ee76b6625b5df4797c76e6af83d55b6e78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 27.2MB
        • SHA256 688e6b54da6657da9d695dca0aec5b1bf7b522db3860f17e7be1dfd538423ad2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 27.2MB
        • SHA256 4092c2639988b7f3ba47adb827fedb5c92ad1db268ea679bb2e1ba92dc1d229d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 27.2MB
        • SHA256 6b21b62b2e248b699ff700504e96ee6a9e51a5558648553ab71830f399427e92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 27.2MB
        • SHA256 0e7157b77714f62e61872b0c94da269119ae2e8054d8751f6997ba88b2f0fc89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 27.2MB
        • SHA256 4d3e90ffe125237638cca10269ba62a18363e9d53a50b0db5ec47614c4613b1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 27.2MB
        • SHA256 3b08f918bc1e81d2db51791f39e4fe443d97e0ccada3291c276a97b541bfc317
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 27.2MB
        • SHA256 8e046cc9156407591da865ebcc8241c067c74d54f84a054ea21f1956dc971e77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 27.2MB
        • SHA256 d7f9aa4a6839820eee92d037b657430bcebac7c2aea33b79560477dc641c1c9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 27.2MB
        • SHA256 b34c22d256174dc7750bb8414ccdbc53943da827ec2ee6e7c98067fd83d1f7c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 27.2MB
        • SHA256 7bc0130f36fafaebe1bc4191b3cc10b85409d19fe874aa02bb935ad6e4e00fd6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 27.2MB
        • SHA256 c58eee454a3c769c5a99d399332ac8130865f62ccb2f4d9a62c91592199834b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 27.2MB
        • SHA256 cf47b86507d0696fbe7459d388928ec05831a1bb350e9ed64611a886343a5060
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 27.2MB
        • SHA256 eace4aa8c1efac7d9abeff58e3a5d3b8c0560af95512bb59d1493bcfd2c9539e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 27.2MB
        • SHA256 7683ef25e900c6ea3c9a94466d91b121ec6d9397ca3463aa96568f3aea580c95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 27.2MB
        • SHA256 50d4466a24cc582f0a3cfd9b503fc0cbc2991d8e295e66a99875ac18d6e4d6a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 27.2MB
        • SHA256 c0e144fc6ca1535376ce2ade2b687befe9b61a465b4f8b81470fb792d15af106
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 27.2MB
        • SHA256 712a5bab73268af7e03d720e54f623642f345d1a3c5845d488292fbf361d15b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 27.2MB
        • SHA256 5abbfd5a9683552e81bd589dabac5d141cd96ed501593a52c7ffec2b331fddc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 27.2MB
        • SHA256 2f03718e6fe7fdbebc73b7c38136ee7839f4a3a078db9888878de537ae0854c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 27.2MB
        • SHA256 d4e0482791059e935e06051a285b6a1e2fe4ea62ef24ce504974864b4ca8adc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 27.2MB
        • SHA256 d31a06d355b0ff676dd23952f731b66836334aa968255eed91dc1cf9d2a782ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 27.2MB
        • SHA256 26aef38926a461b175da4d446105625037f86a2188863431c72a12df9c424054
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 27.2MB
        • SHA256 9f2b65af8642e21bde8fa8ae69eb14b7a68a530f9b789957a3ea5a86fe6705c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 27.2MB
        • SHA256 491e97cfc9848b7a982de0cbf518a30b880740b45d3d5fdb53c3af720b144ac5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 27.2MB
        • SHA256 e10e557406e490260de7551cf40923af9c39b8a1ab9a152a80b060a4b1ac22ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 27.2MB
        • SHA256 5a4bc179f2360ebdd39304bebfef4de6b0bd873fa94822d467fa2d17f2c0dbae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 27.2MB
        • SHA256 ffc3e9e248706754e0f41af5afff131cdcf326b423e5e1840a47615fa135a7b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 27.2MB
        • SHA256 1e267864bdcf6547c2041c6cd028546d840dbf66a310c9cd7fed0729117430d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 27.2MB
        • SHA256 f2c67a3e31a03be13a04f47458ddf4fb4cf8be809b69ebdabb152d701453685d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 27.3MB
        • SHA256 fc5a803c09d169505acbea81c51499b49b7a7d92d930a79818ecad1aacb4da7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 27.3MB
        • SHA256 d41cc1c3958713f260b206e041311b2052492a3a1653aa557acf67d1b02405c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 27.3MB
        • SHA256 47903ee38003af791d7dfdfff90001af37d81cc22e92dbba77287bb3ae1623cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2716-14-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3564-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3564-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download