Overview

overview

8

Static

static

3

2026-07-20...r_.exe

windows10-2004-x64

8

2026-07-20...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    57s
  • max time network
    134s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/07/2026, 10:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-20_335b176c1b9e96da43455cde209f8da7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 23.0MB
  • Sample260720-l68cqsgy51
  • SHA256 5d6cc168def2d462906ec3b857bba85eabebb237d2f4087c36c0e2a0dd86a884
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-20_335b176c1b9e96da43455cde209f8da7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-20_335b176c1b9e96da43455cde209f8da7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4488
  • C:\Users\Admin\AppData\Local\Temp\2026-07-20_335b176c1b9e96da43455cde209f8da7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-20_335b176c1b9e96da43455cde209f8da7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5196

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 23.2MB
        • SHA256 d924cb1346c4f980dfdcc412fdfa8bd3a8a20ac2c344dac0bfc925aecef54aa3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 23.0MB
        • SHA256 5d6cc168def2d462906ec3b857bba85eabebb237d2f4087c36c0e2a0dd86a884
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 27.1MB
        • SHA256 26107497830ee0838e07a35890aaa3350926b7ffe4c0e3383888d685162a390e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 23.3MB
        • SHA256 ec6ffe123ba2e684938554bea3451411121c5d21797eb7c0e9488089fe6610bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 25.1MB
        • SHA256 8e09b0205f54f10dca6afb8ef420b93839a646f1e4376b1d4c6aca07b040893f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 46.0MB
        • SHA256 d06c0daccb21f306b1f40373a3ab9191d81b3b22574ae93eed79413dbed77ead
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 52.0MB
        • SHA256 40c3551a7887fe6299f3faa10d1d4b92b8e9257c2174902b10eaf26718333bb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 47.6MB
        • SHA256 451a663448a1b8ced2f02f1d919f54d18f659b305d92e25b740c0887ee3bd858
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 49.4MB
        • SHA256 2047232d3163f72def23c79dd8ca962be46b09456ca10599a5e088ebc91c83d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 47.6MB
        • SHA256 ec5b1434ef8daf81f150416ee5bd6d0804b3bb84ab30088cafa346e235a500b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 49.0MB
        • SHA256 259a5763c10d85a4c206af9561ed499d1ae8d4f644a379694ab36df48bbb6431
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 45.9MB
        • SHA256 38dee65850623033c666e6b4129e0d7224d96d02c0cf7280a969c4f7c82973ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 46.0MB
        • SHA256 8de81b285f9b8bfd3c85e1d512782d26f7ac0981dd968fa41ff4c6e76b4d1a95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 46.4MB
        • SHA256 2d7273db8812ddb042ad1b513df9f9a0572b6c718a0cce7c768d0700743d40ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 45.9MB
        • SHA256 d0cd52664147a8f59274a7b8640d94e45cdeff6e0c9a8df2d6423d6fd757957f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 45.9MB
        • SHA256 984b1f2d0e45af6e4c0160d0d2bafa62c04569d3f753d72c55dd4528a81886f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 45.9MB
        • SHA256 243aced3e715c854672974494394647c2eaa54e9fad3de62f216c8985ede7c44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 45.9MB
        • SHA256 f3d4fb702a1c39c6957ab7efa1bf71828a33b8b8e129e741b99ee5754bd4653f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 45.9MB
        • SHA256 a959cb220ec149d26faa1726b75cf1e56c6d7ac0dc24e6c2f3656776f70f6ee5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 45.9MB
        • SHA256 7cacdb7114b0b9b92c4b7f4d34e10b88779d150f80b06531b58607ef0642f190
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 45.9MB
        • SHA256 a812f66e289cef5d67387b2400da0300268a0e0591a35a46c200d00e0ad2cdab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 45.9MB
        • SHA256 4cfa1ca5f7d1f1a2eb27091f0fcd7426890dc9b6f630f75c9dc7cf099ffe70af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 45.9MB
        • SHA256 3579d78764081633bfe1896c7b08daa83ad8d0acd2f27d002765304a5dd2a694
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 45.9MB
        • SHA256 cfb8497ee8aefee63edd86b798439d1c3bebf9d8791d6f45def3b841620a797a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 45.9MB
        • SHA256 15ca13d6be0cc2ee30ee4a5968715e1139ea086bdb6837c7bc6ca694bea06bce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 45.9MB
        • SHA256 767ed43bf416a7cb1eed7be84338a0e5aea2e6f386972909c0ae5538dc98529a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 45.9MB
        • SHA256 0ce9bbfcce96cf8db1175fa23ddfad187230c5f214c5b4415ef2c26384aa334a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 45.9MB
        • SHA256 ae0cce12caaac2a5f58e749f1babc244fef8c05a65fe42dcdc827201a6f03945
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 45.9MB
        • SHA256 19fc36ea9f6cbe81bb5331669c8c775c32100ead5303daeef255e7b1f1629ea5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 45.9MB
        • SHA256 48fb97140568093bd2cf87d48cbaa9be6231abb4a54fa7ed3bcab098b314cb0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 45.9MB
        • SHA256 d18d98e5996aca3c7f166e0e301a59be1afa00af4af6c899f997dec46c820935
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 45.9MB
        • SHA256 75167dc3f2895df3de38729a2f88a4fa4dd00a818d977874fbbbedf55599528b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 45.9MB
        • SHA256 ac2fd39603d83cd3fecc841136497cdcd076b118c773b37a2c549b573b1d8ca8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 45.9MB
        • SHA256 365159c37bc08fc2d532eaaccc3c970d9f4e9f05f1428a9f717d393d5d52812f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 45.9MB
        • SHA256 2ae1b78bccf2314a7f242fce34f144736cf5d36db32226fbbd59a4d6bb5335c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 45.9MB
        • SHA256 6ff08efb4ed1f6e32b2365511e0cca7790ad933d083b2e22548a46ea81071f4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 45.9MB
        • SHA256 bfd11b44992bd6e8f189a7134c14cec39cee30fe674c76dd9af232784dda3e0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 45.9MB
        • SHA256 d123fc20e345c2b214ef1f48f4695ed2c6495b49155fb67fc4f79c8145df5823
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 45.9MB
        • SHA256 db51bd3313c59b07622fa6384dbc83ea108c1db0142debbdae2ecd3e67458c5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 46.1MB
        • SHA256 e82b51ac6ac3d764723f4904a7946b2923505149dbbd5a720feaffa38f2e7535
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 46.1MB
        • SHA256 9a5f78a1ddd114da98529887ba83d4c19287c670cb0083d22fe4952c82622eb9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 46.0MB
        • SHA256 294f2d827c96aa0b13c985081376c37d3332c922951375d0ef82bb9b22a7fc8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 46.0MB
        • SHA256 a500348495a338884a3ba6ec3604fa367a5e369c7ed0b3bfe34b122296fd5d30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download