Overview

overview

8

Static

static

3

2026-07-27...r_.exe

windows10-2004-x64

8

2026-07-27...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    135s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/07/2026, 14:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-27_fc36411e27e5e40193d8388813295454_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 6.5MB
  • Sample260727-rbd4asbd25
  • SHA256 9f34963af6d29f939312db218c6a536e81f3bceb90bbc274f3a48618700acc3e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-27_fc36411e27e5e40193d8388813295454_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-27_fc36411e27e5e40193d8388813295454_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3968
  • C:\Users\Admin\AppData\Local\Temp\2026-07-27_fc36411e27e5e40193d8388813295454_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-27_fc36411e27e5e40193d8388813295454_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5056

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 7.2MB
        • SHA256 b94985bf136ca0f7cc2b0784e0477eeec15e67e138272ba8977e96705a80e508
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 13.0MB
        • SHA256 e7a2be9443af5b3b2d7d90e7ae2cb4455ac9381f809f09cb283650323bdc6997
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 6.7MB
        • SHA256 d709b05e2064d5e6d70df3122ab8cc11b9004c2e0ccea37ec4740c04c4bd2d10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 13.0MB
        • SHA256 a434e7a6ece5c8816f73102f8247bfaed451e33d8634c6af9031db3a94960cc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 17.0MB
        • SHA256 c7ae64b01f0106d81a2fac674a15767e335021babb7d746144a4e801c67bb730
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 13.3MB
        • SHA256 364acb7c2b44e6692e5ac3e089e6260d34e445a51d6ab9ef18a8e75048789a6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 15.1MB
        • SHA256 ddf0e810f6bd1612c5fdc574d734a95eff7c0164d1a3c65a82400dbd0a9e1ddc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 19.0MB
        • SHA256 43185134966a612df91f3b56f3243de7fdaeb8762d4764c06ea53f6d56450510
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 16.4MB
        • SHA256 eb939f10373e35404b7f2b3fa2f3cc77c6449b2d096e76abc92f9b1f347085c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 15.2MB
        • SHA256 905a01cac647b809ae1c56c5c8016d72ae86839ffdf91cafe7e1be7402cc32dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 8.1MB
        • SHA256 7c3eac717f9a7c6a275f583d7e01ed79d458ecea977baf2421d7193b301c66ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 14.8MB
        • SHA256 9939de4c6a5f396ba3468c7c84c96ea7b127b915576522a9c4a3f1e76a779b30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 16.0MB
        • SHA256 9a383a0df56b2c0fa30cacc80b8eed3012df188010672f7ab28f289eddb45068
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 13.0MB
        • SHA256 476196ae12f92b7e7ceef470fc5799b867048770db09215946afe17e0b905a96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 13.0MB
        • SHA256 52e99e85f615840c762a3ed46d50cf4b214d17e5f76810ecd89176faaa692668
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 13.0MB
        • SHA256 7c8760cd2382d0627f4927e2768a1a3aa7898e398b35414d1cd7af8cf176ba2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 13.0MB
        • SHA256 ffb85030fd723ecd593e172c2531a6fa9fff0fc0676898f80dfce4eeddcabd6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 13.0MB
        • SHA256 d7259cbe6714fe5fb46beb52742027eaea821f40e67e94582033a5e9c9ff3bc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 6.5MB
        • SHA256 9f34963af6d29f939312db218c6a536e81f3bceb90bbc274f3a48618700acc3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 13.0MB
        • SHA256 d349ece878b05fb4c9c1037c50353383f1f22a8c2d807e962b8592cc9fc08e53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 13.2MB
        • SHA256 3005e7b97edfe81527390274f04e443a410bd93828e45e25943edfbf8ecd86a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 13.0MB
        • SHA256 0ef76b4feb794e99c265b5560143014f42183e4a608c155564006e1c4f69e2bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 13.0MB
        • SHA256 24af940e50dd3a33b9bf06021223d3437dc4f0b8cc7bd7c98d67109a37e2cf18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 13.1MB
        • SHA256 50cb151a53718d68fecacde5c3f35aec0fe987f10b637f965b310498e8aebbca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 13.0MB
        • SHA256 514d359d800686de3f2bd401bbe4cceb17d3c13efbb9ac4540c3df210d41368d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 13.0MB
        • SHA256 71bd3311a1f1c62a651cf2f73bb45e4850a61afb0ad591580abcaac5c998fdc1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 13.1MB
        • SHA256 868d1dc62db99b6e929faa5ec1d7ba47e8ddda7260611ca9cbfb7aab0305c45c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 13.2MB
        • SHA256 f1655c9b7fcacfb03325805f47171eebd5299cedc0cbd7ab519a51e8fd693206
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 13.4MB
        • SHA256 10231f4749dd606188491381450254d580b5cf5d598abd2530c6387242447039
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 13.0MB
        • SHA256 31dbaf4bc9946684530ad857da45079755d0743a2bd0ac5360ec9c8de31753e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 13.0MB
        • SHA256 1f79309e5ab5af9c8bf68143a4794b7f79791bb8c087270f19ce565f62688b43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 64KB
        • SHA256 d2eb08ebe0c7e7ff2223b6feb8c95f679251883e0b850d913bfa4b604432b861
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 6.5MB
        • SHA256 7ae69ecbfe810b9b2590888cc87b98ebeb492dad81c11471d2266c34a0dde950
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 13.0MB
        • SHA256 ef7a5eb32c5bbb9a7b7a94ef34a5b77742200742da0aca921182b480e0e6caf2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 13.0MB
        • SHA256 cdf8da95e2f3f5aa0e4853ebd45b41f7b042024b6a149c5fd6df4e599dca612c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 13.0MB
        • SHA256 1e3ae8e2e77654d2f2ab08cc88fb3e85135c9193b6ee41a1557cf77d20993ef5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 13.0MB
        • SHA256 d89283a283991657a7de298ee688b13123b21eae3dc86d7168f150e2143f5cc4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 13.0MB
        • SHA256 2d1d11b0d911d90a477c72e23ece2c098bcca52090dad03348c723d70d1296bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 13.0MB
        • SHA256 b610de4154efb4d815b122d412cfa9af09784f6f5882bfec06fbe4522d2f16dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 13.0MB
        • SHA256 3a5e89aab44fe16a7e79a007a8101d077190297062ee8d4ee796c6529e6d8523
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 13.0MB
        • SHA256 921f5f04b0c37d6524250dab8347a4685db103a4bb7013da472aeee348961534
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 13.0MB
        • SHA256 0c99ddf0bde95787a9d9b67476ea6c2c324bbbfde92829252fedb1e46803ee58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 13.0MB
        • SHA256 db4f69ebe33115201354bdac1a25f9d5def8676e1128015a87104a85e49916bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 13.0MB
        • SHA256 3eed8e8e6fa6ae7316287131f8a0a24651f9b4a385906ae5eeeb4c9df0a07e2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 13.0MB
        • SHA256 78c44bc35f446d4bb176cc6f9bb02da519b3de96bb36dc63c0e1d9e613e30f11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 13.0MB
        • SHA256 95e05272463dbee07a99ee5cf16ca6354a9387a52acfab80148f67c611047663
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 13.0MB
        • SHA256 0383a1e9e9571d3c3695948edca7da55b0d267b4d9f0ff9713b378a7087b1327
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 13.0MB
        • SHA256 ed3fd23b74ae2858f36fa2ccb6e6c04fe42c875ab3c5c0f6c0bb486c02c98b33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 13.0MB
        • SHA256 1240610821e92e23f052c467ff061dd6cdbd29906e93cfd343a41baa4134acf9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 13.0MB
        • SHA256 5b43201791b3f4336ebcfe113f92b9ccdd217307fb4cb274f471e679e453278c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 13.0MB
        • SHA256 c24a0d6a4d376b45672afda24c300ffcc3e4f2364ef0a8dc5fc002adb3965952
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 13.0MB
        • SHA256 edc3320922dc6d4d98fcad77833401c56045aaff8ccedcb331eeb776a5b1ea4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 13.0MB
        • SHA256 2a1183b912c5c52894d6fb75238d370f0a5c628818904a1f5b8f989ec63ad80b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 13.0MB
        • SHA256 143206a1932b2e0468c2e8a0aa5a1d5c87716c4a3ccf778cb3f883821c3bebb1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 13.0MB
        • SHA256 1062da3411c0337747224fe6ff976f85505fe6b8817b2359511bc10dcb589d1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 13.0MB
        • SHA256 26a567067521810bcba874dd2f532291024486d1986ad860682e01e70f3e12e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 13.0MB
        • SHA256 9a37ae6ed620333a009de26042b3ffceb171be679d57a62bd17240b5c2c6962f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 13.0MB
        • SHA256 b6fc90b9c3d910f46cde820c8159fca0ad4e102ffb86a4dd8e40df19b780e0a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 13.0MB
        • SHA256 43bd096a76fbdffc94f6523caf79860cdf693fd7e1a5909f1793fd3e26f1496e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 13.0MB
        • SHA256 695ff1ba56777737b0168e36928ebe8e452ae4fa74cced83aae2bffc9ec4a0ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3968-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3968-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5056-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download