Overview

overview

8

Static

static

3

2026-07-27...r_.exe

windows10-2004-x64

8

2026-07-27...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/07/2026, 15:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-27_049cdcb4fe5772892ecee2f85122a1e3_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 12.4MB
  • Sample260727-sd8w5awsby
  • SHA256 255f933f2e5c32172ab6a49f72a4f8ae18207d3adf0db5ac1177c3d68c94c4b0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-27_049cdcb4fe5772892ecee2f85122a1e3_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-27_049cdcb4fe5772892ecee2f85122a1e3_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:6076
  • C:\Users\Admin\AppData\Local\Temp\2026-07-27_049cdcb4fe5772892ecee2f85122a1e3_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-27_049cdcb4fe5772892ecee2f85122a1e3_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2540

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 25.4MB
        • SHA256 9305d25073ae84ea3e08d8fb8a8bb1db230b4d91b4d57dbf6d8f41b0e75a2903
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 25.8MB
        • SHA256 857f2eb186199a839db061534b591ab5a8bfd0126d139c733b9ddf3a23ce8497
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 25.5MB
        • SHA256 aca82f014b3027945cd32c7d1778e8e8710d0feaf3900ff2080f620aadec6456
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 24.9MB
        • SHA256 4174c2b10042d8732614f6452ca5fc23801e607d5d2421da1a7fe1a9a8e9ae88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 25.1MB
        • SHA256 8cfe994d6bf8cc92c321afcdddedd64f1a2b8da72534e4125e9c9f3eda20e506
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 24.9MB
        • SHA256 2c856a0ac23bfbd7b7048aea07218c355aba7e6a83075aa434cf8dd4a898fb32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 28.9MB
        • SHA256 512d57d5532cc39936eb885cee8c4329c2db05bb5cb549ee5399679b7ad04812
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 25.2MB
        • SHA256 494980f7cd26a92711d08b85181a356db1ad15c0c8766c5797ae0483661e1378
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 48.3MB
        • SHA256 59fbf5d1df16bff78fc56601cd54c5824a13486d09e3cbad320a0e10569aee62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 27.0MB
        • SHA256 9b4d8e7972d1b7cbc4c5f54718d5f2c96b471d300b477840318286d275d4dbef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 24.9MB
        • SHA256 89c4df26919e337721c1dee8728b1083b1244f29d3981b55e38909ceafdf4f59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 30.9MB
        • SHA256 0c16db351a626491bd599155fb41e3d2a195f5c365c9eaa0bb216170806658f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 26.6MB
        • SHA256 901f5facb8488bfc73a84b146f3397692cf0d03b88014f5a55e05d7ea2be3abd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 28.3MB
        • SHA256 ddc7300dfecce34b013739eeb77b598ed1b37e7b5111ae4aff714fcdc911a506
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 27.1MB
        • SHA256 0562529ad9996d9558fedd8ab5ee6c1746a79c3a41ee9a8134526c61af49df0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 26.5MB
        • SHA256 24b6431f64f4c3d514faf267a1e60fdc987a045963895f7cd5ec3233d420db2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 26.7MB
        • SHA256 ed325a7defbafe045ca6fff737eedb146f0b989b89296f4b77194c07318090b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 27.9MB
        • SHA256 86e1706d5d2d56b86d91925ab5451b21aec7d26ca26e899973c07c027896cc72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 26.3MB
        • SHA256 3ef8f19b510d22fa64fff34b072ada65ef1c4f0319f781c88926946124b68950
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 24.9MB
        • SHA256 06c3bbe16032c5cbd3b3627d7c0fc757ff4470e54c36bab864a9f1724bacd60b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 24.9MB
        • SHA256 174bf70b3d7a6ca54c2b957900a3af7776a1b87d8cb9f671ea954025cd769b8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 24.9MB
        • SHA256 ca486031f746c36f45cc51d984f344ceff10fa717a12e51cd805d970e6263c5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 24.9MB
        • SHA256 0598eaad6a8f0f25e7b3ddf67f8ec0e1009e7c1cd46a267874a06fa29048c63a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 24.9MB
        • SHA256 4beecde1161015f0869afd39be517fda28d8894810e2183cdf632740b9e13577
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 24.9MB
        • SHA256 fb1ab2c4d5b3159e894ce88a5b8e7adb10107f40494e47dbfe65a825aebe29d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 24.9MB
        • SHA256 11b292fd92db14e370901191ba8e7c0f2fb1796817c9e2cb7486e3d169c345ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 25.1MB
        • SHA256 4883fb7d2fbb6229553d401febb20867bf4d2e220fa6f47d43a0fcfbd2dc63c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 24.9MB
        • SHA256 b8fb3819e360b07c1fd7f26b6c681a5708167771a9b6856a256372e5f73fea06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 24.9MB
        • SHA256 0164d9c57d40da83a711dbc101bac4dd3983917f381660c822efb387621f43f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 25.0MB
        • SHA256 4faebb4584429ee793216474c466c0d02fcb51a99b0ffd228e4e27f4ebf28050
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 24.9MB
        • SHA256 b03edc333580a3a70368571e8134ed1d75b3bc77c920f397703bbb753ae2261e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 24.9MB
        • SHA256 8e296f3d3a259222ff7fbe2f585a483f43f76d93084d6cd2138cf7ead021c56d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 25.0MB
        • SHA256 cd7e3ca4eed87b88a3961404b9a7d68b0a1c759f7b23fac1568a6c34ed423b22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 25.1MB
        • SHA256 f5c8863d8e5bdcdc6064fbdb1d4b3d47474a6c6f1cf478d17a5e8ac34a83ad1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 25.3MB
        • SHA256 3fe9f17062a2aac540cfbf0dc7509ea725d453bd4bb6ab99911d8a2b7f5ee93a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 24.9MB
        • SHA256 830e16d23f4a6b08307b26e87e72b1a07b679a0ea378e07be46dcb8c864ab03f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 24.9MB
        • SHA256 acd10567cc93d3257407965f338f0f95ee04312bed8cfdb35b93724d9674ad96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 24.9MB
        • SHA256 6563e972b8d2a8895f297ef5a5594fb1fe1c0d1b157f032cd8957aabf713b6da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 24.9MB
        • SHA256 3f70941a45db6a1761c6ff2a34ff5b43200438ea8670f82cec9fa67567b38514
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 24.9MB
        • SHA256 da458cc3c5cccd35da7c3a68f41f6bc882994bbca97a08bc11aefecd2f5ca03a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 24.9MB
        • SHA256 08032d6a2082779efd39b023878290e8d95117770b1a2ee18f95c0ce2c367285
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 24.9MB
        • SHA256 2b2334be4e1d2a4d8b918a694985ee499a1f91eabf24416b0f8cf5fda9a2a859
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 24.9MB
        • SHA256 1ec0e8a5ce53ee1db23fa568379882333aafe6e546bb3eab16f8c0d75ffccbca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 24.9MB
        • SHA256 f154faee47528b116bcd38e4011bcd0d038e92c2295c72eb6fbf6c079700f4ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 24.9MB
        • SHA256 7bf7cb61bacef8688a4be7bf3b502c1696924e43745c2c79be4e9c67b5e7a29f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 24.9MB
        • SHA256 5ecbf3bb7d14cbf06e126f2ea06987c47194ef486a82596f103fe8fccc696695
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 24.9MB
        • SHA256 227277ffaa43d21ba08c5e92c52591ae04ceffa03a27371d6b6bdf9e7c562461
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 24.9MB
        • SHA256 1dfa3a51af793ab53fce5f3a04d3eeb6fd69f18582aaa1bff3f65b5e0e18c7f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 24.9MB
        • SHA256 e05d36320544d1aa239d0114c896a5e3a0b0d06424e0cbcfca381038e4cc1825
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 24.9MB
        • SHA256 353cc547e698d4a973fbbdea705625ecd9c25ff2b0b482bcd22a1067bbe571b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 24.9MB
        • SHA256 78bf43c867df7b7a3a644ae68b111ce86832f6ac794798762aaedd9498b08e2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 24.9MB
        • SHA256 e5bb30bb3734f9f80f1c375eab8bf28efb99a989fe073ad2459e6d0d32cbbf24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 24.9MB
        • SHA256 0b3518531882a6acc53d780692248148a26cc34a76718c9ed3dc27ac616076ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 24.9MB
        • SHA256 0fc003bb277d589fcebe4a4bc8eb34c4f9848679a63e6a13964a48fe0d4a3ce4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 24.9MB
        • SHA256 abef1dcc44cfb156982726a022834fd50f55d2e4d150f3d23d1fb8e398eb79c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 24.9MB
        • SHA256 2e841aa3db531d45ec01da77a8b35401e2c0ab9839173112440044448beb4611
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 24.9MB
        • SHA256 27504f8b4442d718e0c09a9143ca9d20ada08a8f2a9526347b41ad0f11d3037a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 24.9MB
        • SHA256 d53472b0d0de25301913d71ade1d364ce38a3b149eac7aff9129942de294b3d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 25.0MB
        • SHA256 47663fe52ac69262c545439da0919cd45db7cffa405de2ecdd91ce6f58ed03f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 24.9MB
        • SHA256 97ff475b40c01cb43df625473c06b17d3d13eaee55547d6557638fd73a82e1e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 24.9MB
        • SHA256 516adaa9a8b073d45d0bb8f9a4ccd697b5c1d17645aa2968112bab7ba2bf0d38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 24.9MB
        • SHA256 8955d69883f8147da70c64698d9c7e99523648fd099a94a61081b6b329f8f63e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2540-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/6076-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/6076-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download