Overview

overview

8

Static

static

3

2026-07-27...r_.exe

windows10-2004-x64

8

2026-07-27...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    83s
  • max time network
    131s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/07/2026, 17:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-27_5054c90fec74873223668eccfc13c253_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 28.7MB
  • Sample260727-v4592aythw
  • SHA256 520460daca8103457a9c917ade1d127588c37e9e56b63e6b2fd520b0a685f027
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-27_5054c90fec74873223668eccfc13c253_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-27_5054c90fec74873223668eccfc13c253_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4952
  • C:\Users\Admin\AppData\Local\Temp\2026-07-27_5054c90fec74873223668eccfc13c253_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-27_5054c90fec74873223668eccfc13c253_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1228

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 47.4MB
        • SHA256 64774580549d0d629c8f744c19417e787e2fac5cb86ea6449e937cae7cb59707
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 50.4MB
        • SHA256 6c84278efd9a9abea4b9566268078ce0c90200e2c18144eb6f0fe10fc0be8a50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 49.1MB
        • SHA256 c3bb1188992cf0132e4a9fc05c4e6d318fbb87a32f6c8916cbcd71afc63ab450
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 43.5MB
        • SHA256 64d3f524e9c27058a26453862b809b3e2bd6fa6335f3cbd0706849f525240990
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 30.8MB
        • SHA256 0a8f2e518640c7f6a4efd666a247b63c42ef1e34167ca6da518e1e3ab9bff6ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 43.2MB
        • SHA256 66255d378d628bf816ba53d759833a52e2a9ddff1836daa88f47725251b7d89c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 36.0MB
        • SHA256 699d1ab4e62536cc9bc5e17a5aae3e264df5f6c2dd3cf582eaf742ebdf333dde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 36.0MB
        • SHA256 183bcabbf8d885f3b363ec6ea1e855b2cbd1fb1d59974699c196a03050e8f034
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 37.2MB
        • SHA256 40caa45583479afdc3875f3e87a5ce8bfb6d72100994d710c047788e2cda1954
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 35.4MB
        • SHA256 0fbe3b724ea68c67da1dabc2c26035793e9c0417a36201f4f47d92d11c1aae9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 35.3MB
        • SHA256 5e09c546cd2aea678979a236759dbafac2d81ea84bd503262539b11e4f29777b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 33.7MB
        • SHA256 5fa495b2366650ecace1b9b392654c4392f411fa73c209dde341be280d74eec8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 34.6MB
        • SHA256 d52fdfaad203db73883767fb706c5bf1a784a632eadc59c94b114b833267b01b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 31.3MB
        • SHA256 1eebf402b1e075cc430b4429fc84012f4a2ede2ff11860e73145af98ae0bb882
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 34.3MB
        • SHA256 3e3a201e2c3b0739606491849323abeca62ffec0dc7e8d801cc9344f864c4cb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InstallApprove.exe
        • Path C:\Program Files\InstallApprove.exe
        • Size 35.0MB
        • SHA256 2603f2d9b8d32cc0138a863a8851eea19821f9cc89f85596b537f03ce1ec931a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 30.6MB
        • SHA256 ec32a0b00a089ca0b962110e3366c1c023b156fb13ff49bda49986031ff7ee2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 33.3MB
        • SHA256 9461e54fbba126be20f442f38aa08e6f733445d7ca02d86d7763fe9936dafe6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 31.9MB
        • SHA256 c10b17d99941c2323d48026722dbca614123cc5accd20ddeb132e913af0fc075
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 30.2MB
        • SHA256 54b5db23a52ba8b98ba846e0c60cd3767b0f589323bd7e940cef01a976f7f511
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 30.0MB
        • SHA256 97368a4464b61f1b58a98beb8a0849e96852826f9dc66cec740ba0feadac3985
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 31.6MB
        • SHA256 ddb5e44cf597eee73173e36a8adeb563233bc59f47c78e99d4d1cd642aa6cd0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 31.3MB
        • SHA256 193601f7da33173bb3cce3ae5e1e36289ba3b8a9756cac2784e80609fc563253
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 31.0MB
        • SHA256 eaef7a26bea7ea719bbb5d5f03051bdb2c5b360938282a9cad7c536306df299b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 30.6MB
        • SHA256 46a4396ef6fe027b01e434c0bc22b11e19dd27aaf090c2889e184bafebfcd7df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 29.0MB
        • SHA256 52467aef682eb88c591487f6be1c833aa5c39d6eb35139c78fa66e6bccac0111
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 30.8MB
        • SHA256 7288c1fc9d324732f66fbcf6c35515d6a56a41e951b3beef6bb5abb4b99b92a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 28.5MB
        • SHA256 478b8177fa8322fcf55e8edc6d06f001e7ada58eb99e9debd03ed344440fef0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 28.7MB
        • SHA256 b417c0bc7c6ca0d08db9d05d33d02c399c88ff8d4516b18db195ce3014cf7611
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 30.2MB
        • SHA256 162ced31e87d6ea390ecf2f8875c3ac1909842a336869ab7ad9c2afd021dde54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 29.9MB
        • SHA256 00a9d1f789d964ae7c55394bfd48e32f71d043309714c9dcefca1416f93a1a3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 30.2MB
        • SHA256 6bb9b1ab0f3f6693c49a7f28bb126d1c45904a278b6df5e41ce6b46eb87ee184
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 29.6MB
        • SHA256 0bb89429b633cd1a15ede3fb76c6bad19773ada1c5ba9924a9ac8cab3f832b06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 28.6MB
        • SHA256 69b0912462f58783a764ad98e0e83c80405d237f465e5d5e3e90689dbd2a9beb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 29.4MB
        • SHA256 e7542964382acc8685fffdbfffe7785bf7d0bd4e2e00a72844cbfb329559ab40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 26.9MB
        • SHA256 5eb8df28744e6ec7f5b3db18ecbe6c61e9fbe911bf2d3120a2430c0ae51b1d5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 28.8MB
        • SHA256 fa9cf2f2f7e81367ed57da240e0ba168b542b0f9cb22d9d0170116636627ed27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 26.4MB
        • SHA256 394ad25702f7fde64db304a9dff8f4cb8299016d1b178fdd23a954ff47a235a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 27.7MB
        • SHA256 99ba8c695c8d735e901b10bef9d6bd90266db3dc32aa10b156cf139baca3b116
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 28.2MB
        • SHA256 e0a2a2fa79bc3dc0251ec6f783eb709e513ad3b0529fdd6e93440166520a87ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 28.5MB
        • SHA256 f72dda31ddf96036b205cd46df335cacc3f2e66987405296b65f4d6cb202ca5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 28.2MB
        • SHA256 c619dfe1fe78c9b4028c195e033f94fcecdbbf8476e42060b5d99a5713f5d7ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 27.7MB
        • SHA256 2fa23ee697a5a41aab02a6417026835fd688e353bd12b442747945947ce412f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 26.0MB
        • SHA256 3a6da30ccf3e3e713735eb0d54b7b3a5cf69eb04b0f4715509429d813d9f6fe2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 27.2MB
        • SHA256 de714b2f898171c68653da0b63cf0678bd79f1f0d32f5f1ea1bd573084891245
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 26.8MB
        • SHA256 a1ee9723edef3b843d7aa138a7cf143f1c5a339d10381b8a2583d296429591c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 27.0MB
        • SHA256 5cc28fb931d34fa3e0d17f1929b0169760f69997dfdf76f6f4c10eea4b441319
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 26.9MB
        • SHA256 f72034b4edf14fa717c913218a33ebca36bce6ef728272b1b899eea0b09e1d54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 27.8MB
        • SHA256 ef6771357c4ca8c051a234c1833564a0d5a828129f6831a361d31cf677f0555f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 25.9MB
        • SHA256 9eb35c80801e1060708eb7d5d756811160a867a744c404761eb8ffbd3f5924cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 28.8MB
        • SHA256 27725e61bf6a473ac62bef82d1bd4911829753ccd30bc6cdfb52717f914f0ab8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 26.5MB
        • SHA256 0f26f883e3eac41434c7d6e8b8b215f9b76ca38d1a10c1599fd22a768a8033b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 27.2MB
        • SHA256 67edc10893a229f5521cf50cbdab9476f35558b56b75b45ebf13c1e02a6a512b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 26.3MB
        • SHA256 cb95e71b1f7974cbdec4b509e70487124d0251d6ab1945577a911309203f26c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 26.2MB
        • SHA256 9af7e01c3fdf1126f8d31db46279916c1ed8553a5c0def5678283caa51d12225
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 26.1MB
        • SHA256 0489192bba0ae5daa348ec5628946f05aebe18bca8d18abf9af8648d541044b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 27.2MB
        • SHA256 ab4502c15c5bff08b716e74276d1530a3ca3ffaa5d8356a34100787f8c4f69a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 25.6MB
        • SHA256 6ffa46672433c82ba72980359f8ee8f4cb74e405dbb82d78a62d409d7dc51c97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 43.3MB
        • SHA256 00ba8a0b123b4093dd8558c9f2a3599adc8a187f0028eae8db72a1e491531f25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 40.1MB
        • SHA256 f7ec23fe363412de9ecf7a8a106a3d4069404e158cb00317d62fd3055cbd48eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 39.1MB
        • SHA256 c3310c74f7ff7adaae03236944ee0a37b7378e9ccd2bf043ec6963a84676fd8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 37.9MB
        • SHA256 386e389ff092c5099cb0d6106198c89a97a8ff1283a7c53010fb034b1f9f8479
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1228-40-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4952-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4952-23-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download