Overview

overview

8

Static

static

3

2026-07-28...ij.exe

windows10-2004-x64

8

2026-07-28...ij.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/07/2026, 01:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-28_0964f2bed0a2eb1a4d3dd844b170dba0_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe
  • Size 17.2MB
  • Sample260729-cantsasblc
  • SHA256 83a610afc832c3ec20e886c6743beb9181b9b869d286d7f3926b63e0e99a23e8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-28_0964f2bed0a2eb1a4d3dd844b170dba0_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-28_0964f2bed0a2eb1a4d3dd844b170dba0_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4892
  • C:\Users\Admin\AppData\Local\Temp\2026-07-28_0964f2bed0a2eb1a4d3dd844b170dba0_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-28_0964f2bed0a2eb1a4d3dd844b170dba0_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3596

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 17.9MB
        • SHA256 198ec6d5a6893db89544217f398ad99918b6ef870fb3bf9607001e758572bb4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 34.4MB
        • SHA256 35ded840f8b9ab75439ee9790ca402e4a992622e585af42858d81064f26da44c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BlockRequest.exe
        • Path C:\Program Files\BlockRequest.exe
        • Size 35.0MB
        • SHA256 0623136e25c5873e38662265190c9e5ca873faaf48406ae1587baed569dc1d84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 34.7MB
        • SHA256 c7a2e40bbe1900d945fa399dea8b4943f977249105a314b25b56a300a48f1a24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 34.5MB
        • SHA256 0615a4a991d042f9a814ecfe3a1adb4ad1bfc6bcfe9b7820be21f5f7a597149a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 38.5MB
        • SHA256 b56d1cf1af75493cf58110115cbe211b2686ed08badd8ef5a5892d5f12deae25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 34.8MB
        • SHA256 e25f31a17e634391d70b18414c8a1034aa81f02c0c7acb1b45f0ebfcac74418e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 57.9MB
        • SHA256 c0dd2d97c99ebfe3cb7261a2463e95d1076e842e1593d6bb08a48bfc2c9b4fed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 19.3MB
        • SHA256 7f6b94b371094c4f16df6b77ef07f2cfb305210d00df3b2185b250bca775b6b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 34.5MB
        • SHA256 8772fd178f66a8b75924b36bd2ba90e48cc44054afd0caab5e9ff54f04cae642
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        FindPop.exe
        • Path C:\Program Files\FindPop.exe
        • Size 34.7MB
        • SHA256 6f406e95c22a505e14f05e3500aca4435e5ef2e663c49db81284ebd10e93c89f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 40.5MB
        • SHA256 a8f2dcda6c5439ceef035803d67559f2f057c7102654d322998e509ee4f18d0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 37.9MB
        • SHA256 655654bf0e2446b6673639aef2feae99835608d73f72c75f8bcad89ec540c51b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 37.5MB
        • SHA256 582e27ec69826657892a17bf2067ed0469953dec05b41a0a8c83eee6e72f31de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 35.8MB
        • SHA256 83f90598f6af13142df1a2a77b2747719dfe7a67b305995f3fdd65f59c973aa8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 34.4MB
        • SHA256 881e4b92c4e32f5c41a968f3bda01d5d225a7135c1fd352578dfd4bb5a92bb6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 34.5MB
        • SHA256 daba058903a571811035563eaa7e122f02b2241e1c9523a8ff8a889b82fae194
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 34.4MB
        • SHA256 b7cb9753f9f58db8cd5e3fc4e258f745fcd4b73a38bf5fb9d364c09eee667f03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 34.4MB
        • SHA256 d6543e1396fa96da798b71a6c9e404f81f9ab2bfcd7029de46e9912034c5af2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 34.4MB
        • SHA256 8d34da615f0d37fe09bebce82a856d98b3724f6f8c560d99a7168615554f1776
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 34.7MB
        • SHA256 ebdbecde606dd8f8b6466ecdf2bfff09506433a3371e9cdd6fdaa1d4871338df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 34.4MB
        • SHA256 4a2aab4775c270d15aba3cb5d70df4fa2b684d03874492798e6ef6fa932bc779
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 34.4MB
        • SHA256 ab32e23948c6d62715639b2c106da3eb4a04d84dadde6dcb83b7c6d2971cfd4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 34.6MB
        • SHA256 a649385b85f4d4e651a042e7e83d8bbe3fe3b7e2da3ffe543b378efa2a78e57d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 34.4MB
        • SHA256 dc065c1636c1a2596b6a721ece52e95848d984c9965af948a342a230aaa60291
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 34.4MB
        • SHA256 e88c6dd5e8d9f23f92b16d12d843c048c9e4ed3c3769c4150a0ead821b295c86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 34.6MB
        • SHA256 73e3f59e01e54c3fb0992d19eb4ed5513b549c2c15d332d23fa455a2390aed14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 34.9MB
        • SHA256 8070e3ebac1f4ee1cb34b6445fea88330b67f5511dbefac4e2b1e617ef03892a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 34.4MB
        • SHA256 d5d760bb59a1f058382c7f5618a9498e56b54c32f44a73fb82b71531be3f4088
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 34.4MB
        • SHA256 93f1c99e27025240dca2bbd55a695e1c8b698a84583b363721383f1813cd67ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 34.4MB
        • SHA256 8a23bf462f22df5ac3b16a87da985002e6c1847d64001db1bd0e3917aafdd2e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 34.4MB
        • SHA256 4d30b70d23a76081c5ff991590445b13ff5e090c713dc915e3bce5125b043152
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 34.4MB
        • SHA256 666f263a4ccef8081b6664e54f3e393b124e0d2b274bfb6950f45edb539a4afb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 34.4MB
        • SHA256 d96f13e58f2e3d3fce334b935a6416c55c110cb0b72508e3de7c729ba6cf42b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 34.4MB
        • SHA256 16853b5548606d4d49b92ebe6ced42ef6598779cf729a09fb980a2f00ac81e06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 34.4MB
        • SHA256 bc8d4b876226a80a61484a03fe1233f74c0c73a4c061ef70028ff260cc98afcb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 34.4MB
        • SHA256 1daa2f677d6e1b23555315a22a507fbea8c69880e2202a92075f4190dc6b38d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 34.4MB
        • SHA256 d22aaee820723477443f079ce3417c0bb65779537118a0644afb3adac4018831
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 34.4MB
        • SHA256 6870bfd48ead6a69b894fe72efdf03ab69e61d935983a3e023e4b65e47209f6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 34.4MB
        • SHA256 585dbc58c767a4786e3714e1db3d489be5117540aaed4ed4cf325e743fea0ff0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 34.4MB
        • SHA256 c49600ac1f4f30ad39d0316a2e9c2fe8bc5a6022bb0a07e7d13fde8856714b1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 34.4MB
        • SHA256 f458ea88187ad67d4fccc83996235d4f25cc869abefce34f34024f2b1d47bd52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 34.4MB
        • SHA256 bc9a48af27afb4e9c1d6ccae8fcaa0532bacf51c283c113ceacdb8e3f0dcd0b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 34.4MB
        • SHA256 1d5d8f2da8f20e70c791d987b82296340e9a3c2591ddd3656099aa4a02d1ef6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 34.4MB
        • SHA256 cd31f3c593a53160b8af87fa5d015bf6a002650a5fc0390d3bb7bed6d8cfb02a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 34.4MB
        • SHA256 68135574966a9255999176c49047c97be5291248de16dc8991a66b2b43c1c77e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 34.4MB
        • SHA256 c41fcd1598ba381e44fc09e5015ef51cc56e17f7494ea5726cca94e900d539ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 34.4MB
        • SHA256 d9b83c11c85aee366a79b0848b7065323bcfa92cc0c07d3748cf73b107753e60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 34.4MB
        • SHA256 e81ce4444c42bc2db8267c21aeb1a962c3c704f1618956cd330bfb340c3f172a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 34.4MB
        • SHA256 8f5c05c9d5cdb0c2862d69703c55cd238dd4f09a8155f4c863f67dfe72765396
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 34.4MB
        • SHA256 d348059cbb44653aa3d23c0a69e988f1e23c106c17f0e3d01ab462347aaec804
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 34.6MB
        • SHA256 9f4814aa2fe4dea02272b4f441ccaeb9af685e9f3813ee86c6dc14cccd3d347a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 34.5MB
        • SHA256 5dd4eec740517d1009f541cc1b2f66bb30c873e547cfcc7ee568ed78161540a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download