Overview

overview

8

Static

static

3

2026-07-30...r_.exe

windows10-2004-x64

8

2026-07-30...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/07/2026, 03:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-30_016e01608287e864545edeb909c0f18c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 13.4MB
  • Sample260730-ekfbhasxct
  • SHA256 03a3e2db72713d227e912b140b9c91e7943d2de0ed287028cc9092aadeb998c0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_016e01608287e864545edeb909c0f18c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-30_016e01608287e864545edeb909c0f18c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3240
  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_016e01608287e864545edeb909c0f18c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-30_016e01608287e864545edeb909c0f18c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4056

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 14.1MB
        • SHA256 149c715a0a3b2537f86148b43c8c071526665129b3670b3463963871ea41a5bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BlockSet.htm
        • Path C:\Program Files\BlockSet.htm
        • Size 13.5MB
        • SHA256 5801059ba339e346c56a510483a9c32a7c15cbf917e1f7ce22f2983ac7f7e3c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 15.5MB
        • SHA256 0425f0adfb3c0425a5d8f6abde1ed8ae7729402e0084d6424db08c9820fa5dd5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 15.6MB
        • SHA256 62f8a86560619ccc1dcadb7c81f1c73a158a8bc0644630040f69e6f35952f5bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 13.4MB
        • SHA256 371cb41c1242d90ab1a13dbc81162e99ba768d28e49664e769058d6f48a97cd9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 13.4MB
        • SHA256 81f394d22283fb8e1c7b746a5f58f87bfec2b753a20b3ddbce70d6d520e9cde6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 13.4MB
        • SHA256 86c4410503214e0d8876e7a1ff4dc0da77e1f52342cc016df1c9d8ed6a748bc3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 13.4MB
        • SHA256 0dec571f3a867592e1e77c9e793a45efff2ed5fc09721640e3570052ccd4cad5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 13.4MB
        • SHA256 c157cab31f68715125b5eeb9a7911b28150ba9a907ab74f5220a2e6dff5feced
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 26.8MB
        • SHA256 848c902ffae2db3e393bec5cc0b01e7766790e9502b1398b60f5a87b1b7ec327
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 26.8MB
        • SHA256 953723516b2b65dd90ec1b8ed99c22183acf65adcad9898780588f0d51b73175
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 27.0MB
        • SHA256 eff596889538e0b6dd85a79647912ea57d978c4379616d20de317ab3aed17e06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 26.8MB
        • SHA256 8b2767ea4f3c53d3605195db7546c18b4caec47191001ba207c16c4036b59983
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 26.8MB
        • SHA256 e2264a50f9453ee3d221987a12809a2d193a24c31651cff7d547f1efebb62a8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 26.9MB
        • SHA256 731b1a718fbbb56e106d18bb861379f30b862a6e2379c81858f4ba8c7e07bd19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 26.8MB
        • SHA256 1af0550e36b5f4bb032b94661dbbffcc1a92561fe4acbfd0552213e03da64e70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 26.8MB
        • SHA256 85faeabdc7f6682ca424037ce1f7fc0ad09906a7d4160ee14b52341be00617d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 26.9MB
        • SHA256 e933b671b88a90c4e5a676b28519b06150e57ce7a9bdce29a50f303dfbef6bdc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 27.0MB
        • SHA256 bda86c1fb88c00f592a5f2d5f588a0abb19e1a2a5b51df2e1fddeebab2cd9ecf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 27.2MB
        • SHA256 d2c020eea5786ba109b0efc818f5f653223ea301fe9993ea27513339ff5b5d32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 26.8MB
        • SHA256 ef7185260143786dc9084cb6ba316374c390b06a2f135bb09d558fb800f7d0d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 26.8MB
        • SHA256 d23369c49450b3943fb6ee37d460fef8e95ea596bcf89558490ae94b172b8fcf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 26.8MB
        • SHA256 ce5f94bfb0902d9e6c839ad1adab513b293b32f0c0a2cfa76cea92a0677ff962
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 26.8MB
        • SHA256 fcedb36b2dfc27dba7421a3e70a2cb9652dabac460244f0356315fdb347cc66e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 26.8MB
        • SHA256 2ce705a86307ac1fe268470931744607ef8bea6378b681c16d48f45b27155882
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 26.8MB
        • SHA256 4dba81837c7b07c661cd773b48bdb4414250a912a9a5b469f85d5af3e2d406ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 26.8MB
        • SHA256 12a4c80be756cae323a8f91695e3d65ea462cc0995184b7e12a5a401ec1acbfc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 26.8MB
        • SHA256 69f71a47e565f674a2188976c8c99da869543fd27f1ca99c76828c44bcbc3781
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 26.8MB
        • SHA256 8c38582715dae54f32153317ea4879c92748890b5fc97f3f354ee0bcee9d3292
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 26.8MB
        • SHA256 18ff5cfc0488c089d4244ef8b2b5ff52cec386be1ab477ce8360aff3d3161ffa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 26.8MB
        • SHA256 fb63291015772e990fc82d769604c5a76a00b4391a86dd117bd28528e3cb5bcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 26.8MB
        • SHA256 c3bdbd17a27d3acb44e610420c43223eab0974cbc83d1d8c35c84f7d35720d33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 26.8MB
        • SHA256 63a790f1acfc6d7949f7e2039642e035abbd65a173c344bf5bb5abc8ba696961
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 26.8MB
        • SHA256 01be78c759d1ce1a669d52ffd30fbc13023ca4e2f0b95e22d68442f64dc3a193
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 26.8MB
        • SHA256 13da30c6e31ad72bfbd0a4311077e70464659163c4e03f39d8b31172fdba883e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 26.8MB
        • SHA256 d173d2a07ed6c0f0886394d3c7c422da3446dacf51c3cf3f39110f14b66a8b3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 26.8MB
        • SHA256 d4f0dbf2dc0db46e5563e3bdd1216f71dc2aba68f6dbcacacf8b34659a102789
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 26.8MB
        • SHA256 c6d222d261f525c3b8aa19ea6e06ddb2a85681774e06dc22d408ff2d8cce7fb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 26.8MB
        • SHA256 6bb29572ee258e2506353f137fa7f9583d5d1636a9b76b2905d341c51dd3d153
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 26.8MB
        • SHA256 268446568d2d32b55711d88471bd84d9b6320d1e72642eb90b2504a905abcc21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 26.8MB
        • SHA256 e76c3d4f56f3424002ac2dd47de33ea3ac1a8330cd5c8b0bbf8f857e406d1d5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 26.8MB
        • SHA256 b234dec0d25e2bd9c73fd374351a3193d88352153f93f0d81965a89614637108
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 26.8MB
        • SHA256 d2622403242082debb76957ac572d1a0968d64308e5e26e4230fea1a539739c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 26.8MB
        • SHA256 9ec562f801cdd4b83d75688a66daf961afdc80538f464dda66dd5907bd2e6938
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 26.8MB
        • SHA256 98e0c748c840f5487a7306c189a969b8086910f2289b7ae3ba14197119c2007d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 26.8MB
        • SHA256 c04463d5c41bb551276b92092320bcf545ba7d892f1c8c70777b1361ad57a847
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 27.0MB
        • SHA256 a07250b6b3561a64b3f6e8211150f57e66568a86ebd2b7a2b248c5d18928e4f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 26.8MB
        • SHA256 577f5f78fad227e1f18b082f8a70ba504f5d53a74cfe7ed311ec2e90eef76aa4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 26.8MB
        • SHA256 2cfca06e4e3347cee9125e9149a63da3a8812a73205f703c62d9d0639e074a74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 26.8MB
        • SHA256 02edb6ab3db1c893380f93712efe7784297afafde3e84aa43a58a5954cf4725c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 26.8MB
        • SHA256 d45e378f631afb02364f69b0ea015a54bd14fbb6df40654d8639e3631ff89a4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 26.8MB
        • SHA256 bb221340bcb2f9a74a0313e2573d9794a99d61042f399e45a2e70ae613f405e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 27.0MB
        • SHA256 139db327798411d8288ccebd53289591880dd5ab13556c0afbbade6dc36bf879
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 26.9MB
        • SHA256 1eb82c5e36c6b231565c51bcb79a85374a2e0060b302d827df75c53ab7181175
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 27.0MB
        • SHA256 b7774eee12f8a95a0c9be4a018f5744d0fa1cbf57c4b82c337279812df70118d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 27.2MB
        • SHA256 2b74849e8b8dedc5e7f063d341d0709b14df131e3356f174e0736525d7263586
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
        • Size 26.8MB
        • SHA256 94a623eb998f1661b982c7e991c1ccc79f6fa638e928b88164fd564ce482df44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
        • Size 26.9MB
        • SHA256 442e904456c18a2ba13c4368d847a3d308fb840bb171cda92a604e559db8a176
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
        • Size 26.8MB
        • SHA256 22a4ab29356ec574359a2addc9c909c217fc8689b391e7355070e5d635b2d589
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 13.4MB
        • SHA256 83dd8e945648da2b78b88ea4b4491d3ef8ce94bf0c659129d6d88dd0252d3967
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 13.4MB
        • SHA256 03a3e2db72713d227e912b140b9c91e7943d2de0ed287028cc9092aadeb998c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3240-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3240-4-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4056-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download