Overview

overview

8

Static

static

3

2026-07-30...r_.exe

windows10-2004-x64

8

2026-07-30...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    115s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/07/2026, 03:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-30_016e01608287e864545edeb909c0f18c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 13.4MB
  • Sample260730-ekfbhasxct
  • SHA256 03a3e2db72713d227e912b140b9c91e7943d2de0ed287028cc9092aadeb998c0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_016e01608287e864545edeb909c0f18c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-30_016e01608287e864545edeb909c0f18c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4848
  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_016e01608287e864545edeb909c0f18c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-30_016e01608287e864545edeb909c0f18c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4636

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 14.3MB
        • SHA256 ad6fb516e0f011c8e89ab2a4ccb268c6af6dbba5f0134ff02dab14f096fb1f60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 27.4MB
        • SHA256 fe116b756c6df8e49a5b24fd71fe14b953223bb7c6fb1c3baa77098b1c003a95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 26.8MB
        • SHA256 5800e9e582392ce4a990579c0a254e5c489844c373039e28e9134ddbd10ce6ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 27.0MB
        • SHA256 8424c3fd0895b3cebcc082f9a016637918a45218626f15b29d2521d07ed5c95a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 26.8MB
        • SHA256 f8ac4d18d09bcefab26953218d274fadc3dc4df71e894adcf34cdfb97846751c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 30.9MB
        • SHA256 3fa6e553760a74ec0f989dfae3a7995c3ed8e2519926ea96c81a5da2651af910
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 27.1MB
        • SHA256 d8dfd4c9471b7b0b4d7d2aaaf116fc41eb5ec1c2454a3784acccffe1a2ad6418
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 50.2MB
        • SHA256 4a230e4815ca3cdf4c9e5a0995a1bb03bf41cae554db8d59f39a461c22b1803d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 28.9MB
        • SHA256 733e38c30398823c8c8c0c9bf7cf1802084c5f9a3505e69b6d2b43e3b21c46d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 26.9MB
        • SHA256 8659ba39f5e36efe22c4892053114f25044d211acda7d6b0460240457c830443
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 32.8MB
        • SHA256 2bf941efecd5e74a08fcd81937515ffd4352859fdcd01f1181fa15a7d272d2d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 128KB
        • SHA256 018b597827351ef5fba9c0e1d321cfa9b45d887ff0f8d5607452eb75d8626cb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 30.2MB
        • SHA256 0d4d3ebbf80d7716ba3141a6fefa1b031f8827db696b0351e3abfadabc20dd1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 29.0MB
        • SHA256 c1721b9cfa6f0bdbf59427241026fec0b37fdc1c3830b4173b3255ae2f3427d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 28.6MB
        • SHA256 dc9bacdd4e079de2ee494b15d384a735f2f408ceef60b1ae771a0eb243fea060
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 29.8MB
        • SHA256 ad22e675c25b8cc3e41fad8ef7824c30387e88ec73d7d3e4e64ee42a97c328f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 28.2MB
        • SHA256 28479d2d758e12fce9fd739b0f9453c6e19ac2a249c7e9e19c3b87f70d7c9003
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 26.8MB
        • SHA256 c68330fe58bf8ba7347c3af7bd36a6b00f00e4a23a741c709b4d1c736467b992
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 64KB
        • SHA256 d2eb08ebe0c7e7ff2223b6feb8c95f679251883e0b850d913bfa4b604432b861
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 26.8MB
        • SHA256 f77a83721a592bbb5cc4154c0c3ed8b256231992ce5e8e9f015a74beb2a0b97a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 26.8MB
        • SHA256 92d673ee9515fd1e3cae77381159d00c5db2854e7a89a02761b926eb99979f01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 26.8MB
        • SHA256 5983811d05b1b1f4ede69e2183d69501f77c4553d7dce40d1f92f5f02f5ab4a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 26.8MB
        • SHA256 848c902ffae2db3e393bec5cc0b01e7766790e9502b1398b60f5a87b1b7ec327
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 26.8MB
        • SHA256 953723516b2b65dd90ec1b8ed99c22183acf65adcad9898780588f0d51b73175
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 27.0MB
        • SHA256 eff596889538e0b6dd85a79647912ea57d978c4379616d20de317ab3aed17e06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 26.8MB
        • SHA256 8b2767ea4f3c53d3605195db7546c18b4caec47191001ba207c16c4036b59983
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 26.8MB
        • SHA256 e2264a50f9453ee3d221987a12809a2d193a24c31651cff7d547f1efebb62a8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 26.9MB
        • SHA256 731b1a718fbbb56e106d18bb861379f30b862a6e2379c81858f4ba8c7e07bd19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 26.8MB
        • SHA256 1af0550e36b5f4bb032b94661dbbffcc1a92561fe4acbfd0552213e03da64e70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 26.8MB
        • SHA256 85faeabdc7f6682ca424037ce1f7fc0ad09906a7d4160ee14b52341be00617d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 26.9MB
        • SHA256 e933b671b88a90c4e5a676b28519b06150e57ce7a9bdce29a50f303dfbef6bdc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 27.0MB
        • SHA256 bda86c1fb88c00f592a5f2d5f588a0abb19e1a2a5b51df2e1fddeebab2cd9ecf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 27.2MB
        • SHA256 d2c020eea5786ba109b0efc818f5f653223ea301fe9993ea27513339ff5b5d32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 26.8MB
        • SHA256 ef7185260143786dc9084cb6ba316374c390b06a2f135bb09d558fb800f7d0d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 26.8MB
        • SHA256 d23369c49450b3943fb6ee37d460fef8e95ea596bcf89558490ae94b172b8fcf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 26.8MB
        • SHA256 ce5f94bfb0902d9e6c839ad1adab513b293b32f0c0a2cfa76cea92a0677ff962
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 26.8MB
        • SHA256 fcedb36b2dfc27dba7421a3e70a2cb9652dabac460244f0356315fdb347cc66e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 26.8MB
        • SHA256 2ce705a86307ac1fe268470931744607ef8bea6378b681c16d48f45b27155882
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 26.8MB
        • SHA256 4dba81837c7b07c661cd773b48bdb4414250a912a9a5b469f85d5af3e2d406ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 26.8MB
        • SHA256 12a4c80be756cae323a8f91695e3d65ea462cc0995184b7e12a5a401ec1acbfc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 26.8MB
        • SHA256 69f71a47e565f674a2188976c8c99da869543fd27f1ca99c76828c44bcbc3781
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 26.8MB
        • SHA256 8c38582715dae54f32153317ea4879c92748890b5fc97f3f354ee0bcee9d3292
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 26.8MB
        • SHA256 18ff5cfc0488c089d4244ef8b2b5ff52cec386be1ab477ce8360aff3d3161ffa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 26.8MB
        • SHA256 fb63291015772e990fc82d769604c5a76a00b4391a86dd117bd28528e3cb5bcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 26.8MB
        • SHA256 c3bdbd17a27d3acb44e610420c43223eab0974cbc83d1d8c35c84f7d35720d33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 26.8MB
        • SHA256 63a790f1acfc6d7949f7e2039642e035abbd65a173c344bf5bb5abc8ba696961
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 26.8MB
        • SHA256 01be78c759d1ce1a669d52ffd30fbc13023ca4e2f0b95e22d68442f64dc3a193
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 26.8MB
        • SHA256 13da30c6e31ad72bfbd0a4311077e70464659163c4e03f39d8b31172fdba883e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 26.8MB
        • SHA256 e8dd9425bb3f249cebaf6619019872bd432f675af6c182cafe7c69a5601b1d2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 26.8MB
        • SHA256 d173d2a07ed6c0f0886394d3c7c422da3446dacf51c3cf3f39110f14b66a8b3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 26.8MB
        • SHA256 8d26e6d92567979952f8d56ca963e8a0784062d4fc9063fe63155fcf510231ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 26.8MB
        • SHA256 d4f0dbf2dc0db46e5563e3bdd1216f71dc2aba68f6dbcacacf8b34659a102789
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 26.8MB
        • SHA256 c6d222d261f525c3b8aa19ea6e06ddb2a85681774e06dc22d408ff2d8cce7fb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 26.8MB
        • SHA256 6bb29572ee258e2506353f137fa7f9583d5d1636a9b76b2905d341c51dd3d153
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 26.8MB
        • SHA256 9966ca6be9d83fd0e2a216db35539cf83727cd04485b21ff581c4a836dc40f57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 26.8MB
        • SHA256 268446568d2d32b55711d88471bd84d9b6320d1e72642eb90b2504a905abcc21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 26.8MB
        • SHA256 e76c3d4f56f3424002ac2dd47de33ea3ac1a8330cd5c8b0bbf8f857e406d1d5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 26.9MB
        • SHA256 fee88bbe430a47377861090c7a72cc22d5dcbb2c967583fb7a99afe6115c1047
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 26.8MB
        • SHA256 5365ddc58ffcf5f5b62e52e40c7e306ffd1ed0dc114652fc655369e96f3cdfbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 26.8MB
        • SHA256 44ca3a289dc01b52c85b3ba6c6da04b86586e33e4d2a0350e9a03d68f8547efd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 26.8MB
        • SHA256 e485991a60740e1e3cbfce58be6d10f65eb9a630154417cfa9d3bce8d5f02821
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4636-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4848-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4848-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download