Overview

overview

8

Static

static

3

2026-08-01...r_.exe

windows10-2004-x64

8

2026-08-01...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    151s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 00:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-01_5b886777970f4d4c6a418b70be355d01_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 21.2MB
  • Sample260802-a1ebxszzew
  • SHA256 493c00c926c99416f54fc926702c52d072dec1aa6e933f43fe25f85c9a1fc0de
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_5b886777970f4d4c6a418b70be355d01_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-01_5b886777970f4d4c6a418b70be355d01_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3964
  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_5b886777970f4d4c6a418b70be355d01_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-01_5b886777970f4d4c6a418b70be355d01_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4508

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 21.2MB
        • SHA256 493c00c926c99416f54fc926702c52d072dec1aa6e933f43fe25f85c9a1fc0de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 21.2MB
        • SHA256 bcb0ec14c44352f340035cdc89d91d59189f8f11f95488d3369a8a374006707c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 25.3MB
        • SHA256 6240e735d124ade6d4df1c3c1ff2448d06e75e7463a07ff38d2d4faec1350611
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 44.6MB
        • SHA256 33b003d522547b10958bba1ba6a6b9d773cc7d8f73701bc7eeac3dc9c5996a44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 23.3MB
        • SHA256 7d10e391c69279a81d3ff10002e0a2ffab8192dbb517863e89580d42b626eb21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 42.4MB
        • SHA256 0221608da4d13128e39552ee81c022ca4595d7b6b0585544ddad78403e9a7855
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 48.4MB
        • SHA256 634279b5c97148b98663fe9ccc3908da632ab90154b883fad9548a7fa80627a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 44.1MB
        • SHA256 9a4027388145807d3864ff3499d76c9b74c34036d1ca69e7cf4d058eb31d2cdd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 45.8MB
        • SHA256 1f10b3b84b3908edcb3426879d70f20cdf2fba0d57e376075e64ba954db96304
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 44.6MB
        • SHA256 284f6a6347b5cba90a65b44512b92c43bda12bcfe5a4cd5f43d9cf81d6a7e4f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 44.0MB
        • SHA256 d16d1c0b31ffe0866923b015c2e5ce3dd18cd89fad40175625c2bf3826313e44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 44.2MB
        • SHA256 49668b29bdfec831eaa79ba908a53df5f3037e0768fe559407175955db6247d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 42.4MB
        • SHA256 b4c31893e97171d00d85c297495c2a3535d962bc4ed9b35e57f8d107dc4d6785
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 42.4MB
        • SHA256 8f7bf7695f815bb5fbf28e5a40a903e2cc6b00bde998cec30210da0f11d17477
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 42.4MB
        • SHA256 593201037a89e321521e1c4bc288d3d5e619af8b7ce297d0d22aeec5556520b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 42.4MB
        • SHA256 ffc09ab0c91e96f3da9a9c1ec2bd7ab3c88daf6a1ffbc9510b55f9859a9568a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 42.4MB
        • SHA256 af06c3532bfe64963d9a7604e32021985e798ef135cd60bdcf9f5e32c2eee290
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 42.5MB
        • SHA256 9b9a489f0f91920ddae18c4fb7164260d6b62f83c0c7859e0b1bd0cf7223a888
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 42.4MB
        • SHA256 a61b7b9247ee63335b32373401ed25475960fa3e38c9e93cafcb7fcf910e49f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 42.4MB
        • SHA256 52914111bdd8e701a32de95804af853b0859635970aa2b9a8e501b06389f363f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 42.4MB
        • SHA256 ea25ed5db621719bc73da4b0af29f68f78598500c0c50c5438209ca61ab78bff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 42.4MB
        • SHA256 626efa253a500ea0e723b0b77c5e5a3b4dfb0b86abe499716bedb2afaf404f0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 42.4MB
        • SHA256 aa23822f26c2282f016ae5cb88e3aa9ab2eacb9ced4261a281649bf0f5efc836
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 42.4MB
        • SHA256 b510edee9aa007ee04758df4fd349401bad2845c0f34a647653face92ec0b7cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 42.4MB
        • SHA256 97346ef9d8bc32ea77689f9bde15ebcdab8b6bfa9897da9525c424f7d1a0a761
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 21.2MB
        • SHA256 3b0800a3c817dde92809fab93702a5e2a911e2ef7c96a730911aeb748a485e30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 42.4MB
        • SHA256 982e534f22e660df0596c55ad3f4d70b03b0a0f2582afdf6b10ebf44bb5ea8fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 42.4MB
        • SHA256 08076ca19ac9b0e25197da8373533ebe58c980b902a5e25b9d337c198c973748
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 42.4MB
        • SHA256 207e385993ea395a3701fe11c99906018b8ffcb68dfcd7f01d43b8073d074214
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 42.4MB
        • SHA256 890ccfb3a15f1adb99d0cca1cecb56a8d3411edd4581241faa6aafc34d77773b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 42.4MB
        • SHA256 83e66240ad5ef10ba7c5cc31d9fc2cc4c1adec152a5d4482bc004aa6f54bf6b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 42.4MB
        • SHA256 a09589df273583f4a9ebce52442bc46ca78b158cdbf72f9b4d483f07ecd8fd51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 42.4MB
        • SHA256 f723a08772e7f8d1d4411b6fbbd2117674fbd38cbd67ee725410cf54b1990dc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 42.4MB
        • SHA256 a1a36c0430c4909bc6e72885bc7a663e6d25e5842b3890585ca6127ddb98dc9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 42.4MB
        • SHA256 01f39b9555900953a7609a87526883a33e08c0034be332106a858839dc49896c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 42.5MB
        • SHA256 0acad567a568fe2374e6f0b6a0731e853ac6b08bfe33ea98a676653c694cd007
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 42.4MB
        • SHA256 84b75579cfd0289f599dd55c09ab98bc57666d16e8af61ffb67da7aef7b520ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 42.4MB
        • SHA256 17b653b46c05026e27cd84e678c1ca62a0e1779b55f43f7eb6541e8d207afa16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 42.4MB
        • SHA256 352551ce261b1b254461143e9326927e1f863904996e6392ac46b27281f8c185
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download