Overview

overview

8

Static

static

3

2026-08-02...r_.exe

windows10-2004-x64

8

2026-08-02...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    151s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 03:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-02_1c5a4a5f4730cd218d650a73dfca7728_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 26.4MB
  • Sample260802-d3csnatcpg
  • SHA256 e3de0b60418e3798b13b2ee4ac3f17a75d0abe4ffc71f80e1561f8fd46cf95e9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_1c5a4a5f4730cd218d650a73dfca7728_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-02_1c5a4a5f4730cd218d650a73dfca7728_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5476
  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_1c5a4a5f4730cd218d650a73dfca7728_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-02_1c5a4a5f4730cd218d650a73dfca7728_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3336

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 26.4MB
        • SHA256 e3de0b60418e3798b13b2ee4ac3f17a75d0abe4ffc71f80e1561f8fd46cf95e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 30.5MB
        • SHA256 167afeaf15546637cdb30133cbc98d84affb0429a2b2136ac8716f3527e79fb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 26.8MB
        • SHA256 c9a216e5c5a9bb83e22aa4e01f5589d8137e2df8da0856ff2897cba7d82474c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 49.9MB
        • SHA256 01085a7f70fd9313d758142a5fd607bda833b00e52bca5168e898b836ddf2a49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 28.5MB
        • SHA256 55cdea1c4295d2bb339d3c6103633b4e69f16d045422d29d2a1ab4ee42a72ea1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 52.9MB
        • SHA256 9e733c4ad14d2d4d68d15980a2a920ee44815cd05c816da3920e7965562d5e30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 58.9MB
        • SHA256 fb389da9d0eaf5484e26bc1de1729eab4f3b2a61444cb1b07cabd99b35c874cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 54.5MB
        • SHA256 4a9e2a8a071208930b9e80f09e85219de87aada7f98432128ba0c2892a87ee3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 56.3MB
        • SHA256 91161f7663c668b31243697251a4c6d551e09f1de5444c1f579f4b6928f496aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 55.1MB
        • SHA256 192daee1baf86b925c92f50be38ef19a2da56559cb47a6623aaf9cf347a27508
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 54.4MB
        • SHA256 8e95fdf69fda6b0f5adb0121b3813da08e44cd3ec9ac404310b7c25edeed1356
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 54.7MB
        • SHA256 988ab18ae693757132a713915648bd7bd9990683d1a66b840b733cd09c085bce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 52.8MB
        • SHA256 5edf0392b3267a99714b11c046ddddbfe9bad9c4b58dede9110539eebfc82e37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 52.8MB
        • SHA256 4a0d9bd65decb8c17408918931c54d15742b4eea8b426814ba72381ec6c521d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 52.8MB
        • SHA256 60f66d1f8aab5d9ca0f1189fa0dcdccbf586881652defc6f4089d6d660492ea4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 52.8MB
        • SHA256 77e59e714a748331b4d8198c072b21df52ed7bee726e6b3c958a88e18b687f02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 53.0MB
        • SHA256 a8a24f79af9e18221b5e371628d40ab8069a230ea3495879fc1472e96407be71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 53.3MB
        • SHA256 f47b7db1afe7657679acf7170f1b337cc45c478fe2548d02e352e0a79bb7dc5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 52.8MB
        • SHA256 491851e8406ef661893a9945717b92e1d4dd771a52fbe6f89d0390823a6c957c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 52.8MB
        • SHA256 b44878eee4223ca1f5668c4c7f00f22f6378db05e095ee518df3137930e24b79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 52.8MB
        • SHA256 0e8506571f6bfef7cd277fb854afbd12fe84ac446fe6715166efa98111097c71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 52.8MB
        • SHA256 7e2aa29a0642c1d04db32c91bae41a61691f4f9aefc14c2cd1dab24db7698dab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 52.8MB
        • SHA256 0a24509745216424539fa31c6c2f1add6f9cc326c96293638ae1273bc6d5227f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 52.8MB
        • SHA256 c7e327509ac56387590f000f0183c2834c328bf48a3b72fbd71bae1e2d2e555c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 52.8MB
        • SHA256 7e4b26735970fda0db364798f16f930a7440dd8126b9cca1929759a5ed78b721
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 52.8MB
        • SHA256 bbacfca77fb09815d416865f52bfef668a1f561c54a58eb23962418b2d2a4884
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 52.8MB
        • SHA256 36faca40aecbb4a3f7d1ba570bc7c5bb19cfedaec7709aaee70597c12434f4b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 52.8MB
        • SHA256 a4966d88de5b8e6f7052884e5504f200b08fbdd6c6c47ac8ea9bfc2a73e02b14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 52.8MB
        • SHA256 29cc1c42d7162052547e3c129e1deb02734f9f70c4e9fce21880b41adb2b4304
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 52.8MB
        • SHA256 5d7477667ee8692d32dc1fe8d425d9178c4e93c8f3e76ba613dd5af2d3fb9188
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 52.8MB
        • SHA256 e4c7cb1d9794010f223e3cb936e4866170bdebaec6cc7b4d8e46879f2c709ac5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 52.8MB
        • SHA256 aaa0e3246be0e9707324037ad805dea157a036d54f7eb9cd307699a9e4df7a27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 52.8MB
        • SHA256 b48358c53cb681ee2a93723953674fb3219043e0124d61d03c59f9a8d0e478ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 52.8MB
        • SHA256 30ddf62e60093236c37828161f14bcb816c8acccb2625bfb9ec9b0091cdf7e3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 52.8MB
        • SHA256 a3bef27f178728aefd305b4643cbf8467fe6d227c0780aede2edb9a7135c30cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 52.8MB
        • SHA256 ca4d4c6465aab5e75b0bbc49c9e8b4447aa3d19cd974cd39077f9f95ca3c7c68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 52.8MB
        • SHA256 614921d39467bd3c7b864b928bf5452577bd2606e734c85057fb195364a71167
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 53.0MB
        • SHA256 f6a729fcd5ce7bde475a1cf3e91a6f7938e56aa6c60123c26dab606607cf7499
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 52.9MB
        • SHA256 b4ff3a9982d6672922370987a5a768fe0646b9c2db23233baf23fea9179f39d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 52.9MB
        • SHA256 8eba36d70b8ce4e382d7b7e16aaf0307d36d518baaf5fcbd7eaac86c0aff02dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 52.9MB
        • SHA256 fa50352c12578180d69d7745f35da3acbc2c1b6a6edd2db449279f62b5c3aa9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3336-21-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5476-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5476-9-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download