Overview

overview

8

Static

static

3

2026-08-03...r_.exe

windows10-2004-x64

8

2026-08-03...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    146s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/08/2026, 16:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_c8d9815f36542b47cef45b4585c20e29_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 18.3MB
  • Sample260803-vfglrstdlh
  • SHA256 c5646012c62c07c7a5ee10546db620b9b83ac67b6374574f36d63042eb5b276f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_c8d9815f36542b47cef45b4585c20e29_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_c8d9815f36542b47cef45b4585c20e29_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1508
  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_c8d9815f36542b47cef45b4585c20e29_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-03_c8d9815f36542b47cef45b4585c20e29_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4576

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 19.2MB
        • SHA256 002a1ca21b730c1ec30c51eae5329b040a2d3918b17cb438b3c316dbb36ea4c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 19.0MB
        • SHA256 cc710097cae81cc5e0ea7a4147f7e8130f5860fdb7f5b1e92b20af5a6d248a1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 36.6MB
        • SHA256 10d3548df09ca0648ce6437b0ff375ccdcc29b79101f61489453f50bf08d7061
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CheckpointExit.exe
        • Path C:\Program Files\CheckpointExit.exe
        • Size 37.1MB
        • SHA256 3f9f7843291d354740adbdb8d4f4035a02a975c176f3f5be9603a08810244d8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 36.8MB
        • SHA256 95f13583836dd963a59c5958446e82b186b8b153bdb944f22c59ee5fb178366f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 36.6MB
        • SHA256 75424f58028308cda4c7c566a9db6e80b0598f6b29ea76dda6cec4af2ad4a20c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 40.7MB
        • SHA256 d3ede14ca766af5812040e5e9416028e2a37ea72c01e8d091723913d863045a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 36.9MB
        • SHA256 cb9a192e19ab19ff128b017db4ba405dc505ad97bb6fad34775911e20c1b5876
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 60.0MB
        • SHA256 5e72b3a435becb627adacfe2c5bb4ecf1780585fa4260618fc4256c347627ae9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 38.7MB
        • SHA256 b997c25903bf1f2cdb44c218d6769912969617a9b0d5c901bf9eb90cfbe8288d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 24.3MB
        • SHA256 122336672d86f44b08037d6852a6cc7f66336c0f33fde48a9c599a9ce8f26d32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 21.7MB
        • SHA256 5c69b4cf92f3808cd0fce847c099685c5e527b64ba4b144695db983e561766e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 38.8MB
        • SHA256 e20d96d8238e3ae5e26dbc1bc7516fbf28e4ce569087c92a34567431f3e10ee1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 38.4MB
        • SHA256 43284ede642fb6c1e556d28ecb6ab52f619291b97b0e6039770e3cd5d1757d83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 39.6MB
        • SHA256 65eed7ba6c637c1bdbbcb791ef10d85439f40e5fcb0e8fe62e25c29c81b09011
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 38.0MB
        • SHA256 d107dfdd17c5436700888380daedc631fc52af0a47fd66acb8102b942239fe9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 36.6MB
        • SHA256 9f71b682fb9b8b27627df6347a61b140304bf1c3559e29e166d12609ed530f23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 36.6MB
        • SHA256 198c4fd1fba1005129198db6c014dfb87e56829d0a15f358c5f368c82d1ddb32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 36.6MB
        • SHA256 12400d8fbecf11f3c43551a1e11db952578e8cef96850428af81d745aa44a8ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 36.6MB
        • SHA256 cda86b090b23c94417e18990f2730084e263199eb3768daa1eceb95e74ebfd9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 36.6MB
        • SHA256 146502fa3ac073708e1f9e199623751e72f3e777bfc6605dd3da3217b6e30bbd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 36.8MB
        • SHA256 a5b3edde28ab6e01e42ad24d51d39719e77bfab3a9fbdf9fbc51f921f7ba8da9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 36.6MB
        • SHA256 7c65a7f1286ce3b0d1dd332ad6b6a8325b5303cb613ed67cf8c246987401bae0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 36.6MB
        • SHA256 43cddb2ef2916c1cd0d8c84ca65e6eed1fecfc91da2e491aaade077cfbeeef15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 36.7MB
        • SHA256 f9e53ba2ba7eb326947993b16d7aeba9f9dd7930054fd4fceca0e126df558944
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 36.6MB
        • SHA256 be4142788523e58901a42b822c2c950a0a4751137886697d6a14b4c6c881607d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 36.6MB
        • SHA256 38f3e77626d8a7edc30265c4c8a2790eeaec69da9b9a5d310b0edbb4b9127f09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 36.7MB
        • SHA256 8d873751c74e67dcd403fe677c964826f7840dfd366c2aebb368dd8d430fd772
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 36.8MB
        • SHA256 80550d64d7905bdcb2972bb96e64b561a659e5487a0673e6598e63e1cfcf2087
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 37.0MB
        • SHA256 74a3376eb9ba60c65345a903e661e29f8779c5616876dd3da0717e34ec5e9574
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 36.6MB
        • SHA256 bc4cfc2e70934136371e5394676f3cc18b62c7b4a5423edae179d1e5d3f209a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 36.6MB
        • SHA256 bd6e1215e46441903985cd5520579abb16bd0e19dea2f20ef010b8b510e6dab8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 36.6MB
        • SHA256 84fafe38ec3f7980d28d298621122379609432102f9e1c0e899110227ecd77ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 36.6MB
        • SHA256 b64a0bedf7bac78e170484c6b917d7a0fe3d9e121025107d875ef07e1a861d70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 36.6MB
        • SHA256 990bbb9b36df508059ce6f0ce0eff1c7bb0d1909331263325c79682ef742f58d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 36.6MB
        • SHA256 f8138783c472255a297136794279cdc6e6d1065804087495366aa73a8b687bc4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 36.6MB
        • SHA256 424216863abcbc30e5be880ad9e24e40d2ee235d64510707fd7024a8eba9824c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 36.6MB
        • SHA256 366b14ce20bde3dcfcd25b2132ecea9398e9b02a9238f487ce15e8830330ddfe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 36.6MB
        • SHA256 d17a5ce04a14ab22c0b43cc32a9f05c0c0e26b7a8d791cb309702c693282be8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 36.6MB
        • SHA256 fdfb255b1cce0eca5c87a2793c64b5fde4e955f46e1024d1bbb7af9c6a8556cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 36.6MB
        • SHA256 408163ca804804a43a425d16a838c41065dafeec1401da9ec9a90ec9a4e6c06b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 36.6MB
        • SHA256 059f3ce0a7f00136fd93e789916e191fceeef65b87cfbe7c8f07823bfca44902
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 36.6MB
        • SHA256 1ee4d0e833e31b84bb4cc5d0aa48ec7f3bd1e1da41e607f566f64f5ab467d11f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 36.6MB
        • SHA256 4335d88b1fba1ae9943b97cf8726d31b7aed7547cd9228c37372a0d974e6959b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 36.6MB
        • SHA256 ed4eb6c546f1203e0bd67d28823c94532e259ca1b947a168ad108e40779372d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 36.6MB
        • SHA256 625b0dd747a2fd8e290f6ed6b5688afc3d1e0f639ad2fb73698cf64ad8e2e6da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 36.6MB
        • SHA256 b3ecb299200e78095ef7ed3a17332befcfa9c5fa8547096562a24c888895b456
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 36.6MB
        • SHA256 9ec2e79167cf5a34706ffe343cda07e415fbe0bdbfec8d664b03d6917fee0670
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 36.6MB
        • SHA256 3f126b5774a85b5f6f3009746d31a7d9f90a2841080f185db27e7b2b387f63af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 36.6MB
        • SHA256 76ee97b5f15aee62b72dedb2afa67b0874490093ea0317913afe6af207b09e36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 36.6MB
        • SHA256 7f5a9ed7056ff5592a2c0489dadb08bf11e55c15558d87b42deeaacad89165a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 36.6MB
        • SHA256 3ff04905fcb22e64e739bd26b2122c07f6aded98d9a9f18210e2c3200e3483b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 36.6MB
        • SHA256 d1a498ddab6199f2f4ac5f5d8af15a2fc20a27b089b79475d2b5223e670ab79a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 36.6MB
        • SHA256 31ff5bd71dbc4018bbe883bca6b63c68a493263f65f5ebb1b683fdb78ce331f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 36.6MB
        • SHA256 e65a5b739c8e95ec13dd41e8ee7d0491d9605f4e9bb6e9ba2f0228ab47cd433c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1508-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/1508-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4576-19-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download