Overview

overview

8

Static

static

3

2026-08-03...r_.exe

windows10-2004-x64

8

2026-08-03...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/08/2026, 17:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_71de3aff4527606c51a48175197f684d_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 18.5MB
  • Sample260803-wembasxtd1
  • SHA256 7fa80822db8bb55800ac261ee80a6144cf2187355f0c83aa5ea692ce79b63072
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_71de3aff4527606c51a48175197f684d_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_71de3aff4527606c51a48175197f684d_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5888
  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_71de3aff4527606c51a48175197f684d_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-03_71de3aff4527606c51a48175197f684d_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1200

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 19.1MB
        • SHA256 abc45bd97adbbbd3b75c5c7ade55c992cce1433113db2c5d9510ab140cee3ad8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 18.5MB
        • SHA256 7fa80822db8bb55800ac261ee80a6144cf2187355f0c83aa5ea692ce79b63072
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 37.7MB
        • SHA256 b79fe22fed212ef16cf593fe92de67b0383e5c546995dbef4256b54d6f5b4de1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 37.1MB
        • SHA256 25a45ffc1385b830e2f79355ecb0f433a922f5216f962190a6fd080c8a810071
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 37.3MB
        • SHA256 1a790f0155feeeac5ac18a9152deaf8db88cb072e17752414c3b4b542b149d29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 37.1MB
        • SHA256 9fb677b7bfd1976eff481f32710de28ef3398f767a0f4681a6ae6edeb45628a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 41.2MB
        • SHA256 f9b09c635ba0d8491b0663b2225beca0923922478d76f27639db27734a4554b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 39.2MB
        • SHA256 45c5556d06b1b270d262b19867bfece54e02f873e941d1082fd7415e6866c5ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 38.9MB
        • SHA256 8b4763e4a1e1415033037f47dd4af350496360106f7b503bcf858e4be693eb17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 37.1MB
        • SHA256 856e010c3f0436296ba7152f6fea1216d14185a9f3fc76482bfd8e2d70049100
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 37.1MB
        • SHA256 bca7af6b21bdbb88f2bad130a7cc27c5b7caf58e095ae664e9508725f01f5cb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 37.4MB
        • SHA256 4daf348eb18678807f46a0ffd8ec08d00a4491b2b14749afbc52699f63de522b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 37.1MB
        • SHA256 b55cde6548c7983bcf5204e0ae1e156f5e8a116a41ed370c91938bc00ceb7653
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 448KB
        • SHA256 ef1671569d85236e5e1438807fc26fa3d0c89d95284243558028b54dd4ac3913
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 37.2MB
        • SHA256 d8f41e3e9d498777996dac37828235f8fba610476ca93483ac65eca23dc480b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 37.4MB
        • SHA256 15d20740ac0695325db98674e820cb07e2962dd87db1e8bae37ccb9ac3550cce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 37.5MB
        • SHA256 e11c12d101f8f6532f5f478febb3661cf6d21f7f3de4f9dedf0c90c7cd1c1993
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 37.1MB
        • SHA256 9a30f3b0dde880cda6822afd8f5a0e217c29ef41b3487b8ebed6dbf430b2e606
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 37.1MB
        • SHA256 cae4fe56496d2356bb7e6c68982267946219706ffd2c5347c1ce5240edd3fcbe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 37.1MB
        • SHA256 64dd388957e82768d0eee92f0b6933007a6f8863d0f4867e954f0919e849fa13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 37.1MB
        • SHA256 023eb2875c7c90a41cc6c93c10e628086c4a7606acec2bb5286b50b4dca942b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 37.1MB
        • SHA256 73f8544ae817462c03ddd9d5cebac924934bea15035e3a277e1bd8e0725ff115
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 37.1MB
        • SHA256 5c0254f52a11b1dcdc244d039e274bc30816d98bffac69e13346b1ecac16e0d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 37.1MB
        • SHA256 0591b7c022d60c659340462e7e8c86279cca3df73e590e635404bf3f0bf6ab9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 37.1MB
        • SHA256 ac46bd1ed02474414cd0f793e9bfde33469f5e94e8b2a5ceb340c4dfe5731b72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 37.1MB
        • SHA256 73688e400f7547acff31e4993579421c905a7b1ea045b46d9515e2cca4e657b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 37.1MB
        • SHA256 36f4bf18f3608ade9c72a6c738412164eaf6a5a9530cd51f95d1e726cc788046
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 37.1MB
        • SHA256 48885365924900be84adb8befe59080b09a45602dd7951d08899dad2a90c9d48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 37.1MB
        • SHA256 c74ee20eb716d15440e8f96e605545bd7fcab93d3e434017f586e28ef83b483a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 37.1MB
        • SHA256 1052b771f5875e06f5e79c99348eb9d4f47f1a73e0dabbf841d57832a64db498
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 37.1MB
        • SHA256 e6e50cd4e21493a78f45fecac641638bdebb4f48393c7222d0edd5a9169c16f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 37.1MB
        • SHA256 19578d0d441fb93aa6578e04fe72d2c1a8bd405b2515308f48887255f245e1cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 37.1MB
        • SHA256 24cf77d5f16fb897daad902f98ac60039f1653aded91e16d8305c71dc7865a0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 37.1MB
        • SHA256 8cab81ced3c942de1f160565f89de0ba58f0661dd7f18bf8a7d3c30ace066fca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 37.1MB
        • SHA256 1f1a342f7e32f239bbf959731900f6c14dcb861544d0b228e1062649b0598355
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 37.1MB
        • SHA256 68de698f73a58018ffcecdf586dc402b39c5503986deff626d67a85e666498d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 37.1MB
        • SHA256 284815e17bcc0a41fcfc788de743e8fb67ccb771eac082a67219c1bb5b1d2b6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 37.1MB
        • SHA256 e62db95041ab0970b9f5ad653971a4ebae1b97208b13129a6eba763765201916
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 37.1MB
        • SHA256 724f9ad908b2288d09cd09d4f93496e4db3bfca0ea6049c2834b6eec8d4f5017
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 37.1MB
        • SHA256 abbd09ffb0cda2ef54f70b76070cb42a68861881aaa99acafe7467dbd81d18e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 18.6MB
        • SHA256 cf2a00d106bb9ca18cc51ef5e26e6eb736da79269de9ce5eb8284765b6b48cea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 37.1MB
        • SHA256 d1ec6b7fb08ffbbc5a52d3cb890e5ee29f57f3b6797f2f10e9350220f121fd1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download