Overview

overview

8

Static

static

3

2026-08-04...r_.exe

windows10-2004-x64

8

2026-08-04...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    106s
  • max time network
    135s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 22:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_c93bd5f9875adb93608cfe653e3ef9c4_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 21.1MB
  • Sample260804-17pdks1gnf
  • SHA256 1087b8c8cc5ee9cf0b559915a34eb52641760cdfcf14a2eca685a62e911de7d4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_c93bd5f9875adb93608cfe653e3ef9c4_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_c93bd5f9875adb93608cfe653e3ef9c4_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5152
  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_c93bd5f9875adb93608cfe653e3ef9c4_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-04_c93bd5f9875adb93608cfe653e3ef9c4_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5192

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 21.3MB
        • SHA256 5fdd26847be3003885b4e628b820d9c61cb351d0881ee36120552fb63c9330de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 42.2MB
        • SHA256 c3e3179aa20a2b11e2ab71dac9bb0fc39df20948949b77e59997ff910fc26371
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 25.2MB
        • SHA256 d1eac98617f9120220003588a9106e694fd009b372578e1a511ba50996009426
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 23.2MB
        • SHA256 ed6d21b1666402e1f7f18464f63777656ae957f677e6be0d784779942954de76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 42.2MB
        • SHA256 3dafd06bb925f81fe5aca127d360c9f0d184644f554bdabeec01e5e50f032334
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 48.2MB
        • SHA256 087af1c5de01e894a18e2d30ce1342daf77d635cb106cd1890c963ec7586d345
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 27.1MB
        • SHA256 99ed4420a8cf99cf7bc3d02677d5e1ea4a9b1c6431eb5c5074f4b24f0721ad1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 43.9MB
        • SHA256 e0c0b70ac739177d28074e7bb7bde50491f5e4d89ec0e83ca742736bc3f8969f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 45.6MB
        • SHA256 29beef63500d64b43ece872c44805cc3239a8c70b555e49e46f0da3c4a5d23fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 44.4MB
        • SHA256 da79782e0a8887e201f253119cfb8850fdcc7e987be82c093bf162f2d44a1567
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 43.8MB
        • SHA256 ed8b6b033f8740b997db99e30085fb3e9b4968ce81c7d04f2806c059f73cc7c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 44.0MB
        • SHA256 43a0cc83c128475311148ee484f6b47554316217e65d53b1602823e4c18e9193
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 45.2MB
        • SHA256 7d97875a1edf81eceffe1d29153b3073abcbb5aeefd373806b20e209ca6975cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 43.6MB
        • SHA256 22f6390f57a02c26fba7eb340723b89aa08cb8c30e415ceb32ce9d94cfe3491a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 42.2MB
        • SHA256 981c66265099ea39b36270d73e4615ed06b2942d5ee6411da667cb12f400a2ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 42.2MB
        • SHA256 5b772433004fcc38b4f8a31a29bae0d15913bed3d05e236d65014afde7f8be87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 42.4MB
        • SHA256 85a094de80e4571e8634838f64a75f9ca46b0813b0e4748e2ab4b06e223fdf1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 42.2MB
        • SHA256 82efcebe14b0b1fb93230e22b13357e921da8da4b85765800b68997b2c8bbaa2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 42.2MB
        • SHA256 f8d39ed88a68da2b07310c8e28a3ddc0944d22eb53d86bccc4dad5bfd32ff479
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 42.3MB
        • SHA256 2db3c978bb752a693ac07c8d4d4c77c55cb1c30c9c5a29946554b3843fc1ba62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 42.2MB
        • SHA256 a13bcf0a6e1ac6e8eca39c12b0f3b30e748a18af16f8fcb8904e9b9f2d3c1b35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 42.2MB
        • SHA256 4f24fad5a77c7bf9fa1bb8aa1218c2964bc6a36ad2808447a68529b10b6e75d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 42.3MB
        • SHA256 ee6f5b0f4e432e6ce52c866e2f576117d59ddf25bf674d204c72a010dab1dc2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 42.6MB
        • SHA256 b513cce33d271032686b5244b03aa78835a0af1a1e8acc355785b241c7d64ada
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 42.2MB
        • SHA256 dd702bc430e4384be16078d91fe15cdb8e1025d4c599e78f1bd74deb87e0738b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 42.2MB
        • SHA256 2ab4a24026225e2ddbcb75b579849b30f3347657b479029bb00dded7057035c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 42.2MB
        • SHA256 4b620d94251ac2209f48a5ca0f5c153b38d0221909c4dd30f2ba92c06da702a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 42.2MB
        • SHA256 a53de973b30c52faaf9ceb46e802a1d5fcdce2bc99b93a0cd2bcac98d7a147b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 42.2MB
        • SHA256 46e39d9281126a8e0e60a9f40fb5284de845346a508ab5391f18737f8ab81fd9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 42.2MB
        • SHA256 b2fa05b0c5ebf674ed490ce8440e93c9e0ef7cd6177192368d92d6bcb3eef116
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 42.2MB
        • SHA256 ac5286f7d1e98cdc50f7386502ecee2f63878cc051a59b2dab69a99983984dae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 42.2MB
        • SHA256 42ed5045264969e7912a98e87c366892d6a3b2d127c547946e1ee6768c21ffd9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 42.2MB
        • SHA256 d2ec673030296e077b6e77fb6444f56e640c1cd38550ea9493df73fd77a94ad5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 42.2MB
        • SHA256 00ad3c8d897cd245a351851cfae7cce3c54d9becbe4d7981cecfcaffef962cb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 42.2MB
        • SHA256 320524607ce97a7094a43b7957b2560e45311195a4e1166fe1a5ebae8273e3aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 320KB
        • SHA256 21e9dd8769a39db9165211e397543c288db6cfea67fb378fdcbfa803d9a215f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 42.2MB
        • SHA256 a324611fd24b53f6293412423c7179b0ebba9b6b2b5e49015e307c20d36cc013
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 42.2MB
        • SHA256 3279d8f603a95abc00dc07f15b8d59ad07355be2ec6f2093f314401aecc1e667
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 42.2MB
        • SHA256 c0f5bcc5d514a313c6b7819e5b33dfed7c497fd29c10f233808bb658cfd10487
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 42.2MB
        • SHA256 1d3804d8745947e3286cdc77cb6aaaa714f8a3b6ae0b2d24eab6a2e0a48fa9a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 42.2MB
        • SHA256 612845f77ef9115b4d9618f36fc347dd1ec1ed8172f5c7b9a70acd453d87150a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 42.2MB
        • SHA256 500fef37f379a4579da742398b9232ac702aca7782ccd1879e94dbbc6ef9f0f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 42.2MB
        • SHA256 8275940676ecd21111e10d47a03a85de2733e69e32a6c3937c40c4dc6881e829
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 27.0MB
        • SHA256 b30d6aa9f670e2f810df28a09e3517e76feb68990a4414ee16fd4f272e990f08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 26.8MB
        • SHA256 44e1364e506c5e8c26810196421141d0eb68523e6e14efbe0febd0608f134cce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 25.0MB
        • SHA256 6d65db5e42ccaf3fe7b2191dbdeda455e6c85b17f8559062bbbc28fc3bc423b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 24.1MB
        • SHA256 f2ff7133a502365542dca4349a52fb7222f0eb5c461f3a3274d51fe04209ff41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 25.9MB
        • SHA256 4bf2b15e14830481bfc6c54fb4e650ff996851ba162f894265c32f8abd3a1ed2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 24.4MB
        • SHA256 927cb6782788639492ad8b035041ed4c77ec6c403fb788da0b48edf01cce0379
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 42.3MB
        • SHA256 6212774a009da07394789b5703b371ce6c519bd5d38debc60978e98952034d48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 42.2MB
        • SHA256 92fc98fa683cf72f3bf663b39c7ec3713fc1da49cdfc9976ffd32952fa8f5fe1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 42.2MB
        • SHA256 37d50008099efd169f90664e2b3b1e3430c38a941f67b92b1832af4718505c0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/5152-11-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5152-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5192-18-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download