Overview

overview

8

Static

static

3

2026-08-04...r_.exe

windows10-2004-x64

8

2026-08-04...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    105s
  • max time network
    129s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 22:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_b5e3f31b1529bbab1bbe3bb778b1c34a_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 22.4MB
  • Sample260804-2brdqszsaz
  • SHA256 d013fadb0221b12e42f20565ae57d0506b1eafe8a25270d9db059d504cb60804
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_b5e3f31b1529bbab1bbe3bb778b1c34a_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_b5e3f31b1529bbab1bbe3bb778b1c34a_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4456
  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_b5e3f31b1529bbab1bbe3bb778b1c34a_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-04_b5e3f31b1529bbab1bbe3bb778b1c34a_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5048

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 22.6MB
        • SHA256 2c3505370aee7afcc5fcc81e137d1373980199e3411d1a0cbf2bd438c54baf51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 22.4MB
        • SHA256 7324c5e65649999eb33fe4dcb23628888241fdc167b3fa0090466e396ffcd85f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 48.8MB
        • SHA256 4e1d797eaa3885411689c15fec003f9eb94e182bf53b2fcad0910ebeb685b6a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 45.1MB
        • SHA256 24a80eec3a6fa99a2e4ec85d343ece702dc43b26f3fbee0f4b01d456e21a69d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 52.4MB
        • SHA256 0e74224f227106267e7633d3ed6c4de81330d9408d9bdf16c2806f6733213931
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 24.5MB
        • SHA256 776c606b2b1a28e4b0ff36cc7d14b7ada1fbdafc03ad29dfaad23f4f54582971
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 44.8MB
        • SHA256 9ce25b707607d7380f5bc796e6ecca2a4826856670b3c1d73bd9aabe88a40524
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 42.0MB
        • SHA256 35a5d0300470f3eec3d9cb4594815e6f4576a3a60b13b5fa0946e7f864243909
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 41.9MB
        • SHA256 aea072346d4f69898e66e3ef5522b36c7c54558f7d08e4b480d188424f28872d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 45.0MB
        • SHA256 d1891399828a1dbb67801e4803e3125972cfc207fa362bf60a579d6c21784f8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 44.9MB
        • SHA256 8ef3fba929685391c8a1e0138680c5503660eae7710ae84e5bf41ae662b87940
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 39.7MB
        • SHA256 de774abd8e518316bdc74b79068ca6368e896e35ab443ce7ead10b6c6bfb2c6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 38.4MB
        • SHA256 21d67e3331a83bc4bd75526f0dda17860ec8acee2eb3078b844b8478d04030d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 38.5MB
        • SHA256 7a1a366b3334a3411fb825ed856ce2f1642756a6cd9700228c9b1c7315b1e0dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 36.6MB
        • SHA256 0197d8a9991162a944c377bd70d2aa701430af48583e7a28e984e30f27246427
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 34.6MB
        • SHA256 d824563d42151f4da4c2d4cbf24e2b3b3f528c3df4a48c5df242c2e01cfa92a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 34.5MB
        • SHA256 1d72a8f6b6d20992fa31e4fa06fc8664103ffba35a24819d8020b64249b8b113
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 34.1MB
        • SHA256 40aff4068556dc0458c7454e68d4cae673a5cc7fd2f86efc9824bf402ce92ace
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 34.9MB
        • SHA256 fee8ddd0e58bd4357b705b883308061b9e161c6aa727e41622808a4b9e1d0fc4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 33.7MB
        • SHA256 158bbe3b668c7f1ae7e3e9b1867a171cd2da69db931c91b57c7e66d2eb542631
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 32.5MB
        • SHA256 9987a4f259fe36dae42aa66149753ce58c6d836ad2e31c677de4e53d6555ab59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 30.9MB
        • SHA256 d4d3721fa954f85454cfcb49537e972b881d0fb1afb9b0ef8e98dfd708c8fa00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 31.4MB
        • SHA256 a6527d807232f2a067e7ac19a9717070d021dd2d136f83afc970232c81511068
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 30.7MB
        • SHA256 269d8691f14c84ca4cda8becd64dea2d8edf1ad8b3c6df0f9ec7290a8249157f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 30.9MB
        • SHA256 891d9c2d8b92dda9049c2c4127e88beab3584f5c5eace6241e008bf3294d7c30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 27.5MB
        • SHA256 639ea78ad722a5df3d3c0cc6d5a57a20fb4604595221262e1dc20ed88530e726
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 29.4MB
        • SHA256 5928b6300fcf0a69a2c34c725c9d79e868cdba1a601cb102b9344744937fd6fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 28.2MB
        • SHA256 7a26813c284685eea9de7deabb7f0a2fcb962d2409ddf2bea3d1bce38bab72a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 29.2MB
        • SHA256 a5a36783362c7089c60fb99842caa8f62cdf9bd50a77bac044a05375ac962ae6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 30.8MB
        • SHA256 67f2823fee6381a8aa43232db8f3a7ca07a7ab9d23d277b270cb04fb7036b3f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 28.2MB
        • SHA256 a7a4df13a65c43e8828eb8682583879d17111032fbc2ce785c78c6e82ff30fb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 29.1MB
        • SHA256 d538d07546d76d3ab4cbf4661117e010fabb6fac5f01fe433a949fca24e2b669
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 28.6MB
        • SHA256 8763223534d5154f914a157852baedef95b88f2b7353068b3d4d150d67771dcf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 28.7MB
        • SHA256 c45ba133264bbc113f4ac409e7d2685552787518f1aa144149637dd44ea47bf5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 27.4MB
        • SHA256 7219860c6ab346b537f72d5a46684f8417295dd2322d58fdcb3677e45991955c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 28.6MB
        • SHA256 6387d24acb46505e3a017a91bbbd7317e64130a455ab9fcca9e5ab3eacd134a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 27.2MB
        • SHA256 51bdfd7dab7369de56ca744f949038739b02e8cb8c794e60375e38434f5e85c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 26.1MB
        • SHA256 cee01f5f76104d7fdede7c58fda3e8274269602003ebed37ea44f44d5b00cd1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 26.1MB
        • SHA256 7060d7c687eb429672afad106af280296ea881850b3e2939115509fe98ad4b74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 26.3MB
        • SHA256 3b0f789bfc2eeaf03cad472298bb0fa58c7cdda795b1694ca4ccffec11d394c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 27.0MB
        • SHA256 c3f4509af18baa597d8c61552415085a2f907e3e2aa0cc2f3c04a73c1486e104
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 25.9MB
        • SHA256 3e2e214f968dfa53f3501aeba05b86ca0f7815f146672cdcfe1549d2d0a3c5d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 26.4MB
        • SHA256 cfb6d02905451fa73fc78e21d21aee47958f99303455b340a9c575ee5a95def4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 25.1MB
        • SHA256 c522d171ae979562571d4020e520b4c262116b9b161d49e7a8ea29a0cf07f31b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 25.7MB
        • SHA256 41785aec2dd981fbbd11c05c65d1984dcf1eb674ddd584e11d94b0508f62312f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 27.6MB
        • SHA256 2fb00dabab16f4e15e94c016cdef98b158cbe00cd1caca31681f73fd631e8e0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 28.6MB
        • SHA256 b2f5890f4cb598088b4f8d589dacf458c1bc6b2ec20a3dad19923fdae170d8a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 26.6MB
        • SHA256 c05e7a2f711473f3b417b4a61551e4a4522a1fcd65cc333bcea0f4b2dbcc075d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 26.2MB
        • SHA256 6281ee613e80aab361bcb8bc0aa881a1cfedf4eb66a0140024417951b75e015f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 24.5MB
        • SHA256 73bcb79eb29ac868176f2956404839fb5726ffba2a8c8bacaea7df4bf6db41f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 192KB
        • SHA256 cc71df767f30aa32b4d730d3c0244896e3d45eb216f18568c46371d93640cac9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 25.5MB
        • SHA256 46c68f4d3747cc3ff29a5b3096cfface35542bab3317d023220306d3d90d89cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 25.3MB
        • SHA256 ec0c473451abe2f12211277b047127fd8036bbeacf0ad698b21bccee45303a43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 26.1MB
        • SHA256 8905d80b948aff99cc260b10d66a4c89472eb25e5afd6a6999a1c14eb14f8062
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 26.4MB
        • SHA256 3407271f0f85da3fa473c9b584c005ac91b951ef22afa7dba76f05bc0427bc53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 44.9MB
        • SHA256 ad9977922e7b40ee7fa0d696cf6044d71720d76a51fc90bb75b1d97d071dacaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 44.8MB
        • SHA256 a1ca9d43ab1fca8a93099d78d2353a014bdf2a78336453aa5d6188c539a38415
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 44.8MB
        • SHA256 023b36f1fa9362a01f506dc616e075aba3e1a40ae4d213f17682ac14d6b5ba5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4456-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4456-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5048-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download