Overview

overview

8

Static

static

3

2026-08-04...r_.exe

windows10-2004-x64

8

2026-08-04...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 22:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_8c0e149abe3e8be09ee92c889a0af99c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 19.5MB
  • Sample260804-2k6vsasbpb
  • SHA256 1fa7e91876e7d7d07be3a7d66502994a6b1e1c88b0d4032b002f030ed280f57c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_8c0e149abe3e8be09ee92c889a0af99c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_8c0e149abe3e8be09ee92c889a0af99c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5816
  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_8c0e149abe3e8be09ee92c889a0af99c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-04_8c0e149abe3e8be09ee92c889a0af99c_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4860

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 19.7MB
        • SHA256 417b54bdd3108ff73f28a30afd0f2a8e1cce618e37ebd8b28e3622ca77eff8c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 39.0MB
        • SHA256 a506d879fbd4adf8b9a55fa9bc2aca66d3b390039f735b3d8da9ad0c7a85b571
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 43.0MB
        • SHA256 965c9168e3c4a4774289fa1da900dd1410a28eec1d83e974dd38210bef6320ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 39.3MB
        • SHA256 5f5758e072f3276de14d442e2cc5002d329e96fd0197259b7f5e9fc6db1623ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 62.4MB
        • SHA256 2f2dd532e34b49474ef40b45f5bacb81f42b8da8adf0521d084e4a2d3e4da68e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 21.6MB
        • SHA256 fafdf641552bc33ff57e9df5c532edd72b983493af15641ff52d1c42cace8a35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ConfirmShow.asp
        • Path C:\Program Files\ConfirmShow.asp
        • Size 39.5MB
        • SHA256 544ae5e5a1f789dc73f762ac1de022aaefa286a7f42a03a9840f764f893f474b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 40.6MB
        • SHA256 6c430f51027d146a9d0682e2fca3226e7a1dd43da607ee4feaae40c3f571c64b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 40.8MB
        • SHA256 0a48135d56e3746eee061379294293e99d6d111d770690703ecb012a2eb7e8ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 38.9MB
        • SHA256 5abb359a8194e7e333cb0217955b79b334cc4572f8c7c895d55cbef2ea01cac5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 38.9MB
        • SHA256 77347fd0eb8e1205d726f3ffe3f7e99ba41e1fc356621837ba259b48c79f151c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 39.0MB
        • SHA256 77133cc979fde97d3b02d6a73a971f07eceb9c87cd0bee395e64c09a5b57d680
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 38.9MB
        • SHA256 59b569972076d67af96ca6c82c119d13c13c2b00d35f577df54bbcc0554b26c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 39.2MB
        • SHA256 0bac414f80415e04e05cc34a528e277f92e9f52552c93db3ba81327f6d32a3bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 38.9MB
        • SHA256 346da928a5c30fc85a39aac081b7199c99b38a6f92f5ed56bf50c983cdb48163
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 39.1MB
        • SHA256 434d1971654507f878dcff23cbb09f59e8dc3bfcf9a5724f47f1635f30d403e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 38.9MB
        • SHA256 8a2ef7ace5ad86276c2c184eb0c84bb8cc616a551ca8c1122f47f82f3f12eb17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 39.1MB
        • SHA256 14f97feb43fd5c8f814740f7a95a5db02086dc7ed1aa4fc76e6256daced465b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 39.2MB
        • SHA256 54670ff4066811ece313ce0cc532944edc90e6ea5e057b85e7406f842dbe651b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 39.4MB
        • SHA256 4d6bb4fbe50753616d4f37d1adffbf7f27bf8c60250cd050e335363f96c8e91f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 38.9MB
        • SHA256 a9e864e61dc381ca4b99985e350b98c4b247be5ef0bf20f922ddec68446b729b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 38.9MB
        • SHA256 3136abc23b027e61919255453f4df8e764f9f38b234fbadc060b7f42e84817d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 38.9MB
        • SHA256 7db3bf483af06dad88459d6799ac5dd73cccd3d0e7dbdddba151ded19004280b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 38.9MB
        • SHA256 70c7190d52032a238abc4619f5b59d32a7d77cb8c3e2a70ee6f54cc39b806063
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 38.9MB
        • SHA256 9d1016e70e676d64d69a09c0f0d74356954921dc39954347d8e9b9cbf62602e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 38.9MB
        • SHA256 2332b014dc690db8c312241daa3fd1a4fac95805ea5caf8fc98f4465f9707440
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 38.9MB
        • SHA256 e497323e5004fc5eb7870957b48693fe7ad74f2466cd311557bc554667f4e1e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 38.9MB
        • SHA256 50818b3a1d600f15db75ccf9f9b3bc2a2981925ab9e152879904649d48dd1bc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 38.9MB
        • SHA256 149c0a3c0317944de4d75e9d1f2b0ea7d53fac05197feba16062b6e18b18ba51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 38.9MB
        • SHA256 2b72696ff5085603e14fb5385d6933f03d5cf8be3d25c5229c6febd738e6ca07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 38.9MB
        • SHA256 8231620136317f6ba50b65b3bfd76d96a3414839c8fc83fab18d4b3660339f28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 38.9MB
        • SHA256 18da6f574b00326b8b1c64ad8b4d9810fc427fa502e4e34ac3ad3841db5f6184
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 38.9MB
        • SHA256 62cb16710d884541b559de3065071234e9ac9e172c176e45ba919f6c915617fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 38.9MB
        • SHA256 2b0927a46fdeb0ce45a985ff2b37c2d90415cef96595d99dafd507401464e1fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 38.9MB
        • SHA256 6aace832a805bd8ea239ccda7c44a83f74184956cf89f1111f14cff6b10bca13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 38.9MB
        • SHA256 b5296816e35bba2e3c643cf7b52eaa7f5abaa692760fbbce4cbe6fee2f02dac1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 38.9MB
        • SHA256 999fdf74f5c35a2d601ad462a02153aeff13ea63174c6787d2cc1da21f43cba7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 38.9MB
        • SHA256 7a4b0baf1c9fc4a8fdf7ca75ba288729f7d97888cba93527cabd1091772da1ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 38.9MB
        • SHA256 f833b2e7bdaf2281c740ae78601c44b53d4d5fa5afa66da9bb7c95da2e3124ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 38.9MB
        • SHA256 91576dab761b9fe8a57ca173205831064c6a808fcf5d7b7149984b156a73559c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 38.9MB
        • SHA256 7f92d89eb37cabec2fa29de191d46f7ce463a8d873010d47701c855b46d67d4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 38.9MB
        • SHA256 15b10d16259141165d580820b13f95249a0fc98bbe316321cf75d1ea0135748f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 38.9MB
        • SHA256 5b1e43f3465772d944d9b7f1304dd3cf8c886206ebabcee1a9893bcbda4242f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 38.9MB
        • SHA256 24a07594dc2f7e5823dc9f516c3df5080c2dee962da6191ab797115d0bffe43f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 38.9MB
        • SHA256 7521e76f3086e1c7b0c1327a0666dfb73d10a06ca5618cbd1ab698a526e49cac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 39.1MB
        • SHA256 de6c27fc77187d769a1c9a40327c497cd37c018a2beab7040ef81091f3c09fe3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 39.0MB
        • SHA256 dc1262fcfd32008a9265a0e8be32e551337d43ba8f5bdab9980608c5be9ddc62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4860-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5816-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5816-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download