Overview

overview

8

Static

static

3

2026-08-03...r_.exe

windows10-2004-x64

8

2026-08-03...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    151s
  • max time network
    137s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 11:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_7b11d166591658fbbaa3422db43a0ced_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 18.0MB
  • Sample260804-na2anaydke
  • SHA256 863dfaabf6b19c3587c58e1099d3a270b6dc081f9e2887e5fa6f73442c7d483f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_7b11d166591658fbbaa3422db43a0ced_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_7b11d166591658fbbaa3422db43a0ced_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5476
  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_7b11d166591658fbbaa3422db43a0ced_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-03_7b11d166591658fbbaa3422db43a0ced_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3032

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 36.5MB
        • SHA256 da63a576d093298c4541ab96dc5415f8a7c5dc10b903ef1b15c59686bfb30bfd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 36.9MB
        • SHA256 7156146470eeb6702c927e33f548cd1a75e76eb76bc5aab7ad95bd8dfa09e86f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 36.7MB
        • SHA256 43ed0ce79c744e7bfc61d9df988428e4f8678f22fd662676d8d31b08c377979c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 36.0MB
        • SHA256 7e7ff950c96fbced3d9cbb63e1d698baa011ad9a6fd29952746727d373e7ff14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 36.3MB
        • SHA256 e5d87f8675b9f3562522d33c4f747a96483ce9671927594d71e4ca638fb9aabb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 36.1MB
        • SHA256 1267dd8eedff81a8b68fa5774f652008ece1842a7728fbefe2b408693e89829f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 18.0MB
        • SHA256 863dfaabf6b19c3587c58e1099d3a270b6dc081f9e2887e5fa6f73442c7d483f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 38.1MB
        • SHA256 bd8bdd3008ccaaae7722bb57f0936b16e8c5931f331bc150c19a333b0749a38e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 42.1MB
        • SHA256 a8bda5202d194fa0e5a6bf78b1b67a5dd94630e599198e096f94fdfb9dc69a7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 37.7MB
        • SHA256 cda5197198beb5c95cd236f3936f9717b2a0fde405b7502458bb5646fff81ad9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 39.5MB
        • SHA256 ef00d53b1aaabfc8f99bb95a43bc03b8374123e2c4af670cf17eb5c4ede59f9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 37.6MB
        • SHA256 13124685b6a7f07019c649a50b030be5dc0fd9cee1d2c4a1f4d4c60e35f41d39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 37.9MB
        • SHA256 acd31ee436a23f04ae181d783016082e152537bfcaa0ac7c30139b580cab4841
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 37.4MB
        • SHA256 b699c7929dbef9a43f8503aeea6aff82d4581ef0f21f2f17b7601b421882bd45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 36.0MB
        • SHA256 71268e44dd766c9e0332711d9c578e4c14398e386301b46fa90824f82805d2d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 36.0MB
        • SHA256 dc41eeb16aa3dfd41b0842d9b0d04727983468b12e93aeea20e4ea62de83f5b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 36.0MB
        • SHA256 89972990ff083575529d8104800b16b2c440cc9db40a1c29d0735c6afadd6902
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 36.0MB
        • SHA256 42af816f068e048bebdc7d07c39fbbac01a35b00c5f56c9b8ed75696efd50043
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 36.0MB
        • SHA256 4c7dbc2f72cbc9b9446a6ae7c76d3bc72d60313521593c47ef3609f7e850d045
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 36.0MB
        • SHA256 8c072a37c1c80db0a71b1122e85d60cbfe1558bc74d558429a1a4a3d8359dea9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 36.3MB
        • SHA256 2d602948b71db239ab8719029922de27bc8e4338db448193dbd67ba38449be11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 36.0MB
        • SHA256 670302a79a8ac992cf3cef70826b1d8bb188153ae3085414b6aec82a9eadcbb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 36.0MB
        • SHA256 bad9bbe9d62779c94487b9b9138ab341cb32e01bd6b374ff094323b166024037
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 36.2MB
        • SHA256 2aeb832564baa96d05c4027e24a60f550e6538af7a19b094690eccbbe0eac2cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 36.0MB
        • SHA256 9c2b1fc9b9e8c9033aef8c89955d5a2fdeba2157ba03f7dda025f967fb21d7c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 36.0MB
        • SHA256 3f8b59332e46b9170d5dedb5bc1643b981839dfa48dd952d6c0df8164ba021cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 36.2MB
        • SHA256 76b7337d4ff4ec8c5db538212d0f57b817c066206e1f72e1f27c333eb330b250
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 36.3MB
        • SHA256 92dde012918b3ac0d2ddf6246b973b5b3cf74bc4dfb574c647598d650b039f9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 36.5MB
        • SHA256 03c9ad0a765d3349b4542b45caf307d3826118499e2be0b36682443742b7976a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 36.0MB
        • SHA256 1e47f0f549ac983d487699ca573b0c2ce33aa80d30351d6a7ff1f499f77524bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 36.0MB
        • SHA256 310551d2c980e12295a9f06bbde8fddda49bd36771d64af4a0ee4e234f0a0924
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 36.0MB
        • SHA256 c40df5b7a18db69c389870734a440755a2f1f91ac59602b45fda322505b73290
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 36.0MB
        • SHA256 1284d3def68fc7e075562696a3bd9d22eb3c2c34664c58f0a3d88157b35c3b69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 36.0MB
        • SHA256 40dd0c8351dec1b0850521fa0513f1ad653972c470f56189ed72d8af6dca4914
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 36.0MB
        • SHA256 9530197a1fe890153fac6e90397447182b0ee0d5d3b31de13f6dec07532910b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 36.0MB
        • SHA256 aede7d78a72c5dd91e04be0255fd132a86a3805f8aa2c3af3195a26acb8577fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 18.0MB
        • SHA256 1c158b2c1cd6ca47f358de575989ad982229f784e57cba25e0a6549bc76f4741
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 36.0MB
        • SHA256 75158a87b45c954ec9391de9563c82f9d414bd163af4905c741be75dd36515f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 36.0MB
        • SHA256 b95d552d80070aeb7eb6b931f1a3308d63abfe3a64c2353e77cc72dc2a096f68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 36.0MB
        • SHA256 c8565bd30a9a922fd3bc748a52e5ccc57bb5b2ee3c404ba90cf3b945e6dad8d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 18.0MB
        • SHA256 4b8e9b121146b3c9ddb9f231a842a889482fb78ea039e6ae753a17764c700749
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 36.0MB
        • SHA256 4f51d58f9e1bfa55f2cbe5d953fbc82e97d346328439e9b41097768d7bfd3e09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 36.0MB
        • SHA256 61f1e25819f5eb9c2ab6dae23a46812ae2586fcf5e0379a06ec0511d7e759031
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 36.0MB
        • SHA256 ad51f1996132daa3dc930af472adba1b0cb0d6f4c65e917eb75584c46e21d37c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 36.0MB
        • SHA256 b9d191b1d95c290d464f937df78aa2b4dbba6080e87dcc8af3a145749db12311
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 36.0MB
        • SHA256 ec760fca1e3782cdfa21116d9bc267357554a9c16c01a994b02daa373f0f02f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 18.0MB
        • SHA256 10c384bb9197b5c7201a5417ff7360cadf24cc42f6d0667d58691880bff485e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 36.0MB
        • SHA256 3eb191cfeb0b0bd80b4915030ad74959b255dad4828bd2c4947da5a6ba12c142
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 36.0MB
        • SHA256 695fae987cc198dc71986299645de808d1334194624199d39daf15965e59d27e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 36.0MB
        • SHA256 86f69ce01a60b650f1ad996230eb6eba318b06581b4519c19c69415d19d6b3ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 36.0MB
        • SHA256 76e6d8315b7ec54282add417c748e64e791c8823f63e0df85c2672b671ac55a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 18.1MB
        • SHA256 a69474c4ad9e24802cef6408ee3d7fbd266f067ca96c79f2890d528ccf10f67d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 36.1MB
        • SHA256 21f6a4c332f4bc8994323ea45062cb26fe98a1296d25fa84c94014d6f463ff2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3032-42-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5476-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5476-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download