Overview

overview

8

Static

static

3

2026-08-03...r_.exe

windows10-2004-x64

8

2026-08-03...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/08/2026, 11:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_5db66a15bcd8ade9b3c52b331945e080_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 11.4MB
  • Sample260804-nw2hjsvxgs
  • SHA256 41dd0de4f4417eeea69eaeef839627d5146f402d8d234b9e3a83bb8d9ff9a803
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_5db66a15bcd8ade9b3c52b331945e080_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_5db66a15bcd8ade9b3c52b331945e080_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2316
  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_5db66a15bcd8ade9b3c52b331945e080_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-03_5db66a15bcd8ade9b3c52b331945e080_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3080

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 12.1MB
        • SHA256 72da3d30e7c8b6f57e3a48ba7b99d6975b50f5bae3b00c8df75d15fae3db9164
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 15.5MB
        • SHA256 2f166a54079cf071b603dab19ea8eef1a861e6a763c75e8f7f04d52701db71d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 11.7MB
        • SHA256 7ba58cbd898eaf96d3dfc4ef45cf9845823d6ae753afd83ba9bd47d955cbaeef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 34.9MB
        • SHA256 1682ce45f8df91be33cac8c5ada357885a71ee72799e04e0a602ea142684b985
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 22.9MB
        • SHA256 5a12d270f850d6091fc8a273774dde1158917761a89256fbdc7bb78027ff6e83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 28.8MB
        • SHA256 701eb9eb85504f71464392b83918479e0c4c3ee4529c630bf3e4423bfda6243c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 24.5MB
        • SHA256 7425bfbed4b220314a2dd6949db0b42db6453b1badd34a76ece0f51dd1954acb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 26.3MB
        • SHA256 4e2a7f899dc9d82c8bf9c203cef362cb23adbacdfed5e3d8ab587095b20cbd34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 25.1MB
        • SHA256 532936ad02862fd4cf2a533766db47c0094526a8cb245d4aaa8addf7956ca0e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 24.4MB
        • SHA256 5aa8c0066c7574c6b7c9e226f4ec6ba3d3adfa7a9ca55802b37dc2ab2b830ea6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 24.6MB
        • SHA256 6d721f9d65111c05ea4633e50529e0168850812aaf4094dd339c411a9578773b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 25.9MB
        • SHA256 f34ab873e1e98ad485b336c7f7a5481cbdd1712c75d94a3a4fb7657b23be383d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 24.2MB
        • SHA256 81bebdcb07219072228722483f1665cd54019b0ee6bd7a83df6b39e0fba8ce8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 22.8MB
        • SHA256 e59464b4c0027f385ba50341b2ac5d3fcd820c815e278b8de6da0f4d31154794
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 22.8MB
        • SHA256 2cd09f9385d214a30467b522a737d5789598f81a73de2b309574f3924adad365
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 22.8MB
        • SHA256 72545ac0a952fb05f5f37bbff75d119f078bfa561b33754dc62447c7ad3ec122
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 22.8MB
        • SHA256 87cbeefe4d4e638d62560c8eb0f87f86596445955fe2f4d33e35f2a649ded832
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 22.8MB
        • SHA256 d34adba0ba8690ce20ca3901d764d7e306d73554b4d5f9480e6f4b2191ebb17d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 22.8MB
        • SHA256 b5e46b7c84dbb77bec7b3419bbbcb22c279f0f1e2d309fb287d52294845773c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 64KB
        • SHA256 d2eb08ebe0c7e7ff2223b6feb8c95f679251883e0b850d913bfa4b604432b861
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 22.8MB
        • SHA256 585fda91cd949e0500fa98eb934797d9ff3b008eb5005c8a52a75f30d0a78414
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 22.8MB
        • SHA256 9150164b8a7a1747d5a1cefc12cc6cafd863f8f01fe35386fe6c452f86749517
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 23.0MB
        • SHA256 6bd23f9a9d7def51767d3575224050c889c398020d7738406886b98885aa6837
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 22.8MB
        • SHA256 6350e24de787e3186f68f2b30fc742671041a72287e46a7fb97f443ec05c9909
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 22.8MB
        • SHA256 ec5577a1160958c5e03997400be017da951ceb2cef15afc5729b371752700478
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 23.0MB
        • SHA256 18afd666635d6e6e28c3f708893806c430ab9e7e3fb47b035e66cff5b7e5f119
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 23.1MB
        • SHA256 2ce154b0e413903f6ff11d64f981ccc32666142f96b655550614b0a00680a691
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 22.8MB
        • SHA256 09f74469afba7865193e114286191c640087c65e03d15e76e2d4eec8564d3dcb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 22.8MB
        • SHA256 5095aff34dad159b6051c3bbfde580def1cf01c52e249257f2e9b57b27506abb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 22.8MB
        • SHA256 48dabc4468138d178c69761ce8115d2f83bd74bfc1297cce1112699dd2ec379c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 22.8MB
        • SHA256 d90047ec98d69f10b7e0f18b18ca905a57fbccd8f2478e7401720f604bb17630
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 22.8MB
        • SHA256 5cdc0fa2a830be9bebdc6b45a177bec3131ed64f89270e541d4902b20351996c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 22.8MB
        • SHA256 7d087664c04fd5393b83842b92e5d0a8f9aa229fb4f2fdb0e4be26fe6ee5b3a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 22.8MB
        • SHA256 fae453e2b0c58f887dcd948c183074776f8f1d1e882f96d660f4a9b92781be25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 22.8MB
        • SHA256 915e8458a3ac96b1ee579b0bf981b689426795af8125650fb882635597f5b590
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 22.8MB
        • SHA256 5ac7961d7048d859202d3cc6bd1b89c51fced1ff33834538081cdcf410ae57d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 22.8MB
        • SHA256 f73a8490f9a4e3ad2a8e2af78db39ef9aee7fb7e517df500e2a2015a14e6cd45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 22.8MB
        • SHA256 129ba6778d05b74744a6971ce9803ff585aa453c8f836a79c372f7e96dfb6fe5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 22.8MB
        • SHA256 afd83d92734217f46fc7f6d400a849926c89b48af1725c79b1e4ce68ffaf1f35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 22.8MB
        • SHA256 03fc31e290acf2dcacfb9c0f111b41249c913b51812dbffa69154e80d1aa8dad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 22.8MB
        • SHA256 2c65e11ee45a1cc8743052a14cf1d08b5d4531083c206fe511e6374c0698ab7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 22.8MB
        • SHA256 bddd328b1caff0a56faa0acf6cb5c3cd0ca8425e6fd323c065474b686f39d54f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 22.8MB
        • SHA256 6a2da4b165a7885064e9128e3af23ed919965fa1747714e2e312bada59e989b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 22.8MB
        • SHA256 4f58ac22a8bcde6860d3a4b3e3e89d4c9c9f7fb51f5c31f303f0f36f8183aded
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 22.8MB
        • SHA256 1a809b716ae9d313340aa215c8523fb8fb786bae49fbd5b9c14a5f6abf293aa1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 22.8MB
        • SHA256 d43dd98aae43127381d0ef78fc65543d1f261c701a6f069251ccd819a0918fd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 22.8MB
        • SHA256 275511ececc01910ccb661ec0dc571c7416f99d52c2d0a3592af953d5624a5a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 22.8MB
        • SHA256 7be6bc860600c319a69bf584b7c926e384f5d8c229e55a788b34da3eaea79687
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 22.8MB
        • SHA256 ae8bdb1d9280480f561784b26e7d1c9967a1e83d2a73f570bb169f7461c67146
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 22.8MB
        • SHA256 3baf9077dcad3b5eb9e5f5be568438960fd2f387561b5cc93dbec64aaef86fb9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 22.8MB
        • SHA256 9cb0214e6f02d2ffd68bd7c4ac6eb8bb58c44176cf3b13278684fac5dc282490
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 22.8MB
        • SHA256 fb87382de919dfc8353e50c2d5dfa87c56a9cd9a66518bfc7c7947a9e9d74452
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 23.0MB
        • SHA256 4e453a4c6c63da44dc96724f19f84ffdcf32b3b339f64fc7abacdfd79a2b9418
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 22.9MB
        • SHA256 15adb937e3004220a07c946d580324694642e25fd6a276a217beb852f53caf1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 22.8MB
        • SHA256 7cd33bf3b6cab0f1ed58fa84411db911f21da183a5b04260206125ec242346e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 22.9MB
        • SHA256 35ce64f8b30dd6961f4602ed7fe2b0da1549f4f6ff34dabef41cb25d81cf4bcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 22.9MB
        • SHA256 8122fc0fbdcec0150c99ad1f12fb3d9c54e6e70ee477b76b1806a1b0f40b1e15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 11.4MB
        • SHA256 41dd0de4f4417eeea69eaeef839627d5146f402d8d234b9e3a83bb8d9ff9a803
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2316-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2316-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3080-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3080-6-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download