Overview

overview

8

Static

static

3

2026-08-03...r_.exe

windows10-2004-x64

8

2026-08-03...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    138s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 11:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_5db66a15bcd8ade9b3c52b331945e080_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 11.4MB
  • Sample260804-nw2hjsvxgs
  • SHA256 41dd0de4f4417eeea69eaeef839627d5146f402d8d234b9e3a83bb8d9ff9a803
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_5db66a15bcd8ade9b3c52b331945e080_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_5db66a15bcd8ade9b3c52b331945e080_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2832
  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_5db66a15bcd8ade9b3c52b331945e080_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-03_5db66a15bcd8ade9b3c52b331945e080_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4924

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 23.3MB
        • SHA256 985040700d15214f92743835f0d6b4126d7801358c5242acf8bcc696339a3580
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 23.7MB
        • SHA256 eb49887c9bca7864b5556b5adb3470c3226cc114abfc306331638461c71c3c04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 23.5MB
        • SHA256 a3f1720e9a516877c5a275d81e35f11441259750b79362ea3aae3bb6326c46ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 22.8MB
        • SHA256 44b63ee0715c2c7b17ba43b9c0206d1556dbde1c081b9d10dbcc5290dfd44895
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 23.1MB
        • SHA256 107bf250e89bc1d62c8ea9f6b2445235ce29bb9b6c7a20dd29f2b61a21adbc49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 22.8MB
        • SHA256 23dffca5e910d2dc37827dbc49b0caa4c2e74830770336a8b510a1baa3c48e81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 23.1MB
        • SHA256 5544eafafffd675b772809497654e4e8c4f740bcea9377d5b64cd6127bd3a3cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 46.3MB
        • SHA256 c5a606d29089c51b25b6c050eecc038143bf96e858de979c735219a05c3ca6c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 24.9MB
        • SHA256 3d4270be38099b82c2f697ba0c3ffaac7174ff1e20b9abaf18330cea2f81ad7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 22.9MB
        • SHA256 5a12d270f850d6091fc8a273774dde1158917761a89256fbdc7bb78027ff6e83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 28.8MB
        • SHA256 701eb9eb85504f71464392b83918479e0c4c3ee4529c630bf3e4423bfda6243c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 24.5MB
        • SHA256 7425bfbed4b220314a2dd6949db0b42db6453b1badd34a76ece0f51dd1954acb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 26.3MB
        • SHA256 4e2a7f899dc9d82c8bf9c203cef362cb23adbacdfed5e3d8ab587095b20cbd34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 25.1MB
        • SHA256 532936ad02862fd4cf2a533766db47c0094526a8cb245d4aaa8addf7956ca0e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 128KB
        • SHA256 018b597827351ef5fba9c0e1d321cfa9b45d887ff0f8d5607452eb75d8626cb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 24.6MB
        • SHA256 6d721f9d65111c05ea4633e50529e0168850812aaf4094dd339c411a9578773b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 25.9MB
        • SHA256 f34ab873e1e98ad485b336c7f7a5481cbdd1712c75d94a3a4fb7657b23be383d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 24.2MB
        • SHA256 81bebdcb07219072228722483f1665cd54019b0ee6bd7a83df6b39e0fba8ce8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 22.8MB
        • SHA256 e59464b4c0027f385ba50341b2ac5d3fcd820c815e278b8de6da0f4d31154794
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 22.8MB
        • SHA256 2cd09f9385d214a30467b522a737d5789598f81a73de2b309574f3924adad365
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 22.8MB
        • SHA256 72545ac0a952fb05f5f37bbff75d119f078bfa561b33754dc62447c7ad3ec122
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 22.8MB
        • SHA256 87cbeefe4d4e638d62560c8eb0f87f86596445955fe2f4d33e35f2a649ded832
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 22.8MB
        • SHA256 585fda91cd949e0500fa98eb934797d9ff3b008eb5005c8a52a75f30d0a78414
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 22.8MB
        • SHA256 9150164b8a7a1747d5a1cefc12cc6cafd863f8f01fe35386fe6c452f86749517
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 22.8MB
        • SHA256 6350e24de787e3186f68f2b30fc742671041a72287e46a7fb97f443ec05c9909
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 22.8MB
        • SHA256 ec5577a1160958c5e03997400be017da951ceb2cef15afc5729b371752700478
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 23.0MB
        • SHA256 18afd666635d6e6e28c3f708893806c430ab9e7e3fb47b035e66cff5b7e5f119
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 23.1MB
        • SHA256 2ce154b0e413903f6ff11d64f981ccc32666142f96b655550614b0a00680a691
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 22.8MB
        • SHA256 09f74469afba7865193e114286191c640087c65e03d15e76e2d4eec8564d3dcb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 22.8MB
        • SHA256 4841ddda78a38f7c7ebcac1fdd169e3ff5adf7b5fdb4bca9ee6b89ba61fc1ce4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 22.8MB
        • SHA256 5095aff34dad159b6051c3bbfde580def1cf01c52e249257f2e9b57b27506abb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 22.8MB
        • SHA256 48dabc4468138d178c69761ce8115d2f83bd74bfc1297cce1112699dd2ec379c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 22.8MB
        • SHA256 d90047ec98d69f10b7e0f18b18ca905a57fbccd8f2478e7401720f604bb17630
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 22.8MB
        • SHA256 5cdc0fa2a830be9bebdc6b45a177bec3131ed64f89270e541d4902b20351996c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 22.8MB
        • SHA256 7d087664c04fd5393b83842b92e5d0a8f9aa229fb4f2fdb0e4be26fe6ee5b3a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 22.8MB
        • SHA256 fae453e2b0c58f887dcd948c183074776f8f1d1e882f96d660f4a9b92781be25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 22.8MB
        • SHA256 915e8458a3ac96b1ee579b0bf981b689426795af8125650fb882635597f5b590
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 22.8MB
        • SHA256 f73a8490f9a4e3ad2a8e2af78db39ef9aee7fb7e517df500e2a2015a14e6cd45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 22.8MB
        • SHA256 129ba6778d05b74744a6971ce9803ff585aa453c8f836a79c372f7e96dfb6fe5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 22.8MB
        • SHA256 afd83d92734217f46fc7f6d400a849926c89b48af1725c79b1e4ce68ffaf1f35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 22.8MB
        • SHA256 03fc31e290acf2dcacfb9c0f111b41249c913b51812dbffa69154e80d1aa8dad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 22.8MB
        • SHA256 2c65e11ee45a1cc8743052a14cf1d08b5d4531083c206fe511e6374c0698ab7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 22.8MB
        • SHA256 bddd328b1caff0a56faa0acf6cb5c3cd0ca8425e6fd323c065474b686f39d54f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 22.8MB
        • SHA256 6a2da4b165a7885064e9128e3af23ed919965fa1747714e2e312bada59e989b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 22.8MB
        • SHA256 4f58ac22a8bcde6860d3a4b3e3e89d4c9c9f7fb51f5c31f303f0f36f8183aded
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 22.8MB
        • SHA256 5c97d81a7b36fe1f6e47a73bc22191d070a439ab810489c94b6c42c21d63af81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 22.8MB
        • SHA256 1a809b716ae9d313340aa215c8523fb8fb786bae49fbd5b9c14a5f6abf293aa1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 22.8MB
        • SHA256 d43dd98aae43127381d0ef78fc65543d1f261c701a6f069251ccd819a0918fd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 22.8MB
        • SHA256 275511ececc01910ccb661ec0dc571c7416f99d52c2d0a3592af953d5624a5a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 22.8MB
        • SHA256 7be6bc860600c319a69bf584b7c926e384f5d8c229e55a788b34da3eaea79687
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 22.9MB
        • SHA256 15adb937e3004220a07c946d580324694642e25fd6a276a217beb852f53caf1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 22.8MB
        • SHA256 7cd33bf3b6cab0f1ed58fa84411db911f21da183a5b04260206125ec242346e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 22.9MB
        • SHA256 35ce64f8b30dd6961f4602ed7fe2b0da1549f4f6ff34dabef41cb25d81cf4bcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 22.9MB
        • SHA256 8122fc0fbdcec0150c99ad1f12fb3d9c54e6e70ee477b76b1806a1b0f40b1e15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2832-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2832-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4924-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download