Overview

overview

8

Static

static

3

2026-08-03...r_.exe

windows10-2004-x64

8

2026-08-03...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    134s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 12:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_38894a8412587e59a84300cc19ff812f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 15.6MB
  • Sample260804-pl3taszgnb
  • SHA256 e56441c239de35717ecfcfd10edcabf5a56c6b6819756de1d0391d84720049fa
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_38894a8412587e59a84300cc19ff812f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_38894a8412587e59a84300cc19ff812f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2400
  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_38894a8412587e59a84300cc19ff812f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-03_38894a8412587e59a84300cc19ff812f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:468

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 16.1MB
        • SHA256 b7e0db74b127e4f8749eedcd24612cbcdb6c76c266a8f7f5ce8ad73fcbb81e9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 16.5MB
        • SHA256 c293cbbd31f25218b6c3c3929ddc826852dfff5fec92b848d99996f975aa7b73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 30.9MB
        • SHA256 f1f4d7ee4c0a137db416c221319ababc160a531197c20ec3897520a908b170f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 31.9MB
        • SHA256 14a3da8e2d6d00392d4369201d51ff6df9930fc78d078d6345e38b14bfd8f3a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 15.6MB
        • SHA256 60916b65b0b48e8a83641ef3099ffc1602beb7dc6305f8d864356f76c95879ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 29.8MB
        • SHA256 613ae3671e1e5fd78225610829e8d28e63c690b1aa699d493cc9c6f37ea0d1bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 29.2MB
        • SHA256 12966a43e29c9a489ded82a6f21d0606e2e2ac10c7850ec503e3c0f8f58c0780
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 27.1MB
        • SHA256 16a10c5832591f5a5f2946e8fe7cb616aa3e03b20db50ec42d3727245687a349
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 23.1MB
        • SHA256 d6584590cf1faf1d9eb4dda8fbfb124db7eb13031a21cd0f94eced02218bfaa0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 17.9MB
        • SHA256 834f5d10af34afac4223277bb892227d711306a82298e74711af437a016ddc8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 17.4MB
        • SHA256 87eb6e5a83fd4823c7d19dbff4263eab73e88aa6abb0ded04de96c0d3c4a1799
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 17.0MB
        • SHA256 38ae7e1ed59add0554834d6396e8efe39d6df973c2d1409dc5563a208b2dc9c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 19.4MB
        • SHA256 06a65ca8f0ca79ab8ce7395c447b3383086f42d1497cefc9f6f35ad56964462a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 19.1MB
        • SHA256 bd4dd6759924225aa6f5de6232394e2fdc6a71fe53092cced4d74aaff8952e39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 17.6MB
        • SHA256 0ee3c4954e9d966ee2d6a44f87209889c7bbbf34575835287ed4960798e833ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 18.5MB
        • SHA256 8fc5eadc10b745257e4e54643719ca7c080154060cb42a926a3c79c327ed2e41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 17.9MB
        • SHA256 e316f4cee6f5877229d2930980b96efa4e3c0aa9d5c9f87f75b021808b0f142c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 17.6MB
        • SHA256 eca71cda1536998b0e8d7135bdd2742a1d5ac0750dd857c3632e7b5c81c9ab9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 18.7MB
        • SHA256 5edef0c941cb1dc61d4f4dcd732fe8ce1dd5abd59581c079221fde2121eda935
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 16.8MB
        • SHA256 153ae25e20ef5469e76794c013e08dd1e0bca48dc15e8f04a1d1633db1ddd0cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 17.5MB
        • SHA256 64c3f36dba8a86781a46e5af4ba51ddf052d54c88baa68ca742af3301fb67676
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 16.5MB
        • SHA256 20fba6ae4408c535cc0c47274b8511a6c233c22f921eee78912661e4d6b6981d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 18.4MB
        • SHA256 a24964c5069bf38d97fcb0570d3fd7328b62f961cffdea2a8d9d28fd809cacbc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 17.0MB
        • SHA256 fbd3e027546533b755799d3f37a8d9b76d2d322945d3de1d434443179f381aa5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 17.0MB
        • SHA256 380d27220f71b70a0c079424912ce40b4ac4f8d8a2cef2d5b39b9b015f7dd8d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 17.1MB
        • SHA256 380587e31cecc975adc00c86f47139d618223e3ce488ad151df888af8bcaad21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 17.7MB
        • SHA256 fd3c43df6859161313e82c73fc6d59f896016c1b83277b472251f92c3c817dea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 16.2MB
        • SHA256 3089bdbc27d70791cbc646722fe45ffe90b85ed847d348e3dfec6326b19e0d63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 17.2MB
        • SHA256 d435e534f1643e7dd309272dfa25951c91f030565cbe593c377743398372b59f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 18.0MB
        • SHA256 0280cf345902bcc6155148b3d7d19832566a3ce7b33850bb44863b3ed7a617e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 16.7MB
        • SHA256 ef0b38394d17c11e88699e8d677901367e1f6bd74ecba2e5f53933f20c29ee3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 16.1MB
        • SHA256 93f29f3c29bdbaea2e1241fcd5d2ae08f2beb0d430d225f55f2d7e9546cd3b1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 15.8MB
        • SHA256 8831bf4d0bffe13a63d308dcad5f73a0c0e047aca8616e96336a794bb1308055
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 16.8MB
        • SHA256 18d0a0a0e52ee6ae5205b216bd2455b39a76224031ba6021694d2918f459c5e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 16.1MB
        • SHA256 bde6e2747cb332521a311f49d9ee2f658a0664e43135f8c97440f5e7df0e9d58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 17.6MB
        • SHA256 2e801252ab7ef5d44a784508ca0670b36e4d1a007bf5edef116d13faf002d537
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 15.0MB
        • SHA256 5a8a866e876bababcd6544865405b40c7cc9a570bbc401f1a9058a032a5eb0f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 15.9MB
        • SHA256 913f8994f1dd313dbb0846f5d1bfd89026dc71b40234f5913692154136546f2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 17.6MB
        • SHA256 213444a4ce34cf6bc11409213779596b9bd65cbbb18514199d55f469684dc941
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 15.5MB
        • SHA256 6a42f0bf835bb8d0f930f362deeb8bac2fa6cf411c40a19091c6334622a1a63c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 16.5MB
        • SHA256 ab878bf171e8974b1f9ce79b2dc82762550a6ed84b2ac792736168a27efc0c8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 15.6MB
        • SHA256 a3297dd5d5ae639f851d480e281b5b5c700d56c7c5fadcd79075148ebec0f487
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 15.6MB
        • SHA256 527053f4061d7d17c881bae46cd74e85e07ec5573c488f8fc9e7b0c96e4b27eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 16.7MB
        • SHA256 7aa484ac9501cc7eb7da3945fd186bcd740ffb250995e269697ee9a478fc3a49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 17.2MB
        • SHA256 fbf7824cc8e73d4238f01411b7d320d236a9c6abb2aae06a92c0455c173971bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 16.9MB
        • SHA256 9bbda280a16bf084e8ffe3fcfe80d70f2e9fc45b3a24742beb50b829249ad7f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 14.9MB
        • SHA256 a56db3e8277e7b2650bb0c98580df95ee4897d41668324fb56bd3f785c38da3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 15.8MB
        • SHA256 954125bf1001612e5abd9ba46dcedc2015873701fc2bca2c5312e041aae84c84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 14.4MB
        • SHA256 63fb9106264740c5f6082c1a97c85bc7e8e6caf3b834e644a36f7a11d9c30ce3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 15.1MB
        • SHA256 dd664dfd6343587013469ab57be35f8811e3f756a50209bb4a6035c4f69f253b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 15.8MB
        • SHA256 f03343cdcf22ffcb2741fe7ac30d7a0f204b9ed3a9aac45c4a7925ce9bab6222
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 23.3MB
        • SHA256 a446cf806b92bb52587004cc719860b74816cd3afa7808a61a7b5687020d75be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/468-16-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2400-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2400-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download