Overview

overview

8

Static

static

3

2026-08-04...r_.exe

windows10-2004-x64

8

2026-08-04...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 13:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_e3c18fe0e616d8adff0740ba4a99713e_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 14.6MB
  • Sample260804-q4epvssare
  • SHA256 dbf3c6a16bbcbcb0aaf1186bfdc1e3d9a91ecbf6cbee6f685ecc73838bf42d87
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_e3c18fe0e616d8adff0740ba4a99713e_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_e3c18fe0e616d8adff0740ba4a99713e_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2868
  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_e3c18fe0e616d8adff0740ba4a99713e_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-04_e3c18fe0e616d8adff0740ba4a99713e_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3432

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 14.9MB
        • SHA256 9167e76746b578c2f8cdf89bff18cec4494a818119715822b60e3d2c3c4191e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 14.7MB
        • SHA256 5f0e359d25a90df18214c1d222a70455623b760fcd1fa3bf65dd5a796881b8a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 33.4MB
        • SHA256 b0ca4320d770c360686c83f7bbfca61e04cfa638f19229ce9c1d57111a32e27f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 38.1MB
        • SHA256 be248afb705b62ee75f5764d3be6b9b763e859595017a99a1857478190f33bf1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 16.8MB
        • SHA256 edb1373536fa97654134d50d7eb8b23aad8fd852d7fb1b06c2d3c13b88657659
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 29.4MB
        • SHA256 107c4b9840e7cc5d7925554d5e66658fa46687afdbb0476a0717daddbeaa3c57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 31.0MB
        • SHA256 78a9c417567b571c88c3c666d13c251c11a68c9ffa6373ece5b9b1c2e2058409
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 32.3MB
        • SHA256 f24cec20022b7a436a77c5500afac62e0292af3289596f99015bb41d24de7660
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 29.3MB
        • SHA256 9c80a5664e7b831a1bb693ae451bf5bf7151318d9b886950cb138bd18b002a0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 29.3MB
        • SHA256 5182b69939b137be3ab608063ef9b286c38ee832fca089fb7c5febb408490477
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 29.3MB
        • SHA256 f1f0c890d63b896f6f84e0e55045a39285499f6d0fb0d9883de5c3eace646e20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 29.3MB
        • SHA256 2cccc6dfc606f8e4e3cd220d13230826f1d32992f043da330cf7abe71cd253b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 29.3MB
        • SHA256 18104f015d9509fc2f254cd082342dc40385e22b1a4ce17acd2613d8ad80fb0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 29.5MB
        • SHA256 ef92084699ce8fc7d951f34eb904bcfee1a203262c9bff0c06680af78bd34cf2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 14.7MB
        • SHA256 4a97256569af4af0d27461b984cb5ac18e3c98812346a5485eb0fb6038bbd3bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 29.4MB
        • SHA256 d4f305b62e4f32abaa28f4c51125881baaeec19f7386b30ddbb373def6dbf5a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 29.3MB
        • SHA256 303458346c03491eb0e6196c5c0d5cd2a6fa24ae943adcb0a4a755296a8174b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 29.3MB
        • SHA256 3323226bc46b386a25eab7efc150f093db80e3eda472f558558bc058932d3a9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 29.4MB
        • SHA256 76d81f2298fc5529f9c98e8acbe714945ff3f61f1dc5af873715cd57b0cfced6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 29.5MB
        • SHA256 f6c2d65e5b0e5842a147aa53fde974c1b43bfcaefd82a3d3cd544d24e64c67c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 29.7MB
        • SHA256 7f6364b46b70d26e14c55c4d5f844642f9ffc6134b8c5d605006017c96278b76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 29.3MB
        • SHA256 2af09a7da229bd7ec739c2291a981c175a2ba8f65dd6fa7bf0e59a5260e16f2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 29.3MB
        • SHA256 a8101b1bf9f8a6cff31f3535991945323cb9c93a7416a55393f74c1f47534425
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 29.3MB
        • SHA256 c8039d0002ea2204a0a2c322a988452e99599121dc75ce7fa6a9f4388dd15cff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 29.3MB
        • SHA256 d729e4e5afbe0133e129bec260fe9e28571b68a38795dfcdffdd599755bffa8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 29.3MB
        • SHA256 ca394d99e8f47bbcf69b43329abb86e83c14036436253bcb8f16a65d8a199603
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 29.3MB
        • SHA256 67b038ce8ef5b47d521643cc311c8c764c385e8f08c12f9c79501a2ab7d43281
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 29.3MB
        • SHA256 21a0f0a93a75006721ee82493905606094751137fac6da81f1642f002ff3db2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 29.3MB
        • SHA256 f3fc827a4d637513d48dfbaaf0de94f4794947d00e59f5f38edab94ca7bb9c54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 29.3MB
        • SHA256 95f225e87a702ebef57e0f079f6c3b5ea896587164fda7b0aaf8ff7c949977b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 29.3MB
        • SHA256 4245c1daaf7cb36cbf9a04e4033d98c86215e13af2e1a8cd58ce8b480ae716e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 29.3MB
        • SHA256 1171b1d883b0c3306b9b6d4166e410ddf0ee40201f2ec7897345c0f7027de5d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 29.3MB
        • SHA256 4bf7a6bf4520e8087ad1c7dc3b530be9d4a2dcea8dafa392d397f10713cb007c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 29.3MB
        • SHA256 91e448053d46c82022db4e56af59e33973749dbc75c3366226ed5095009f69dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 29.3MB
        • SHA256 81f9d438f1fcf8a9721b10843437a52d0624b5305ac6bc72b4aef9580b9e9f30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 29.3MB
        • SHA256 3078dbdc37ecd20aac23e5acdaf260f6d1d9661e9e9576a06a63f161aed11f9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 29.3MB
        • SHA256 e71843e7dc4846b962c25d522c70cdff731d73bb7b9c01c11ff22883b00a8e5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 29.3MB
        • SHA256 f829e8fe4cff91fcda87f9b71164cd263d0ac3d3abb8a0ebbad9400a4f7797d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 29.3MB
        • SHA256 3367a516493ad933a848c7d231b9e2de5ff7b04d92b020556b71dc0d5946d9f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 29.3MB
        • SHA256 6f788e33a72f6b034c256c29d90846b069985154e24246feb3dacaf8c68985e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 29.3MB
        • SHA256 cdd9df133e5fc3ed9b597909a1dfe7af883669e39f88da914629b68376930286
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 29.3MB
        • SHA256 548ad392dcb5f5c7de2eba74a48444b41eea5bef883e5354257f310fe9d584eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 29.3MB
        • SHA256 43a456e9fd8fb53d70a37e84292d8b5abf19794bc52d6843681d7a1842379bd5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 29.3MB
        • SHA256 68b9d3a2a9bae65c52bc67462e33a2abaa65311778d65e667701e1e400a678d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 29.3MB
        • SHA256 2a262718933826a0197645856cf3712a33f4078a2a050f2defea3f9d2b6e84bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 29.3MB
        • SHA256 f2e8baba90a358c1cf8c5eb3f73fdae3c2a71d66bebd893eaa3c51db1307601d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 29.3MB
        • SHA256 b119b0b5b18d64eded8f254e37984a8720e63dff779c74e0ea9b7ce4cd4ea3e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 29.3MB
        • SHA256 4f6c2c4f35e37913151f8d04531f314be0e96062d2bc6e1bd9cf2d95e759949a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 29.5MB
        • SHA256 93bc00931a56c8c5dd294d1d59c99bee688d14910e8b1c3bb65b6479b6b6c04a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 29.3MB
        • SHA256 723b5086d8a07f10a572c51e63c4443cc34a4fe9b82672c718172f39b655beb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 14.8MB
        • SHA256 659aebdc9257c430a57bcf1b7677cffb077213a4fbe89913c58dad0ce5ec6830
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 14.7MB
        • SHA256 2b81efa86e092dfcf0618f7956626edb57b922e674ad24767cfa94aca26b67a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 29.3MB
        • SHA256 90573d3c456191c9da68b099ee6f3194925cfa14f9aeabc35c5832399b3ed359
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download