Overview

overview

8

Static

static

3

2026-08-04...r_.exe

windows10-2004-x64

8

2026-08-04...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/08/2026, 15:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_76a18d3e0c56cbccc5afba87fcbf74ee_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 14.6MB
  • Sample260804-sqlmcshl4s
  • SHA256 010b692f51efcc13538351469e45e6841483cc2113a0372170e018cb782b6094
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_76a18d3e0c56cbccc5afba87fcbf74ee_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_76a18d3e0c56cbccc5afba87fcbf74ee_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4448
  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_76a18d3e0c56cbccc5afba87fcbf74ee_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-04_76a18d3e0c56cbccc5afba87fcbf74ee_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4864

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 15.3MB
        • SHA256 8abf1b6822344d27fe4ae839e63fafe1012dcd995bc241733014334a80854d92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 18.7MB
        • SHA256 4e808ceb54d183718e1fcb686bb6f02887b5c66045a879144aa1ffe5559cd0b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 14.7MB
        • SHA256 bb794739e3dc00d650e0341c73d8acba6838cc3c24bf824f79756190cef0be77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 14.7MB
        • SHA256 5688396932a9bf980d8b88422af9a148de3411b8c25b2866e1e6ea7fbb853007
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 29.3MB
        • SHA256 b438751c00407fe8204f011dea971a0ecc9d0bd7f984062eb1b4d176c28d78fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 29.4MB
        • SHA256 13423fee15199761f9012235a50eaed11417687fc8cfccfa8b18cf89475847f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 29.6MB
        • SHA256 689ed64314041c8de5df4013fdca1e3db19c4e4fd886a2ee93a9f597848257b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 29.7MB
        • SHA256 f8c6f5911cf2d4ca05f2b7466e6e1e95777532d15a97332d38b933a2cce9b797
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 29.3MB
        • SHA256 dc2825075ee5689ebaf0dee0f8dd8de4b14a6b99aaae5ffdb0ea6403ea4c8386
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 14.7MB
        • SHA256 68b72ae4ef6c74e3ef8816ce0ac76bde5858aed73864a9f8743e3439281d3fad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 29.3MB
        • SHA256 84c63d6142f884cee53832539e164a53d613f08063f69b5d66e54ba6c270048c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 29.3MB
        • SHA256 20b659dc4f974c189d951e74cade8d66ee3106b6c45f318687957e92b826485f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 29.3MB
        • SHA256 cc4afd9899284fd5b78265f9225b05b62c5aeb8e067bfbce9571591049462c64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 29.3MB
        • SHA256 132c912efc9ec55bd83527f4202de61a806b9144c9f1e4a8255461dcd683ebc9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 29.3MB
        • SHA256 6037a3622dfbce8db8e44b02cb0a6f12adfd63712d17573e0b08da3e6ff3a8f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 29.3MB
        • SHA256 2f824fd4a7f71db5ff8709845c6385445e0658890e6be0955cbaf335cb51b9e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 29.3MB
        • SHA256 409ae5aded7d41c688cdcdf7fc2f648f97a8df86733c94ec2672693d9ddea549
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 29.3MB
        • SHA256 b84a6daf07adb69ecce0d6edda0d94354d2549ea15f67c82e24df5472bc2fa16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 14.7MB
        • SHA256 b735a83b0cd59c4c5b116767b1fafeb33669ebde0666c8b6d2a03e1e3cbd9864
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 29.3MB
        • SHA256 91ef69140bb197f452f514f89199cb5ca53c7e40e81e17a62825655e36c851cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 29.3MB
        • SHA256 91c97d960043c0786a7a904d0c841ce99acc2a82e776bff27f252c1bc334a95c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 29.3MB
        • SHA256 a25deefaae98933e5c5a2ec21deeb8f7e6b62d838e3881471a493ab20af9caf2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 29.3MB
        • SHA256 837a9d512400ac6d700b4e8d0708d6afdd1db5b14378ee7b75969678cb1d0148
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 29.3MB
        • SHA256 87f39e4f3e1fae39fed3007fb321422e651fdb70c3521c13f1117eca0fb3554f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 29.3MB
        • SHA256 943b24b550715469d8d7a141bc18d52e166016f407c84497579a740200cc0e1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 29.3MB
        • SHA256 c9d7c48c3e7336bc7f7e6831ffed2cee139df3fcaf64235a13624deb1a83078a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 29.3MB
        • SHA256 d2cfeb74a4587beaaf4e436d8eb92429bda0a77ac15e5a3992e21cdccd7c4c9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 29.3MB
        • SHA256 2f0b702ef0e2a7a9096d1be1b858452992a1f4ce29866134f3c77e5b4630058b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 29.3MB
        • SHA256 14d1c2cf254e26721ff26b7b03700c3b7cec956447bf15a0a7e6e998ebeecef0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 29.3MB
        • SHA256 a4ecd2e9e9605afb072cc9768cce9fdb79efccabc8ddb7efdbf8c022875fe0a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 29.3MB
        • SHA256 fa7e808fe6559bbd2a9f89b748a461ba61d10c18a2ffe71fa2a337746cdbc157
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 29.3MB
        • SHA256 2528f8632e2fe2f72f25f6a244535cf8d40250ccc76e5045c132f6e6ad5c3404
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 29.5MB
        • SHA256 1b37f6a0ef8d9b59a953c774d7c253d33a4171546f987481b501e16855baa9f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 29.3MB
        • SHA256 f92a7e805d0ca5cc418d4ceb4932d7f95f444adb377d8544c36af33c0705f458
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 29.3MB
        • SHA256 daaeae229eab3f40b8c00d0cf138a6b4ced428eafcca0fb5518e7d3bcfc74a39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 29.3MB
        • SHA256 067624a8fb4769cd19bd73b73272ae3d814e4b709165266537bed1e74d92e61d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 29.3MB
        • SHA256 a26f0667dabf07b844b520fa05b20a4bc450ef931a972695f3dc170e9a10e9c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 29.3MB
        • SHA256 1a8840b05bf6ef98bb0c9dcfad03a5a9e801612fc513f0806a96b165efaa98dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 29.6MB
        • SHA256 cf2a8949a319c1563d8afe28e4c6ac6580a7832ab4d28145b57f27f156aac02b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 29.4MB
        • SHA256 6038f3edf17183d88cba1730ddd62a5cbd6d0a8284b7a87be67f99d1ac344e1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 29.6MB
        • SHA256 4bdef63134734d95bb73a08cfa79152669d71d2d62563d27905eceb41e5e0ed7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 29.7MB
        • SHA256 de2e062ab4bf32905f9126bb3b30e5d15924be30d8a9a15e06cd95c3888f0c05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
        • Size 29.3MB
        • SHA256 5f297c52a1869718d623f6098de7830bcc4ef40eb19492e3c67ad8207de6c17c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
        • Size 14.8MB
        • SHA256 57f103a7af4bc536fc1beacaacaf623c3991134a8859fe90cd75ecd6977d06da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
        • Size 29.3MB
        • SHA256 69cbd23a3e41138a103c7e43f1ac710fb3f4640605789209c7adb7cfa4dc20d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
        • Size 29.3MB
        • SHA256 ed0f98bef36961cd06b7106f1c75440c5c12339d56d01de509f0ba312d70a1b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
        • Size 29.3MB
        • SHA256 4281da32707912180da7651f8769ef97893b77451f96ddbffcfdce6751da97ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
        • Size 29.3MB
        • SHA256 9bb5293c3bbc076f5bb7f4cf41f3aaca17796e2efcf6619ef5f1f189de2f1474
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
        • Size 29.3MB
        • SHA256 50d80f0784c2f11b1817191ae9073ce77e8f7f97b1a8c42e0359f121767d8dae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe
        • Size 29.3MB
        • SHA256 02c8c396095987f0cc7d714f6bdc0fbcca407e6790487b652567415acc1df65e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe
        • Size 29.3MB
        • SHA256 7b46a54658de4beb0fe3f1d62180cc8e55c66cce271f10c17095ccab6275621f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe
        • Size 14.7MB
        • SHA256 73f2d79747f5a37f967d732081fb709b9f1fb5e467e486cd2e5f9ebe563b340a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
        • Size 14.7MB
        • SHA256 e4961891a5f8910c4cb2615ed4669bd204219eda52c44e2dc18e1547e9f427b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe
        • Size 14.7MB
        • SHA256 54bfec2def0de11f4f9e71e05c64eea7ade9b2b396ba6f4b21fb428f1de9b71d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe
        • Size 29.3MB
        • SHA256 66b6018ffb15365765cdc6b188343c511148b600e2e27fb81676b198cd8cda07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe
        • Size 29.5MB
        • SHA256 e1900b7353cb74d819058941d0eb90396fb854dad6e4d06eb6e30a57f8c3d7cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fontconfig.properties.src
        • Path C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src
        • Size 29.3MB
        • SHA256 b987afc9e0a1dcee10df3dc9854e452bfc71e2b29ffcd1cbf3bbbcdb3fe09d66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jabswitch.exe
        • Size 29.3MB
        • SHA256 f128e84843ae42243e2e2c4c17cb884e72a299300618bf40223625875f2726bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 14.6MB
        • SHA256 010b692f51efcc13538351469e45e6841483cc2113a0372170e018cb782b6094
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download