Overview

overview

8

Static

static

3

2026-08-04...r_.exe

windows10-2004-x64

8

2026-08-04...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    75s
  • max time network
    116s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 15:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_76a18d3e0c56cbccc5afba87fcbf74ee_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 14.6MB
  • Sample260804-sqlmcshl4s
  • SHA256 010b692f51efcc13538351469e45e6841483cc2113a0372170e018cb782b6094
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_76a18d3e0c56cbccc5afba87fcbf74ee_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_76a18d3e0c56cbccc5afba87fcbf74ee_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2920
  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_76a18d3e0c56cbccc5afba87fcbf74ee_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-04_76a18d3e0c56cbccc5afba87fcbf74ee_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5744

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 15.3MB
        • SHA256 8abf1b6822344d27fe4ae839e63fafe1012dcd995bc241733014334a80854d92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 29.3MB
        • SHA256 6c655fa9cc646fce721ae5be25f24ad8dd5a106e73cdd69b4084ad10ce9f4d0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 29.3MB
        • SHA256 874d96b2b81d805859a0c5cc4b26ff0fbaed124acce9f1160fc65de765cb3e0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 33.4MB
        • SHA256 9b430ae3ad182346b9cc26e776c8a4357be99803d3018d2f0ad1edee99190de4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 29.6MB
        • SHA256 2810502f465b5c4735055a61a97c0f368f81b940a8ac7649873be197f10aa309
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 52.8MB
        • SHA256 b3e71405c68f0526518470ad319c507dee4f85e37c252c8385c7190aa35132a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 31.4MB
        • SHA256 b6a8f5921736c7b074ca17e0e63dd58f9c51c4ef993f11b3a55ca59252bf783c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 20.7MB
        • SHA256 ff48e9c6882acdafa72db77340547cf4a0cd3513989bb279f7ccff7e2373e47e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 30.9MB
        • SHA256 8f9f97cc7b915e7dfe8bb0fd84d374aac8d3864fcf22c76ecd2425bcbdb054ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 31.1MB
        • SHA256 4a8a0681db89f02cff764b9ad6f0a9a581888345d706240e4673684d345309e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 32.4MB
        • SHA256 e5801cd245c7615cb7827a5e8dbc8cd00142373713c214b086d85c9df31a7ab7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 30.7MB
        • SHA256 c51b19e7cfd54b242af87211b4dfb17d63b19b3fecadc1c3442918e8150ffb4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 29.3MB
        • SHA256 07fbe1b6de98c88cb52fb3634e61bfd6f6123fa6392b465a870bae6fdc43d3b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 29.3MB
        • SHA256 ba00f2da04d25e52b58bbdd002ddd53dfb8d3a1ea34ebe4f031995d25fd363ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 29.3MB
        • SHA256 e6af5f457b715bccb4c4733aa2a4e0fd5faa32253e481c656332f144544df697
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 29.3MB
        • SHA256 30c629fc76d17c78cb41aa35f932d38db164ab65e3196dd691ac7eb39cebd087
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 29.3MB
        • SHA256 2a8a5064d4d4b36213d083e3048b539b691f1281c3ff28eabd31747823a1d0fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 29.3MB
        • SHA256 4fbdcfa7f4e4cfb169302e706e59952f3a6581950b14376a7442c28126d29648
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 28.5MB
        • SHA256 30bed32be4b7efaa2b7228149f4baec03aa554661737dbb48572c40b8b3026d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 28.8MB
        • SHA256 bf95131c50bb9cc4d41d845a8c341553a48edd9710ece35e7d22e64dcfae5198
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 28.1MB
        • SHA256 418212b08797d4100df7c14d64f17445e19fecfcedd6b433869c234eb1ccd5cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 26.6MB
        • SHA256 3c992b02d1e5b4943fe95a3e0d08d08b78ca8420836b579fc6517cc26ac4bb13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 27.4MB
        • SHA256 0eca4861f808efab27eac3db37083c8984a7521aa1ec7a3dfa9c448199952c07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 26.9MB
        • SHA256 0c4d4b1310b274de51a31b4a776e6b25751a6bb61db9dbb38dcb7306f23b5563
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 25.6MB
        • SHA256 8b9a3d8c086da879168ae5296640e225241c945347c97b39c2a1071aa2581c75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 27.1MB
        • SHA256 e5438ff7169b92a80614d258d262153c44070ca72d43e4b224c1689e8ae6a5ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 26.1MB
        • SHA256 2899a7e8966ee0520b8dfb586d8cdaf8b248c43298874705b91e7a93ad243ef7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 25.4MB
        • SHA256 8a5ed4a5cdd9c7964e8605d05967ed245986681ba39c9ed18acab03f053ff0f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 27.6MB
        • SHA256 2e76256aaeba53b3cd97b4924e2c582a1fa728390fb5584042764588f99eb56b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 26.3MB
        • SHA256 cdc0698c6c3a8970958e733675301ff71926a73d135890232ac4e93b9ca32a7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 25.5MB
        • SHA256 c4b61e4c65f1d57e08ffa6b1fcc64702e1a039e21121c23fed173fad91f02593
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 26.0MB
        • SHA256 cf9469a1cebc0cca906ad0c1caf99b7972cd586aaad5d91d1458c58db0de9b08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 27.0MB
        • SHA256 be2cda9ace07c82a2ab303ff69406247e28c52a56aff9a850a35762e55fa44f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 24.4MB
        • SHA256 37a2e0a839b784f3376fea30fe81122ce3a72f4156b2d2f3dff88114f2c567fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 25.1MB
        • SHA256 71a0e506dd13646d5f779bbde2505d0fa588540bb9ee6a4809c7c1746de43c83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 26.5MB
        • SHA256 751195d5b008ab064e63dac9f218993a8bcecd4655f4efefc51dfea317a83d16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 24.3MB
        • SHA256 12a5d72eb228f4988189e5de22fe7a8632328dfa752f26ca2e12023ddcdeb4eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 24.6MB
        • SHA256 c020ae0d6737292bdf6254a2da37d4c88ee8fd1da400f4f85849032d5f722223
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 24.6MB
        • SHA256 c725718a0c54df7ee478d6fd5a3f7998805d8584029bcaa62514a6fa0e72715d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 25.2MB
        • SHA256 9339e351a6c5b8aa341aade643d8d0651d46e68b72302cb3fd56dcab2ce01665
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 128KB
        • SHA256 e52488a8a3c5c15a2f928eb2127c84d20ca0143b2598bd3c627a271a6a7a3d72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 24.5MB
        • SHA256 348c95c18e28a1d9a1bb92cbaf9f1fae410651e1531c2c88a75fcfaa4f5f23aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 23.6MB
        • SHA256 95ebd5c71d67783909f5418a4d7cf9a242d7a4a4cb88ddab9b401be1a3b3e12e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 24.9MB
        • SHA256 a513086fcd9e26217f781ab437fa24c10db82566456a3be8a37873067ddddebc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 23.7MB
        • SHA256 e68b10b2774640a8b61e0a56833871ca64ac935625b2cb76c915fe8e249d353f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 25.9MB
        • SHA256 eae0fc145ebc31440bd35bfec60484afa3d35ad7fc2810699905e2bf3db2e741
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 24.4MB
        • SHA256 88929a66d33f4612288ea1e3594cb4293f0c1e65397b3ae9688829b81cf21002
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 23.6MB
        • SHA256 6fd6c6f2d2547eb103ff400727d9185f4d2d6340afe58eb3aaceb7920266a62c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 22.6MB
        • SHA256 693c935d494c4be9fee5704917d25313cee9ea225be272f017c30d18da4051af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 22.9MB
        • SHA256 fb99660b4972e75a975a63b8b466b91722ae7110b93e84dbba1bf8a5a6e492b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 23.5MB
        • SHA256 1d57081540b0bead2360b74a4310fedcb658414288c825fbb6d3d197041528ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 23.8MB
        • SHA256 3ebf13a8064a0d82089be863f5479dd8dc79a3ddaa22cf516a044d2e4b614fea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 24.1MB
        • SHA256 1cee269b8491d05ebb4687f3e0c89ef08910902d718e22edf37c07756fd51238
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 25.1MB
        • SHA256 543180db2157b28b1ac418901a816549fb1ca494b484a31cf2f31e7033d37aee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 24.6MB
        • SHA256 861c3ada96518ba59b29afba43d55bb7c26a62b2feb1a7f882d6093f758ca5ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 29.4MB
        • SHA256 3f867ac98d513a517dcb8ec7071bf1ddb7c2cd54623c60259d55276e59dbcf48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download