Overview

overview

8

Static

static

3

2026-08-04...r_.exe

windows10-2004-x64

8

2026-08-04...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 16:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_29713aac3ea832fdbc671048e88b6012_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 14.6MB
  • Sample260804-tvzv8asvbx
  • SHA256 d7075afa7492a22b5043afeb079a0558cf93c61c60c2c1b45393308619d17e35
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_29713aac3ea832fdbc671048e88b6012_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_29713aac3ea832fdbc671048e88b6012_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4104
  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_29713aac3ea832fdbc671048e88b6012_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-04_29713aac3ea832fdbc671048e88b6012_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3916

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 15.1MB
        • SHA256 5c35ff8b1b9bc49b39ad5acfa1ed29962adade15c98069ae6bb9992cf8ec62d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 15.3MB
        • SHA256 3a9ecf393ed67963b411ce535ce0ec80190146ec54f5c9d968592e1faa968f39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 29.2MB
        • SHA256 e8c27d436b262d6a9aac41fcaf0b3102f20cc8509a295bcce12ac2a38690adf5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 14.6MB
        • SHA256 d7075afa7492a22b5043afeb079a0558cf93c61c60c2c1b45393308619d17e35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 29.2MB
        • SHA256 1bb1653b640a7d67656fd51d1706975c64a602c7d43dff9126acacfa72cb499f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 33.3MB
        • SHA256 e266316ee168fe7a3ab07ecd0024adfb6d3b00a166788c6922ff944ed616d213
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 29.5MB
        • SHA256 4f5fe5f6ff07e83c3cec01dcc60d49e0ef0708ab47696c7858e7066ea5b39041
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 52.7MB
        • SHA256 ec19e4666ba194b0ebe4ace192e2dfa2df6aef75a65a821635192a592bacd1ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 29.3MB
        • SHA256 473b4adb0e34bf4c0f03adf40c7a0faf3f2bfe4a997e956808d8a2b20e22ce42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 20.7MB
        • SHA256 dcc6da8dbb4d4d65fad824734a4b5a78555f844d794e4cbf9ae52e2583a2f4fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 35.2MB
        • SHA256 9f6cc76a2f25705a72a766fbc57916032611a8b5b113a8110df9800f9221e8cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 30.9MB
        • SHA256 07d6701eafd0f4897f1ff6ad8efe0531364a8db285cd27c81bd618bce105e1fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 18.1MB
        • SHA256 ca1e8b7c833cbe8781445f9cc66967fc2f4ee946b27646cae4daf0df31ba00d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 16.9MB
        • SHA256 e996c0a19b0b7aeb4830aa13ebb213b554f4aa7b9f5cb50423c27dcb7a951740
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 30.8MB
        • SHA256 f6420f2317500d806d8268dd0060d1fdcc8f85eebe511363e6086104229d4e87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 31.0MB
        • SHA256 c8a11d6dfd06d86477b1789f30247dbac2d792cb75c60ad83bf0663a893ce834
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 32.3MB
        • SHA256 2371fceb9fee8cd75830a78c384a5b25b19fc69c381522635df7245e46e27fe1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 30.6MB
        • SHA256 4565927e531b8b0456ee92a33e90c800291bee3c6eb6c8633202e76001587844
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 29.2MB
        • SHA256 739a857a89c5ada27411e06d47f7547991cff76559cc4f9080dbdc11bcef303e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 128KB
        • SHA256 e52488a8a3c5c15a2f928eb2127c84d20ca0143b2598bd3c627a271a6a7a3d72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 29.2MB
        • SHA256 00539b77f0ea1b40fe66650bb223b694e5ecb3f26995e52fe67eb752dbec0cff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 29.2MB
        • SHA256 4998205819654bf84af724123a24701a2424952297703f41210bb8ff7fd9a2d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 29.2MB
        • SHA256 2c9af1946c2c4dfde15c315656885fbc38069bf7e7f1eb3b04fd5127e25b6ae2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 29.2MB
        • SHA256 14d5dfa0469de3cfb987758a3d145e1118541cdaca6e7493e3e95123759d48dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 29.5MB
        • SHA256 6aba101f53bd68be17ee1fb1ba5eb585ae8f1df6b46d3f711914273d472b08d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 29.2MB
        • SHA256 675d32a8cace43aa228d14891c4b658bbfd0dc79f778c3391d289e0320f5869e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 29.3MB
        • SHA256 c43b1e59740148e487a20e8bdaab9d630bca42ce46d2f1a31ffb6e7ef02849f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 29.2MB
        • SHA256 01718f71b16a23ae863f3bab1aed49487e7c234cc01084b14c3209ff007e4f33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 29.2MB
        • SHA256 789eb1fddb2875dfb32a246621fbd1e07b93e54288c55be6e477cb5270c2f226
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 29.3MB
        • SHA256 d1a709c526bfd221d09a4aa868ea1f3d7f14039e29c762fd85375895a60d2107
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 29.5MB
        • SHA256 c023180160824f099c7747d8ee237fb1c3ab348d0ddd420ed604ff26845f9971
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 29.6MB
        • SHA256 0240cbfe9f1c55b6641f14ecf94f6adaae1ceb053cfadf0404c0da1d95e87339
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 29.2MB
        • SHA256 43b8cda11e9614dceb6a1ab2b864b3482bdb26a1594108deda1c167d3236478f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 29.2MB
        • SHA256 7146103089a90af9c391fe067b8642f61e09554cc2def9e1eae7bfebc504c3e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 29.2MB
        • SHA256 31c9d4260f54168d8f49426a1e71f61bb2f27eb0051b2d701defff3288e7519c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 29.2MB
        • SHA256 d5b8434b8c7654928dd7c600a547e29e21d1d627751f228606a2833628c8fc18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 29.2MB
        • SHA256 c5c6414d1a141c96db43ed843f8bffb6ac8c59447061c20b4316c6be0e89d701
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 29.2MB
        • SHA256 62f1728893a34fab6bf3ef117656642b26faf8925c444a6639fa1f039efc89ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 29.2MB
        • SHA256 fdbcff3c5c941be31487312cc7a76fd4efa3396d7279a10d38fd042b2530a4aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 29.2MB
        • SHA256 4f9a82d9ccfab94383d87412b33bb8888590098725a51938a8563295c68493c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 29.2MB
        • SHA256 a193367ac09ace4347c99fe731c2a58e80e4c391a83d523fcfaeaa6903534a54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 29.2MB
        • SHA256 c503283118a16cce68148ebd99ead688d32f84729ecc98d2fca725afefce01db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 29.2MB
        • SHA256 bc49b76444956ffea8b7bef84745fff0253b0043820466f921c2374e861a08d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 29.2MB
        • SHA256 126626e3f8f93d5f637b90b6eb003d6ddc9b03b2120ad8d1e7f81cdc76215bdc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 29.2MB
        • SHA256 ddb9e48a3269832bd07c68fb6b669cab583babcf62b7b03cfbf2fdefa18e0a6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 29.2MB
        • SHA256 f1e88677b522191de150fc82e1360858b09e9f87c0a7f9c3b7d375607580d150
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 29.2MB
        • SHA256 600702259406e4da73651d516301a00136205f15f417124984c63fb14d195c65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 29.2MB
        • SHA256 166b7141e893613f9c2da9c6367b4fbca392cf2aa9b64c0a5baa1a2118453908
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 29.2MB
        • SHA256 e42888a161f02a54f9c82641385c5faf5f2a575900c72d828d99324124f4e3fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 29.2MB
        • SHA256 e085dc56575b31f2b0f18e1f825d03dca77b97d7a6fc317cf59debbf63881749
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 29.2MB
        • SHA256 16fbbf52e3ed39218978a1b907b647b5f159d5df0df53b2144eb40692c99c2d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 29.2MB
        • SHA256 b37d05d54a60651c81b210789b3d8bdc2a04fc920b09f17528c5871e66da6c6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 29.2MB
        • SHA256 bc9c9a7da9b2a44963ced4528ec0716160c6ef1d42ac93d7970095bc18cfeb19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 29.2MB
        • SHA256 b7e85733eb91f0457c2cc6753585c93bfecc6fbade9ef2969517166f69a050dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 29.2MB
        • SHA256 1efca30599b33f2cc50a8f9cc0a822d9ee1d8151b89cd88dcdc06af733782a1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 29.2MB
        • SHA256 5658d1c3854470ea824f03e245eae9c738d1c613d27baa3411f2bf77cf604207
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 29.2MB
        • SHA256 bfee2727778db289a91440b7815159b90757f8aaa421c73a2b2376b16170d251
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 29.3MB
        • SHA256 64dad16dc1df85d0323ab703e1fd159b4167e23350a07caf9a7484fc17070165
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 29.2MB
        • SHA256 4214a9cf0874923edb52ff27a0b9ffb632623d1d252855db744ab68105252c6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 14.7MB
        • SHA256 a8b70f1c105b68fd4bb25451c2671dba5abd55a37e08810a628a8c88a8f09795
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 29.2MB
        • SHA256 59456f7d7400729aa6711d7579c9cf9c30726553afdd19bdf02c87d452e13e6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download