Overview

overview

8

Static

static

3

2026-08-04...r_.exe

windows10-2004-x64

8

2026-08-04...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    58s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/08/2026, 20:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_5cf607f51fff901c88b21f4ceae5b491_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 18.7MB
  • Sample260804-ytmlqaxsh1
  • SHA256 a50e28d2cc920ce5ed5c4dc0108d4b1718b1c17d5a7e2569395ee87639fbbddc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_5cf607f51fff901c88b21f4ceae5b491_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_5cf607f51fff901c88b21f4ceae5b491_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1812
  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_5cf607f51fff901c88b21f4ceae5b491_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-04_5cf607f51fff901c88b21f4ceae5b491_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3812

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 19.3MB
        • SHA256 6aef347732d65c84db536bfd574007a7b3573a6fae663902f1103721b975dd53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 19.4MB
        • SHA256 fa4121578fca5ecb62d7386ac95407c39b0201f20e45a61d91dea45cf15aa9b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 18.8MB
        • SHA256 cb89923d0d4aeb7ffe607296c1dec361f1dfb2f737b782dcc3ecea246b04e4ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 20.4MB
        • SHA256 be7f0583d12592878835355f6059cc2a6cd1333eca0cd177d5f6488da5729495
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 37.5MB
        • SHA256 f37a572d688c590492c8a866805a07a8fc504fdfe088dd156cab2c66ed22cc48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 37.5MB
        • SHA256 71a2224539b01a127ea63c67a14048ec50a36243611b145ead56bacfa98ce5c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 37.3MB
        • SHA256 1c1a706de734e961b35805a4574c3a5dbb1d3cce6d54402fbf1e3542bb645c1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 37.5MB
        • SHA256 db8a8ef81e355177da1e2f6919b52f1e3bf62a31fd8a974d2894ae234bda844d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 33.9MB
        • SHA256 c416b4ce8457a17a2aeb73f65c8390d8b21769ad46e87da36cab0d093a5eff65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 34.3MB
        • SHA256 8100f1a680e1ed4cab2fb4c46f27e91ea20eb607682c3e0424381b1f9b51bb66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 34.8MB
        • SHA256 cc63baa99714ea26fddca2077af01ea2f118d1aaa44877854d94bccca4e53d5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 35.2MB
        • SHA256 32b4129e7ca77b1d420177d34c17557faebaa24c61f200600837b28b550d5cc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 30.6MB
        • SHA256 ec5b4f8a5ca6eebb66158179ff950efa44a5dce4542cd88b7c2de40fbf72cc0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 33.7MB
        • SHA256 8e0f8b660643dc75534ad74ced7debc3642e97671268d86c654d35133ca90a4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 32.0MB
        • SHA256 b58a61f8c2ca82cc8a241f89a82bb0b9c7e884ae38484e1e97c71372a2a59b70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 30.5MB
        • SHA256 c71cb7f464e2ba35b42fe807ffec1bc32350999a2164911dc5037fa998b36143
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 32.1MB
        • SHA256 6df3e9b0f475fb4764dd097e98c2ee317402afc755aa0318f9867030d9011fc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 31.2MB
        • SHA256 1208ba10b032e61d329e534b93fff7318f73099f6230d910046a27938de274ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 32.9MB
        • SHA256 637421b3e850a2c01401c61b0fb0d48f623618c5878052eca0372f3b1bf934b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 29.9MB
        • SHA256 edf9205dbb3ec749f9e00158e8e23a333b0aa7e9a564e2bf8f716faf91de39b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 32.8MB
        • SHA256 c3048f4b4f0b78bdd3534160497a58e91e5a196cd57815ae6bed53bbfa660a50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 30.1MB
        • SHA256 813bc5870925a8540ff3c81a3bc1a6ed3beeeef437d9937bfe73b5196da41e5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 31.8MB
        • SHA256 4fd606946931aebe2b75a04b14eb3ec6c4a2158759b6517e40ce805377467544
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 33.4MB
        • SHA256 ff38124c6a424f21d50fe0643d7cb82978442f1ca23da0b4aafb263c0d5cc521
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 30.9MB
        • SHA256 63c4d2fd4b6bace2c41d04788277047708170e7bae21470e1a1bab99dc3b20e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 35.1MB
        • SHA256 1e9135385fe6707240d988c1600a72202a6962746a9e22ba3d28e9b77a97bed9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 32.1MB
        • SHA256 8b3677881ff32c66c295af2fbcb11f24a3c2446e805be7c40476560e546ebbca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 32.8MB
        • SHA256 7d451a3a417ad61704052fbcb0f8ceef1caa83815bef1082e190d9e181e1cbcc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 31.1MB
        • SHA256 1f8641e2e257ae630adae7c12d012d228dc836eb8a7331b057c91876e07e799c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 31.3MB
        • SHA256 e9cf31f4963e98cb2f7a06257be91b22f287c969bdf7d283a0c07f12f33b9f55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 29.8MB
        • SHA256 a3820cf1fe01e903b7835b177d20e1383b86bf84805a92ea89a7c4dcd94be042
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 36.2MB
        • SHA256 98c66bdff0a5e10bc16ef3ff68596fa0094349f2560b0b7786d07c4767ee7eb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 31.9MB
        • SHA256 3ff46862becb9eb8da8eacad7eaebc3eaf58b6b6e553ce13932951fa9813740d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 27.8MB
        • SHA256 6eec337d12048166b33e63f96456ef3894422a6080b924181542b26d949bd515
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 31.1MB
        • SHA256 5a1f496a1d52f4c324610189be93b9aa50713db2fead01fe152f7756c92dea1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 29.3MB
        • SHA256 7c904ecfad36ccebfcd18caf2d52f629d27d4e8baff122ac8be66f1dccf7a441
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 27.9MB
        • SHA256 8484314f24e81320351ba6e0d8ff8ff0350a3566254fd1e094f09f36620e8556
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 30.0MB
        • SHA256 ed4df1cfca3503acc6f9d4530409c6f5994a5fd8c4329f26936dfd3125a59c0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 29.2MB
        • SHA256 e8ccbf673d43d3831f33352a55eefac0ed67b500b6002ef0adf2cff4d668348d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 27.7MB
        • SHA256 aa96d15d3b19525611d51c3e618f69765483a6ce1530c9d3e2acf5702c198129
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 33.8MB
        • SHA256 856a9986ca252dd9641348aed21fb68e2ae7e6e220e86f089e034d569de13223
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 28.9MB
        • SHA256 b1d7e226bb3cf83c70c557e8492f616af4343b5f4f51c8a99afa499aecacced3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 33.0MB
        • SHA256 d8ddd7f2bc8cbb83363bdbb8e6dfc4607764521e48053328589bb633c0ffcfd9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 30.2MB
        • SHA256 633a4cd7a4fdcfd422df7176b2655176183cb80a7c19ed507c974fe8646e960a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 28.2MB
        • SHA256 9559fe56954e292982b3b5dca7d60c58237ce6bc5cda1a27df312d0d346efa12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 33.1MB
        • SHA256 1b4b9d32559465bbfc8b3a44562e44d6b999f87f7630997c3cbcc26d0fad88a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 31.4MB
        • SHA256 2cc862c8f14266d796ab0d059df057064ed8a7d71caf0e696e75c6e785e5b3e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 29.2MB
        • SHA256 59c453e671d1b5775622fe21b7a3262323a707d2134d533995e85c0e6ef83df8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 28.6MB
        • SHA256 81fd6a238ddfcf1fbbd6b7233a8c1d4b4086a081335185708d65ca539ae8b30c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 27.6MB
        • SHA256 51629c7dfbfb48a43a5054d905362a97f179528823596ed3b78e9c705b3fe77a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 29.9MB
        • SHA256 8ef3ad9984b6ef4e1eae6a376c0b4c00528ce625c67b2c1dc227df3ca0d3b292
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
        • Size 28.0MB
        • SHA256 b6a9285541a830d7234ae6ce9521df23e636ab2830a7b43533c46b276ea943af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
        • Size 29.2MB
        • SHA256 4cc9a017830649862dd7c2d9befd602ccdd3fdf94b0cfb0e3fc48190cda8ac4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
        • Size 28.5MB
        • SHA256 0cf034ae6749a525794bee40fa7da86b31f895e84d37665bc966bc8bb6a659a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 18.7MB
        • SHA256 a50e28d2cc920ce5ed5c4dc0108d4b1718b1c17d5a7e2569395ee87639fbbddc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download