Overview

overview

8

Static

static

3

2026-08-05...r_.exe

windows10-2004-x64

8

2026-08-05...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    29s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/08/2026, 02:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-05_c20c955b8a987fa3d3ed4e192fdb652f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 16.4MB
  • Sample260805-da27vatzcw
  • SHA256 8f38db561ffa48411b3aaf928d8896d2cbe9fc6af99490624defc2e68390575d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-05_c20c955b8a987fa3d3ed4e192fdb652f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-05_c20c955b8a987fa3d3ed4e192fdb652f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4000
  • C:\Users\Admin\AppData\Local\Temp\2026-08-05_c20c955b8a987fa3d3ed4e192fdb652f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-05_c20c955b8a987fa3d3ed4e192fdb652f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4448

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 16.7MB
        • SHA256 7621835a45f1a297691039f26e049aa53f228700e39fbbfdee6278dbcfc20880
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 27.5MB
        • SHA256 8b2ef36216443d1a838f239d1930149cdaf3c02471402703ddd4421b85edddb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 27.6MB
        • SHA256 4bbc4c903d1e9790b68c9cb19fe4b9607c18c938703a58e40295ae3936641193
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 27.7MB
        • SHA256 ad77cb41954cd21f2557b18dbc1d9c171c4fd965a1c2971e05d19c7138f598e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 26.8MB
        • SHA256 4c513b1a063ffc1ca8bbd6a115123668df05bfde18568f9614abe456bdca2a40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 18.6MB
        • SHA256 770961240fb3dcb6abf25357f18ad575b517198866421f2600c5ecc67d11f3ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 26.9MB
        • SHA256 2e3ecde26b04ade74b10fff3fbf054869f6b127d8ea0739345c657e621ce511d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 25.2MB
        • SHA256 17ba82f345cd760da4eefac03b582230304190f2e5e6e8a397b0d78640f5e6b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 27.0MB
        • SHA256 568bab667648eba7b928a56a9086332dc5aee383340937f92d5846d64ebe54ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 26.7MB
        • SHA256 03f721590ed158eb1e6ecef5785106f05e24065b8cdc1a8cb791776f6fb37a92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 23.1MB
        • SHA256 f0b5a9ac079aa36d214b19be892040818e16bbdbabfc3829b32e07adb0b1623d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 27.1MB
        • SHA256 645ec5b4e3303ae7a9bb482ddd2a355f570dadf3bf4d63a25ff210d3281073e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 22.8MB
        • SHA256 6bbfab32185d016d114b62977679f6144327a3561595680ae7610b63239fe828
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 23.1MB
        • SHA256 8960badde3ba168eef6953efefee60558f783ab76eb665ef282c77155078f092
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 25.1MB
        • SHA256 e2c19d2be2a6a94a8c1f09339cad5878584443a14d751f337c6df1fd4aa45369
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 128KB
        • SHA256 018b597827351ef5fba9c0e1d321cfa9b45d887ff0f8d5607452eb75d8626cb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 24.8MB
        • SHA256 b58a1d72449f71b6600c0f8c3160e9ba302a761469e8f6f9401a2b776de92363
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 23.3MB
        • SHA256 9a3f183abc7afa51e54fea42f4a50a160458af9afb18d4bac17f13c43700ee3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 24.6MB
        • SHA256 99de8e2d7182c2175107a1cab5bdbdc702cdd7f6eecb602ec368c0b6757f61d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 25.4MB
        • SHA256 aec122d3867ee7211568d1331b300dbe0506165a7d2e88bbda4e6e072149229c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 24.8MB
        • SHA256 f9b9dfcdba69ece48f2d7b06efceb32bd891b5b2a3ea151b78727467c9878273
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 25.0MB
        • SHA256 d877beb61262bbea23ea7bee47cae3fb5a7d2e709fcf7323639998ca91021246
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 24.9MB
        • SHA256 7cb06113e3951d06b7f15381be1f93a37685a450ea1c86c45cd2961e68152440
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 21.6MB
        • SHA256 b9d3b19115cf3d272a4113ca0e8a9f5ad51cdf13cb5e904cc727cb521e3d6bff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 24.0MB
        • SHA256 4abe18c30c21b05aaa291f3f7afd7d12a68a7a4f4a1d8c9cdad26ec210028047
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 22.4MB
        • SHA256 be931847d8f1cc99860a65f02f58042aac98b255801676894be2738284e2d879
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 22.1MB
        • SHA256 558fa1924ba8aeafd37f50baa3ba266dcf4455d629d9c6b250f1148d3f60a4fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 24.9MB
        • SHA256 1d71f68dfd1c11949ae774faeac4a85d4c700183a13539498453d4778aa4def2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 24.2MB
        • SHA256 35f734d1d26bf0ab63128d9adfe56cb14c676bdd68623089c6a442e5223f432b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 22.2MB
        • SHA256 9a44e98f131c5b152184267634e504da0ffc35d3cd193663bc28013e97a86534
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 19.5MB
        • SHA256 5f26428535ce7f0d2ee2756242352a49a9984f54f06506ca5f5c0aa88dc6d7e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 24.7MB
        • SHA256 f0c0b7b8d870d2ce2272c426eef07eae783cae6817788f575710ed6e26a77e16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 24.1MB
        • SHA256 b2a1e354bc0c6a40bb840500fbfc6ae9a6ae5c41364cba8233449268e261e6be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 25.6MB
        • SHA256 7e651e28a5a42b3909e26f0f936c2726bfe6c83bff5ca71c87f16a957f0499ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 24.3MB
        • SHA256 d69b4dbb3ffb76255fe5324e30152a4dd0435452ef5599e81fbfaa30fc625b84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 23.9MB
        • SHA256 8a7869697d529dee7c43f0fcb2a0bc2029cb064678a3bf099e77b711621d50ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 23.9MB
        • SHA256 24ae5bff705c8c76be368d38ece9f8765cc4fb0c7a65c6d8f5a852f675819092
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 24.6MB
        • SHA256 a8476e8c57b51bcbfd1b2697bd2766e9f1d2064eb0bb80acbd4e1399590dbc97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 192KB
        • SHA256 cc71df767f30aa32b4d730d3c0244896e3d45eb216f18568c46371d93640cac9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 20.6MB
        • SHA256 7c903b8988e79ba272b151770fed2e0dd0ca387a22f689a764a9dd0fb05941ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 25.1MB
        • SHA256 3e4cf4536d5c4e47d5afeb203d316a3df434bfd7c5a5626d29f329ca650cea49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 13.9MB
        • SHA256 346e1a3ddba37c63577ca455ef07e752cc313afa8da5bab46c7447e7172da059
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 20.7MB
        • SHA256 4f5c7bf6fe981e88ef982e4c722deacd5b14ba9a10f22d4148bcee0db02f8b2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 21.9MB
        • SHA256 e8463deef4f4dd47a579d1eef246de39daa217f2ad9abe26e28d037a5a02eebb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 20.9MB
        • SHA256 4dc997f025e1203b15a5504ac25107c321c09ee4db8b108fedd20e6cc696a380
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 23.4MB
        • SHA256 b806240868caf806abbfc8e915a618ae44bd1ee6f8eda0a0730991a70001d109
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 26.0MB
        • SHA256 78e0ac3605a55c635860525fa12d69d08d036d83302a79da18b9319508a0748b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 26.9MB
        • SHA256 90f968c1de13a4dc6fd70e3f28210bf58317e6aa6104a015879202e18c08daec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 22.2MB
        • SHA256 dc8ae291c886bfe1a56b4d2d2f11fe6b962ffff3d5fe0e50259446ce672915b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 26.4MB
        • SHA256 a7370f3389e66e9f7fce5d6fca10a12de88f4f110b2ea0edc833ee464a8e9e00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4000-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4000-16-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4448-40-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download