Overview

overview

8

Static

static

3

2026-08-07...r_.exe

windows10-2004-x64

8

2026-08-07...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    134s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/08/2026, 13:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-07_087e57edb9c7cdcdd84048facb173d15_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 11.5MB
  • Sample260807-qfls9sem71
  • SHA256 94b6549ffae57bb6fae539c2204bc664f53b2f73de1a2d213ccdff1fc56977f6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_087e57edb9c7cdcdd84048facb173d15_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-07_087e57edb9c7cdcdd84048facb173d15_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:6616
  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_087e57edb9c7cdcdd84048facb173d15_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-07_087e57edb9c7cdcdd84048facb173d15_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4540

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 12.5MB
        • SHA256 49b155527f38c5787ecd9606d343d6379fc4b0d6db0590c9d347fcc43c512536
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 11.5MB
        • SHA256 94b6549ffae57bb6fae539c2204bc664f53b2f73de1a2d213ccdff1fc56977f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 23.1MB
        • SHA256 be817b78854971944ea48192254bf2727e1b35b93f93cc17a10af991d4fdba11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 23.3MB
        • SHA256 61cc94fe52fdb5860d521068821ad61ee425754bc217789327e9d4c35e1ece03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 23.1MB
        • SHA256 ceaedd6a9b591ccbed7847429195b942b3915c078e94f8fc287527d6d3707893
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 27.1MB
        • SHA256 64ef42ae96a5ed673982b41c8ae66455c5042f4acb4e41b95bc4d90436c5542e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 23.4MB
        • SHA256 447dcc93329cf8715e7758e23f9164b1fee82d87323b7efa50ed2df11f8b360a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 46.5MB
        • SHA256 38ed15e1362065476b169fb1d6f4bdd8c10c1d3319d193be8ac3ef2bfadfaf60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 25.2MB
        • SHA256 66a97e2b23cc94d9cc5140eec52f8ed500b8ffe08383465baaf896afbdd3336b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 23.1MB
        • SHA256 1274fe01caf24fdafa675808e2435238e9cdddf7af7f559e3fcaca368c2d0087
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 29.1MB
        • SHA256 7dfba191f183a29654543eca1d33c71a19bf6151819d5cb78fb0851cd264254c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 24.8MB
        • SHA256 9a2195271c4b283bc732a58818e665df3f58c30645bc2ca88934af4770d25722
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 26.5MB
        • SHA256 3e000f36076ba26c1e227f258f6a3f8d245709b6c1b93d3e9940a2b8c4aca87f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 25.3MB
        • SHA256 b04163336ded8a0d338aba8b8299423480211a8bee9363402b8a890d9e51d7b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 24.7MB
        • SHA256 ddb1c87896575c669cd4d5434d2fc69bca2ca2b7811abfc7cfd937163849b9e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 24.9MB
        • SHA256 70c88b07c418b63435a03a3dc145497f7b99eb6fe0e4bc5a171623fb1d72258c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 26.1MB
        • SHA256 83b6d14af3dbef98d04d54912b9562dd5264422589008a911a185536dfc76667
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 24.5MB
        • SHA256 b9ac18a7e1d0fa1fabfb6c6135c62759b7bc7a911b2eff8918e0b00f764326f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 23.1MB
        • SHA256 8e5de7e54a239d2a74ca9926a030e269a5830f6f7f05a87890153eb1107af84e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 23.1MB
        • SHA256 d667ddbb2dd69d3f0e5a0ebe88180de37ccfb9ec7348ae533d6e11c57bbf60a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 23.1MB
        • SHA256 fd0ce934a822cd37a3b20cd27880860c44d5cabe6d1507de4743b10e9e04ce11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 23.1MB
        • SHA256 6936084d04a9d7daa3b75872da6d98c4b7ea7462ee36633ec1291cc459e017e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 23.1MB
        • SHA256 58df6fdf2cccca1be89647c78c3de226d30e25ecd3ba9ccef5a83449aafe197e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 23.1MB
        • SHA256 42cf566cac404fd58d0c67ca91e84817b0894974ee948438bdda515cfcd9f2f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 23.1MB
        • SHA256 ab6058ffefbd4c3d1859cce67107e0e0214a86c55fe6a77c973b50b2705a2a7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 23.3MB
        • SHA256 f56209857d664863b7b696f1ff16b3b47550a125406b9b267b50cdc2cec6c71a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 23.1MB
        • SHA256 c6e2a37101ff1e77c5cbe0984493ea6381f2d240a64ad5573b2e87c78e941282
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 23.1MB
        • SHA256 dc6112bfa7e0b4075752553905a90e099e4f346795c35adf6902a15e48f107fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 23.2MB
        • SHA256 e650a7df366d475e8c17771c341cf26d3712540e37889f6f8e5b5c6a0ee008df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 23.1MB
        • SHA256 e4397c1364185113fd688ef493993b8199ab92d2fe102603ec7220193c05f13a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 23.1MB
        • SHA256 93f7763a6e8477ec128c3f60b3c0d7e884cde9a6b46f47771e310d08a036160d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 23.2MB
        • SHA256 3fa79c44ca9997491a92037385a8e694abefec6a05398422832d4b32e67cf130
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 23.3MB
        • SHA256 78017e661202c848cc94a4a41de3dcf2edd9b07a07f1738fe4b5fd885202b385
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 23.5MB
        • SHA256 e993bf425a24170f173225a3b5cb95dc294fef32b1721ea1d43e9684ef0ed59a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 23.1MB
        • SHA256 82890aaad59ddd7434cab8c4877afffe245a508cf61745aabac16d96d922347a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 23.1MB
        • SHA256 c3851375c539e3e718bb402ed5b8070aa26d8a7a68afc1b8c0ea64fdfffade1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 23.1MB
        • SHA256 463d86019d472b0ad7e11bfd943dfc515debf1e18d66eb61f906b000abace790
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 23.1MB
        • SHA256 1a95ea26effe76b010b2a0ae675455e9d6ffa025d1ef9dfbc625fb99233f2bed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 23.1MB
        • SHA256 616e57bfa6afe189becf51b73d2b567f3bb8aa143309467b09d399dfa58e96af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 23.1MB
        • SHA256 8b6cba90b018812cf1fedb698547d09f998ca427b637fabdecbdf25a56f8d38f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 23.1MB
        • SHA256 ca34cc4667ce829c40ad41fe387e251a01e93b527129dc68ec89d35f3042e1a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 23.1MB
        • SHA256 fe67027db45e4fe88e633691818843e50e674ff28e921a030f7965eff0b01bc9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 23.1MB
        • SHA256 803f2efdca9fdf233a17c9283af303ff4adf0f0ebb4b3e65731f60302b8a9279
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 23.1MB
        • SHA256 b629019c6832947773c69d4143e51949f5f449513f519ddbdb09a090c2ad8919
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 23.1MB
        • SHA256 05b45728b95fbe84b5c834e27eb3a0797f4d2e2d35505a83b344a89977e6828d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 23.1MB
        • SHA256 41300861b2a3326aecf4c17295cf63a0fc8272d2a809124be2fd38cd7f2019aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 23.1MB
        • SHA256 ac66faac5353dcea580a3f2073cc5828600e58fe67079a3960b42e7506ee5531
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 23.1MB
        • SHA256 99ca7343afefd5c0ee1f0c1574acdfa2ec9959fc0604d7ac93f41f1fc9470548
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 23.1MB
        • SHA256 e0161341a8db73782ed13379b089b005fb09ee640f80dccaef1011c274e0fca8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 23.1MB
        • SHA256 d97fdcefa7bf2b880c7b17517db210fea6507d1153d954a14c8973b2c03a602f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 23.1MB
        • SHA256 512d70b540b70e0884fd08bba6ae4674828c5ce003bdbed1bac32224671039bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 23.1MB
        • SHA256 4e53e63a401b9c52ce27a8703f70870af459ece0e1386ba52eb9d42dd3001e3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 23.1MB
        • SHA256 69b4e712cce0d0141d4cd26a8a089a44fd82dbc5b4c9fadd2ae88c3d59914c9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 23.1MB
        • SHA256 bb0d8dd59cd67e00f706492144363a569f4f9eec7f40b9a673c47916ac2e3100
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 23.1MB
        • SHA256 cef7d0f286e770958fd0540e3c619497561ac81fe8a1f95344f0195b351bc130
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 23.1MB
        • SHA256 141e682845b2cc9ce974c110f306ed442bbcc710575deddd75d0b46021badf2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 23.2MB
        • SHA256 f9e3111c00eb2dc356ac4a76378f2834fd0cc360b5624e25c04eace312fe5916
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 23.1MB
        • SHA256 517e44290ae7449175628a794e3c0906b779ccc1ed70d4cfc19992ef605e6ebb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 23.1MB
        • SHA256 efb2ad96773dc12fac0759e03c09d1bccddd362883a8b7d152ac88dc37cb93c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download