Overview

overview

8

Static

static

3

2026-08-07...r_.exe

windows10-2004-x64

8

2026-08-07...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    129s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    08/08/2026, 00:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-07_e3fda9d55e2c2039545c50120835bda9_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 34.8MB
  • Sample260808-at64csen2v
  • SHA256 7bab46bfe3b5bc16b9d69da9cd7f518bfdb5991e192ffbb4de16cb42cc866f32
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_e3fda9d55e2c2039545c50120835bda9_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-07_e3fda9d55e2c2039545c50120835bda9_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2316
  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_e3fda9d55e2c2039545c50120835bda9_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-07_e3fda9d55e2c2039545c50120835bda9_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1928

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 35.4MB
        • SHA256 1fa4ce0a66442d6ff64600b77181ca495cd0ac94061769b9725111a421bd2fb9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 34.9MB
        • SHA256 68ed6bbe2ac656f8568c274cb251595fd628fc2a0b77d6bf3bad49ab150b4e1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 33.7MB
        • SHA256 7d674d178117f8fde87c308514fb3a068d5ad6e6d75626fb4a9ceb3e6fd677b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 35.8MB
        • SHA256 e3d29eaaf8c897b77588abfee7f0ed465e7f3c6926b56057620f0777c136d17a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 34.9MB
        • SHA256 8c17dd98d209584eed0ceaec6aadceae3ace85834c1021be577b4720e3be268b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 35.5MB
        • SHA256 a166d85e7cc8526ca0cd6536de60168b211ef3140c78e2589b6d5bc3b0166fdf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 34.9MB
        • SHA256 4a82c030245f15ae4ab49860ef80d1597bae381add9c4f400c91a78c5722abfa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 34.4MB
        • SHA256 9273dbd91c3a377512de4dd35756a1901cd49d309e45078822c9cc2ae5ff741f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 34.7MB
        • SHA256 5a499744ae4386ab1cfde41a12ed748c822ab937f4b5acbec4c088eb9b004e03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 34.0MB
        • SHA256 a6cdbb31c07df5a5d3f7690d4e6789a4f84da639fa14101c374d5254646ff164
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 34.2MB
        • SHA256 3865def6c2083b2fbd981eaf54aae0d0f785163427c2e2d2b16af52f64dbe1f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 30.9MB
        • SHA256 c6320272cadb53a7ce8f34a2cf0a5efddccda279a5fc9cabf6b629f9ad12e0e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 33.2MB
        • SHA256 26fbabd344c071073e0a3b2eb500648f654ac82e2700a62ae94b61276323984e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 32.9MB
        • SHA256 4055e972d9d97d1ac8b443b094907f615fcc862142dd9b4340b30297e62ac2bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 32.0MB
        • SHA256 bf53723602d4c94b40583ddd5b42edd2f8ed63cbc18e76b90d8228da9a446c59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 35.2MB
        • SHA256 471bcf7790e06102e0ea78f450ebc36906c0bd692840d51327f55290ecbf9d4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 33.5MB
        • SHA256 4376c298c426c1130c212cf11c69e7e7ce46bdce00b1c9d107a0e6c99a3ea148
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 33.7MB
        • SHA256 8002c448ed6024d042bde79a16a69b15b71c243326f607719f335e291914f19d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 33.0MB
        • SHA256 8dc2fd9177da50bdb4be2751f7ef6b1b9811227d7a046994a9e29571b3bf5eb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 31.8MB
        • SHA256 543e749411e866c8af16eb59464eb2efc5d608470fb1365666d529d2428e082e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 34.7MB
        • SHA256 710200a84fdb03323eae2cbe6e53b02f4e964babdbf3371520c0bd7a1be433c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 31.4MB
        • SHA256 9deb1d2b555a2ad5d888867002e304f056dca63dee8283feb4338d5417349cfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 33.0MB
        • SHA256 1225dba84ebab868f9124b0e4b54478deb0008094f9d8a5a2ae916d953ce6b32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 32.4MB
        • SHA256 35e9841a1bebee13c081c58ef3bac4ecb13f01f49f43272d26ac86f251667889
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 33.7MB
        • SHA256 2097a2790386bc853a40d768fda3bdabf8c1a6d427d702484a78e0200423d035
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 35.5MB
        • SHA256 1eeb57447cb0586dc7d66e1cc1553ac8af1bfd6407c07436d6fa8d2389e90ba3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 32.0MB
        • SHA256 07d99dc4e19117cf9babb11b22efed00cea44848a1dd6fc41a50994263477f39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 31.9MB
        • SHA256 2b7a6346cd5fa6ab0a5e689c5ce316ab75b43c1bee498f43472a88838120df5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 32.2MB
        • SHA256 2177e110b5be7c66b93daf3c252b39afb31b4eced3cdb4b40152247e7cc8c517
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 31.1MB
        • SHA256 72fe3adc5ad2e46da2adc6b513ef585ad68538e046edd2455b300a2bfbfb4333
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 32.1MB
        • SHA256 ca3711cfceb0f9710161063da92151fca131ae5c44c1c939b671b52a4465bd4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 31.0MB
        • SHA256 6901e380f1230e227c6b8d16eb911481adb030fb8abc8109b465860eab06dbda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 32.6MB
        • SHA256 815a458bb44ea19fa51483cd7737db641c6fc091880ea3d18d885561bd5ef081
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 31.3MB
        • SHA256 62a529cd82d685a3aab85f8a043f558941c6c0fc1eafe7dbdc4a3743e65066f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 31.6MB
        • SHA256 b8a321bf10a25dac76fe2fbe34da90241acfed4fbce0f43cfbf06df51da8235c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 29.6MB
        • SHA256 0791985cd2776190b1d3a9a7b8624b0dfa6e3363a4b945f1331389fc8ca9575e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 29.8MB
        • SHA256 0b73a1c9126660bdb79afba839c5c6ed39342f3f4ec9ad89dfef3c34b88aada6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 29.1MB
        • SHA256 7d0cb50b8b7471022f3244634e59b588f8ac6976ad534abdd7263fa04736d425
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 29.9MB
        • SHA256 74ae53172fca3465286f31a825a8f99c74230e03b7dde4cae1987fcde7fa55fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 30.0MB
        • SHA256 267a0633c57a28f5956994cc547a156a5673b86fc1fb30d546cc4fce327359d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 29.5MB
        • SHA256 16059ec2645b62bdced031202a54735252f59fc15e4cf146ba6ad5ab9029ed68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 29.6MB
        • SHA256 a8899ad79502576fa6036de36313c88090a82d8079ada0825045251252f7d07d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 29.4MB
        • SHA256 e63d97f945a41f09e71c8ad399839893217dec257d9537f584bdba0c139b01d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 30.1MB
        • SHA256 c34347927ca58e6b7f4498aed718c642cc1f502b2679f8d79392275807978bfe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 28.2MB
        • SHA256 f24f2b9a8182d7c5637aa086a4c48594972a4a64d276edb9f035943a472371e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 29.7MB
        • SHA256 5ebfbcba179b7198242481ab60a7b43332561cb6d028a33c31dcbd8524183d91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 26.7MB
        • SHA256 52fad790c0d1aa156953d60f156424e5ebbd8f8b762e7271994efcfa5ea30ac4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 27.9MB
        • SHA256 f9474fd591066d2e6bdd57d4d2278a0bc18fffd55d8efab6b957d98be58560d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 26.4MB
        • SHA256 79cdb26533fc6f4815fd94d995d50a1344bc1658facceef90c6d43e1099fd606
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 28.1MB
        • SHA256 d87f90185fdbe01981e8eb8a0b2a6c40f043c7675c2284b9b5b2ad42cd798b55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 26.1MB
        • SHA256 9479df96fe246f675459be33ed238dae2a669bf4002aff18555c7b123323841f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 28.0MB
        • SHA256 5cc38db33bb484b258abc6d46a737eeb598b7ba7b9aef54f63bb5b6bbc8c55b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 34.9MB
        • SHA256 dd5c243341825ef0a68b67511cae01eae3358cf7e861c337f5daecadcfbbcc20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 36.8MB
        • SHA256 ec94ddb094d9a8c11ef70a88710902fb6ba6c38f8220fd93742af97ad9968002
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 38.1MB
        • SHA256 e302953e4b41705be7f6729eadbae46276ee40e66dd8f54001afd3b0b9b46c93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 34.8MB
        • SHA256 7bab46bfe3b5bc16b9d69da9cd7f518bfdb5991e192ffbb4de16cb42cc866f32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download