Overview

overview

8

Static

static

3

2026-08-07...r_.exe

windows10-2004-x64

8

2026-08-07...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    119s
  • max time network
    146s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 00:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-07_e3fda9d55e2c2039545c50120835bda9_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 34.8MB
  • Sample260808-at64csen2v
  • SHA256 7bab46bfe3b5bc16b9d69da9cd7f518bfdb5991e192ffbb4de16cb42cc866f32
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_e3fda9d55e2c2039545c50120835bda9_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-07_e3fda9d55e2c2039545c50120835bda9_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4432
  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_e3fda9d55e2c2039545c50120835bda9_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-07_e3fda9d55e2c2039545c50120835bda9_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5012

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 35.0MB
        • SHA256 2da5aab4cf6437d705cb29499533d924c72b6c7caed99ad0ae5fec049415df77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 53.3MB
        • SHA256 f571ed661ec2c158bc3e8c1a810189cbe3ef719326ae126306e0df47d478a258
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 50.8MB
        • SHA256 92b170f864861555981f527073c7ffeac8a0ffc375cbcd79cfdf29f3fe147f62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 49.3MB
        • SHA256 78508be4e9740edec89438e11544272f29648b7ffe8ba0da004fc09739a2c8f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 36.9MB
        • SHA256 047b27f463dd14ab8be7049037cfa44e9d3c34f7c564a681a7bae2ffab5ab1eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 44.9MB
        • SHA256 8058112a7a4f16d3d01001228777a1e5aa015e6abf4049582f61538fb88aa58a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ConvertToInitialize.exe
        • Path C:\Program Files\ConvertToInitialize.exe
        • Size 44.4MB
        • SHA256 a5d1435c55717a1411beb620540c992d9a795ca1ed46948badc5c38c623f440e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 33.5MB
        • SHA256 4376c298c426c1130c212cf11c69e7e7ce46bdce00b1c9d107a0e6c99a3ea148
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 31.6MB
        • SHA256 d3bcb78a489bf320933c03bf2dd1263235785592ad8fac66f77982fb0560e4bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 40.1MB
        • SHA256 e278ddc274865272c5d060a903f66ec37a221cfbb3222417ef5e316b8a2696ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 36.4MB
        • SHA256 a5a94bdd9ac9f2fe5735de167531559a54d69f060cd5a0dde571d24e4d27c1df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 37.2MB
        • SHA256 41e29a2159e694dea7df4362ffbc5ac4e220bd13e4a65c5fabdd43b14ff6dcd9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 32.1MB
        • SHA256 0bf13001a8e191f8c5bfb525183cded71fbeb853e872b7545753d77500f69e40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 31.9MB
        • SHA256 2b7a6346cd5fa6ab0a5e689c5ce316ab75b43c1bee498f43472a88838120df5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 31.1MB
        • SHA256 3fce639200bfeadc4476acc06f1317df07022354afa0666ed79ce8ff63908867
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 31.5MB
        • SHA256 10f027d2238246292f67574d41f99a374f2bf16d622727dc14dc6f8181503c5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 192KB
        • SHA256 56d5b720b4307ef448fb38ef6495ea0a6fb25e8bfa8f9c140729b820c8e0cc1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 31.8MB
        • SHA256 99557b96783fa671c283a62e745689e56617af8ead6d05053343ab53c6d133cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 31.6MB
        • SHA256 a6ff395830ace640f7a693cf40af1bca48a935ab291bc5f75d7855d1c33c5d30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 30.3MB
        • SHA256 b6d46c250b5254e7f222d9a95e1f1b74de0a0a7b7738f2bbd0153a4efbba8c9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 29.5MB
        • SHA256 3ec622f150056359bdaf3000d54edfcb39afa98b35cc8e52af0a70ef89cd6361
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 30.5MB
        • SHA256 363d1ce05059df8c63da5f975731b2e01cc656282db23fdd9c594d7dc927d1fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 29.7MB
        • SHA256 82e594d70d558634979d796fd0929522435d3edfd006f477c480abbf814ac257
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 29.8MB
        • SHA256 b351adc8d01793751cb01923f313c23806d3ff4de0349ce62f9503314905aa06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 29.7MB
        • SHA256 f663098d94bb6e60e698c5375567c08c8fb3507f6afbb71ac5c8c345190ea724
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 28.0MB
        • SHA256 3449db649f98ae63ad2f6f140643a5a114a9008a380597d205895bc4003fae3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 29.5MB
        • SHA256 2157500793a8c49c79a76d129f0a4e870aeb8f96c338c97960a0e4c0ff5d98f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 29.9MB
        • SHA256 9ac6eec20128fb329a70209eb601de73ba9b485ddfdce791138c738c480d9974
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 29.7MB
        • SHA256 5ae3152f6610292a57b5217023d487917b410cd6c6798f7bd6b395754d1fda49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 29.3MB
        • SHA256 880258db4f7a49dabfc5600b2af7f8a8660d9ed351f67af8988bf4426e5ba8e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 28.4MB
        • SHA256 ebccf93fc7d1f1b841978cdff7174e9234238c6871345a95fcff82846d577806
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 29.3MB
        • SHA256 55fd5d7967d3fe531dd0c62ecc6c2d891664bd9d7ee7da97b26b1f6381d697ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 27.4MB
        • SHA256 2491bb81bac8fc8c73e51aee2212c500aa5969fdda2d60353eb6e31d94ee1129
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 27.0MB
        • SHA256 5fbb28422225d7e0e172ed58b1a6575901dbbcfba4dc4d8e06347a0b7714e027
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 28.2MB
        • SHA256 2dab879fd5010dac8dc7b11349f7b12276b5a4e7c9b06c6ead565f8e2b9583c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 28.8MB
        • SHA256 14c72a894f22f3429e1ccb27ba6cf021567b026986237a905e21101457a40c18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 27.3MB
        • SHA256 bb4b4b8ecd69c7482dd461edd387beb82f099940c5d372e6ade4ec6efc97690e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 28.9MB
        • SHA256 8499315f0948d7cc173e813730c10c24460c4ab97b6e116bf283b4cb6429f30f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 27.1MB
        • SHA256 adb765df21e0a078b321f0e0ecd51a3844eddfb2c1b127b366a8ab066579c8e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 26.2MB
        • SHA256 74fd544ceec9c3158ec4172a5c165b04638b0c64fa1083fb74b94ff145b573b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 25.5MB
        • SHA256 d4590e4705b0d63fb287fe4981e8ffb34b9d5ac074ada73db310cb6a507c0f39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 24.1MB
        • SHA256 9be4ddb91231dc00e707537c93447f6d64cbc190060276d292565e935e00b864
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 23.0MB
        • SHA256 4a5d08daee02952e5208bf36a88ee6a56dde237068e24c79d47625dc569db24e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 22.0MB
        • SHA256 20271d8241e99c3ec504eba38e149bda24d1ccc4f431937fc5c0db1bb5cad3f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 24.8MB
        • SHA256 8b27ee4183f4807f86c424a6236e1330e585545492f4d47059560529aa2f1170
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 21.6MB
        • SHA256 a491e8d1b64af09aaea3ec7091545a1879f3d2a506829cf57f963b45bbaaebca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 20.5MB
        • SHA256 09e7d49d9ecce73043f220f51a76d2e5f4dc844cf6c85f8cd49fc187a61e4f37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 20.3MB
        • SHA256 a2ad87fdb3d822dcd739026e85713fba18d1817652d0c25c67654a790c67d32e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 19.9MB
        • SHA256 9b5054f31732fde92be77d7a3fd303e64cfffd2bc84f6e6a8b3a9f94a009fa3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 19.3MB
        • SHA256 fa38a3f34544b0c464e10882883d15c7ad7c43f8573a0ce9a86945561dba5aeb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 18.6MB
        • SHA256 0f0645c22d07895d2d5523de66f6bed5ceea22d3cc9ecb301696dac9132e62a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 17.5MB
        • SHA256 582519fec9fc9c30f831d9bc8d5434ceda3333c950ff606658a32352a656a9d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 18.5MB
        • SHA256 41428f20bf031cdca66d141e8504eff64d4a9b56c36eb241a9c7c4407023e111
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 17.8MB
        • SHA256 cfd8cfd22515bf4bf05374f0d0b23c0b6b717e602b2a5465a53f68888b91cfd6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 20.2MB
        • SHA256 c2fda59949937f55d59fcbb728b4fa782c76056e53d4028c688e83fde01c82db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 18.3MB
        • SHA256 ab99ef9b2f4de752d7a5a52c368a9ceb20f410703538414ddfed18d47815c9e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 18.5MB
        • SHA256 373b37e5b00053f50a41d169fef8bd07ce29ea5dc549d2009f78a298029284da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 19.8MB
        • SHA256 1fbb0f1edb2a265ed915c1d804aa4467f8e3d4d205a743cb17a2caf7ff340dc4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 18.2MB
        • SHA256 67d7364b50c549a142badeb1f4f842f414178b517ee270034242763fbd53eeab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 41.3MB
        • SHA256 302542575d5f96fff8f3a59df04d575673a1c8d9e656fa1984b33301d8befc6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 41.7MB
        • SHA256 77bfa3f1e2713d053ca54dc0e4233fa001f5b122aab7cc418d82efc12e482da5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 42.0MB
        • SHA256 e7d0da220d2432b7be32afe23e7312144a3436b6227b871c810b10f4b9875644
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 41.5MB
        • SHA256 4b1c26bb7b90f76f7f4778ee01381d5a3ff5e07e2b5b2b1a225dc6344044f9b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download