Overview

overview

8

Static

static

3

2026-08-07...r_.exe

windows10-2004-x64

8

2026-08-07...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    41s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 01:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-07_1769d89d2f8d8c62c5d7238d57d0c9b0_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 18.8MB
  • Sample260808-b8991afp3x
  • SHA256 4997000c21e9da18891f4b05e4284048cefe70e471bd6e2e75572da764f671d8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_1769d89d2f8d8c62c5d7238d57d0c9b0_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-07_1769d89d2f8d8c62c5d7238d57d0c9b0_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4984
  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_1769d89d2f8d8c62c5d7238d57d0c9b0_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-07_1769d89d2f8d8c62c5d7238d57d0c9b0_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4208

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 38.5MB
        • SHA256 4769eaaccb048c0e432e70ba2e493e6a1296126942c5aee843bf18cb99ed57b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 38.2MB
        • SHA256 ba9dd89c9c0982af8cf7a575fbdd7923eaa200e00923587c1624f4c1ee8e3d10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 37.6MB
        • SHA256 241835f1649e1929c24f6bd421865730d64a4d60d5361a2fa9ce24b3febf13ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 36.7MB
        • SHA256 c32cf16c37f72e9574ec515915bb3464fb89304db50f6d075d9586eff29c6570
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 35.6MB
        • SHA256 56d3d7b188e3e2c699b661efb3fa3fd36317a5165a7b5eb7ae7c9a5af6184eb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 37.7MB
        • SHA256 214e042a531375d2d3c05a56f6a828e53829b99ddb3347345caa76c98f7d0262
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 35.0MB
        • SHA256 d9f34da6ddf8274684baa2d27e199c2b22ad07209a4067670f761bdad1bcbbfd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 36.9MB
        • SHA256 76c5fa4c4e646768d1fbf796d5ec2eff310a359c464ce14d0fc27e153792e8d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 38.3MB
        • SHA256 05611fdf9a4481a1b7a86c67f4ebed5f20126d6dc227d1b9565e87bdeced36ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 38.6MB
        • SHA256 6290d03667f4fc279fbb112981712e2cb6cfe380e028f2f8c0ab00ef06367735
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 36.9MB
        • SHA256 6ea6319fac6f3dfbcdc591b179282c5fa0a444004fdd55deeb82245a473b5c56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 32.4MB
        • SHA256 b1d77befc09c9c2bd26929f55b572845f8b26d89f152a303effc13161cfd3414
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 31.2MB
        • SHA256 36bb6bebac422acaf8bf2f93deeac78319a147ef0bb2e460aa42e9865fde07e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 35.1MB
        • SHA256 fb276d1602cec111c8cf1b41accd42888701bf7a21520f69874e5b9192faa5f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 33.6MB
        • SHA256 533dad441d8032da893307623e29c6eb25b139b7afebebcf206b5e6e56e077bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 34.7MB
        • SHA256 2c262514dae55a25b7de751a1d94251ffca81f5405708103a7f291d32731fdd8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 33.1MB
        • SHA256 bbfa1e062f8c0385e96b7b5c4bf199c871fd49e0abc14852c4942e741e74c846
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 33.4MB
        • SHA256 a3db96107e66c4f2ec40320218a26b65cb1f38cb7625d69a98cd5f5f30c51278
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 32.1MB
        • SHA256 11cd67566d6eff1dc2037ec9f7bd10dd783827e597ff7e5f8cac295dd973d1d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 31.6MB
        • SHA256 35e1256790f8539d65108841d25ab553f53640f32537cb71473507fd7fcf0acf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 29.8MB
        • SHA256 087fcf49acf78b46ba5ddc9178703ab1b3c096d9ee648f40ce89fba6c2026996
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 30.4MB
        • SHA256 156da3c1b3786b607477afa1cab22b6c10c8b8c3b7dedc48c2642322cd960b9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 29.9MB
        • SHA256 f9aaf4cd2b618863c97c5b9ce61b80e13a3da0adea4468db2d6da2db9d71b5f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 30.2MB
        • SHA256 7c6353550ddb4efb1a755c74effa2685299bc738eeae78c8d43fc19cc664af13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 32.6MB
        • SHA256 4c5b9604609cd6273972b5f2628354bcce9f70b8c8cdbb80b3337161a24e0e44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 28.6MB
        • SHA256 b5febef7ce7e2cb72b05270fe77ddb4753a33076d42bef0e20508c40f16d6d0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 31.3MB
        • SHA256 862831330601cab1b790b4bae183f32cbab28d14015ee14c74f8d23ec268c527
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 30.2MB
        • SHA256 2604b7f2404860ca4dd2723f8f22d0b80edde741b55fe8fe02bf7fb9fa24d450
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 29.2MB
        • SHA256 5e8349cdddb2813a86cc3163ea4b0d86f3f9b139f8ec6166ca260dba0c7d009c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 28.9MB
        • SHA256 d852b62f06e310fd79e18e5af8087dfb5d6cab9a6017fb2d7fdc2da19833d589
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 29.5MB
        • SHA256 49e36b70669f53cf009ad858c99c73b3da3f235b60f6deeb763ab8fd5b274dc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 27.9MB
        • SHA256 c985ab2d9bec03af5c8c4198b084201d58203a8b3ea590f89c378004cf9ff060
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 29.7MB
        • SHA256 3251e41c34ad703fd92c0b5441e6aaf8b106276c014f474fdbe33b470075ed97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 28.4MB
        • SHA256 d911486d07174c05ab5a26b8bb8cc6f2a876e3dc491a4cfa384d712a76dc84fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 27.8MB
        • SHA256 4c321ea8041bf59e256bdfc3d7785be53b887c6f76f353b5afb739aec4a06b90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 27.8MB
        • SHA256 84327e6b6a50b2ba34ae5efe696a255d2677afe88c865aac4e6a84a1d17cc662
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 28.8MB
        • SHA256 2f493f90cc18af25540619cb3f8fb4743b4ebbf05994aabb5339233bccfdde1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 27.5MB
        • SHA256 a9b19b1f9446663cd40efb0d80fdac6603b249a9be9b8a37edbab5544608e3ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 27.1MB
        • SHA256 df3ae0a9714a7d6931faa0bb5469dd80c9bcce38bbb3da96b85b9e9b0d0e6574
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 26.1MB
        • SHA256 00b167c1517bc2c4f52c0a4f5bdaa03b8eafd8fcd1088cd95d5af6676925ee3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 26.4MB
        • SHA256 f9579a030b20baac3023c283c42bc9cba2887dfdbcefbcfa16eb93cc5cbca989
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 27.1MB
        • SHA256 20f8341e1783b226d1a9b532a28a58aea1498b26c572f7911fc30d447599132a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 26.9MB
        • SHA256 fa4884c317038d2cc075a73e61f83f9bff46572d4f4ed3929aab4ea5f86a4fbe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 25.2MB
        • SHA256 19835b4e850055925bb98aff62c5bc726b2de88f8d5f93c7cc5300d89d747123
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 25.9MB
        • SHA256 77e4504fa2ac081768d14b37865d588d0fe2e3d155ab823a91bb2a979401bf83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 26.3MB
        • SHA256 c02b06b735232d9d00affbc08007895cf0b1a8a701bcebc28034b93b95e76004
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 25.1MB
        • SHA256 0cd761b3874deabd1ea35a6ca0bed080cf6184760bce2f98df2495d5c04d46f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 26.2MB
        • SHA256 94eed84564e8792ab885be7b6cbeddab0e93aca1a44c531b1a439967ceba2c32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 27.0MB
        • SHA256 0f8d3aa23c8f726c2b6a63e79246c8679932e996553163ffaa40284cc6b45ab7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 25.4MB
        • SHA256 5544d3d44cedc148bc265e13ddc8d48eedaaf781e9348ac533fb318802b041ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 25.9MB
        • SHA256 9ee058da325466ce69c0b67d012ebf0d9cc3fc0e2940649f0432c78f46ec5af2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 26.0MB
        • SHA256 0f3df920a105f45a461b19c400d6f042d88ea3786783a5368e0746b00be73db4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 26.8MB
        • SHA256 b478f8781775b1bfb4a311a7755c44ea272f067e86c0f8c753dbf56143738828
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 25.6MB
        • SHA256 abb2ae4c213c606a3094f8acd70716e12955f33a5ca406598f89f32c1e1326aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 26.8MB
        • SHA256 5c0911bafc73ee839a489495e12818781ad05eab87d20fd57ac14a259da35080
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 35.8MB
        • SHA256 db14269068a120159b008476437fba12ba7701299320362388303b64d2b7c7b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 35.4MB
        • SHA256 c924382a563130d36a0c5c52c192c6c75cbec19d6ba552fcf60c0da537e930ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 34.9MB
        • SHA256 342a4d0cb9cda29b299c674c90cccfb352c028972745435ccfd1ab126bbc05ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 33.7MB
        • SHA256 221ebcd52a7dec3f190add5c4b86abc912799020a973199af1c14584139a7ab6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4208-38-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4984-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4984-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download