Overview

overview

8

Static

static

3

2026-08-08...r_.exe

windows10-2004-x64

8

2026-08-08...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 15:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-08_c9240672322a7a3fac23de8fa97baea3_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 16.7MB
  • Sample260808-s1qn3azbme
  • SHA256 5a97588b93e35ab79b9b174185e64d4019b6f3a73590394b75e9ba7157d091fe
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_c9240672322a7a3fac23de8fa97baea3_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_c9240672322a7a3fac23de8fa97baea3_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3472
  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_c9240672322a7a3fac23de8fa97baea3_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-08_c9240672322a7a3fac23de8fa97baea3_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:6008

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 17.6MB
        • SHA256 15c89f60f23fc981975b717b5472b1a3826ffbd56d07a5cf2a562ed53cdeb29e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 16.7MB
        • SHA256 5a97588b93e35ab79b9b174185e64d4019b6f3a73590394b75e9ba7157d091fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 33.4MB
        • SHA256 0f94338733b7dbd27b50c729512167bf5a98978b416382a83634bac83cf502b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 37.5MB
        • SHA256 cd6ebaba4ca8ed82de1e1b230b84bca56f0c151f543a18af78be84247ac6a2f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 18.8MB
        • SHA256 ffa9844c65889d0b6a8fc400fb00e4629354adeff1740452bc736c9990870f4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 33.5MB
        • SHA256 7bf107716ab67d38cf207ecf31e239d4fa5cae1fb9a8e25c6125a4ff19c43942
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 39.4MB
        • SHA256 60d0556a6d91ae73476d2be80d8ee42def3956f2517f808fd36488e181722f52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 384KB
        • SHA256 3e4e65210d0ce663e458df3dc7915e7345a65463edc2c4781b0feb1a0cd3389a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 35.1MB
        • SHA256 f45e3fec32d2a0b2b09d3e0f5baa4665db85622cf663b045a578d54c180a21f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 35.7MB
        • SHA256 a8770d8d53b4557ea7698e887e30d19c2578a3504d4ae6d8cd17c7f41c1c5b43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 35.0MB
        • SHA256 ea403ad93caf3a42f9fe80b6c1d9507b2a2f6cc708d6c79cb3cc712c1b855e1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 34.8MB
        • SHA256 3a7dce2abcf0529480617ed4d823412e9b781d4b307c46e74bf06ad0811f2739
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 33.4MB
        • SHA256 749637ad54e8f4922f256cae351c0241c62652387c4d9df067bb8beba116e898
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 33.4MB
        • SHA256 67ce6a473307cb7cf1ce743cd66682cac05d54dc098e623c8859112704c4a41f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 33.4MB
        • SHA256 7307fc934546ed392be89910931cd161660faacc6a15e4c46834b5a22397e047
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 33.7MB
        • SHA256 92c64926bcfc6583f2589f73a2b491f3a35584da76df97281ea0f0dff552c2a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 33.4MB
        • SHA256 85fa5ce47014c9c2778ab80947980ed7ea827492e4f388835085cea7805ab791
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 33.4MB
        • SHA256 6ba4fa6a8af583c7ddd8007eecc89340171d1a6b3ab026eef01ffb8d79dcb2b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 33.5MB
        • SHA256 12d30a5bfe956a269d061aaee32393fbd5545e56ef8440d851d353a381a7387b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 33.4MB
        • SHA256 2559a3dd920cac6bd9e27f036e4ac1d3aafad6f3ebe7e489370bfb95f3812191
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 33.4MB
        • SHA256 aaab938e6eaf1886bb106aecbddd0403c5d7ef4c34ebbe97e24244654dffdec0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 33.5MB
        • SHA256 d0b1cb8ab0e5a9619859e8c06fce9822cb6654535cca5f3948339e564463c902
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 33.7MB
        • SHA256 95a18b3e1f6bdfbcb41cdc33794ac50511b9e55c4b3bf2c6212a7082a4cc04f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 33.8MB
        • SHA256 a686244ba17d041a5652d4d6e2f8e4bcc13277a1328935d54291e1682181a6d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 33.4MB
        • SHA256 56ee8bbc899889e014af322eadccc2af7dd29c99d409c59435601e5f979167dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 33.4MB
        • SHA256 ec57b9217af37f0038a7b22ea4040f5f388977c08be51859a74cb49d7a36f018
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 33.4MB
        • SHA256 28c0a621cb0a2c9701384a982bdf65ccfd61143ade9036bf0b0eb8a9a2a8ac98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 33.4MB
        • SHA256 bfbd18c197a5898a0f951080a29c005b79ae8c0decae6e0483a102edaac5c818
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 33.4MB
        • SHA256 387cb2f8d79803acdd184c58e683b3e8c04d067ea75f290b56af80ee5a0129b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 33.4MB
        • SHA256 b540ea4e5bbedc62b252daff734ac6d56db9775a83d9d556f284b7f6fe292514
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 33.4MB
        • SHA256 4b178c6fcefe94ad53d357ca73fbd162b0790a32db7230ef9f4c21ddcb00bc78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 33.4MB
        • SHA256 e5c6b04886f3031afafc207983c87de9eb622e0f20f787ee11eb8cffd3d381b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 33.4MB
        • SHA256 6296d4bf13929910160ef8deb999785993201f950e03dce56d374e423efac74c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 33.4MB
        • SHA256 ac968e0e7e939dc06f5ae91497669874ce8c4dee0304815f7e48ecf04e4a62fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 33.4MB
        • SHA256 6dc1c5b4d1268137893dd0a8c5b2b509443ea1eccd9ceaa18b7b206ba4e24b62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 33.4MB
        • SHA256 80e37411efe34d550afa2a32b0623998b4d102be69ce69d725099be37dba3e36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 33.4MB
        • SHA256 19d3f82f4d06d174b4f9262ca2b9e52a9d24ee1b3498a58990cef5601aa44a69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 33.4MB
        • SHA256 8ae47950d4f82260f0c029de649b0ca99e3bd61b14405d71d19f46e6040798d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 33.4MB
        • SHA256 489d2263625f47224274c9ab1d0ad623fb69ed5bfa375cd6b4faf01ebd2b86b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 33.4MB
        • SHA256 e4d302f6ed4acef7716942c41e3f3a5147e176cae3e0b41c6bba549797454d58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 33.4MB
        • SHA256 d6a8aae77ebaad989118bacfc0523c44ffa5f20e1aac18c8181487664dcc3387
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 33.4MB
        • SHA256 b6e29498dece3fcbfde4c8c98db9b861f20cd85e2f6fc882f203d504e7ede7e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 33.4MB
        • SHA256 507fa190b05bab6a1550e6cf7def389d837317ae480929389d5c8e1d102f53bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 33.4MB
        • SHA256 884649832e825588f380a7d6ce3d70d0cfcb29c2c0aa736085fd2155f5d6da96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 33.4MB
        • SHA256 077f61d7cd95cd6ceec0b159fc0af02ccd805f0f5aad85025331f7ec7bb0ebac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 33.4MB
        • SHA256 14a384df26354af71d1ea96ce85838afd783950e78854b44ee0c90f9190868b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 33.4MB
        • SHA256 b99581caec5d941d6f1b92c91be612f6ac05f32463b224cc07d80f184e536b27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 33.4MB
        • SHA256 e5e9b1c1b4161dc93bbc86ab05a9c5382d020a5c8d0ce033509f9860928c473b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 33.4MB
        • SHA256 56b83ded4f9419fe25edf1f91ed93a887a2907058c08f93f24a58c0ca67f72c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 33.4MB
        • SHA256 9baa5265cd6fd7825d0652b1ac2a687610cc8b0d7de38192c8b91a92e73ae586
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 16.8MB
        • SHA256 287e43c1cbccf4fe5f0457cfc3e5d63457638878a5e1a7bbf047331543cdea65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 33.4MB
        • SHA256 6110fd50b62caa8ae002d0df3b0f6c6fba164e3a0386f772735e646cc6ee9ae2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 33.5MB
        • SHA256 13345dee3c339413368141a0632d0bdf9e51bc233f4fd57ca79a8cf770652698
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 33.4MB
        • SHA256 351dfd8942377bc914bf8c82a69634449a580af10fb6b9c52d7db01224a82e42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download