Overview

overview

8

Static

static

3

2026-08-08...r_.exe

windows10-2004-x64

8

2026-08-08...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    116s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 15:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-08_e3a239b4f7cf114d3b56be0b882d1798_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 12.4MB
  • Sample260808-swbpcatths
  • SHA256 27922f0f24592e89d0bde422d5f3b914043024d874309b9d6d49a735291c421f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_e3a239b4f7cf114d3b56be0b882d1798_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_e3a239b4f7cf114d3b56be0b882d1798_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5844
  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_e3a239b4f7cf114d3b56be0b882d1798_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-08_e3a239b4f7cf114d3b56be0b882d1798_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2904

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 12.7MB
        • SHA256 55be5a5c3cd262f3e7755b10482c3f92c7959e95ea496b21e83a5813f4930dea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 12.5MB
        • SHA256 738c5a4996ba4eb7da5d1cb6631b35e857dd8ad51b9d104ba5c7f2fcb2706499
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 28.9MB
        • SHA256 0a1f99a61f7095d7b11676ab46bdbc2d8f3943852a6475a0b23cd489386e118f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 25.2MB
        • SHA256 3f12a6d7e83e9ef8c0ff20eff3a6205cb85138b89b10a878016f9931e2e076f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 14.5MB
        • SHA256 bf4879d74997ba2b760177a6161692f8b1deb4d4eab2b5bf91fa50c211283104
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 24.9MB
        • SHA256 56f777f0100b9cc0e8426b91898a430f27e36aad3ca907fec1e9e2f681ec1f94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DebugMount.htm
        • Path C:\Program Files\DebugMount.htm
        • Size 25.2MB
        • SHA256 e8d308df8ce34de4b02949350149b99f84f23a06b7bcc85b7f3c364398f3ed19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 30.9MB
        • SHA256 e80caab127e27886efda0060af4e9b39fe974ceee3a979ea73e928adf28122c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 26.6MB
        • SHA256 274b13d400a3147d3032f7cf4a5571d221977ca4104139acc9f2759016d7d35d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 28.3MB
        • SHA256 92193146f13bc1024913b14cf093ca329f7153dc1ab9079d7c751343bc064bdc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 27.1MB
        • SHA256 86c17e042751dd027906b14a3959f2cd6884ec8760958cfccda763d2c14fe1b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 26.5MB
        • SHA256 c333a6f967d0a991da5ae3c61619d708efc0a2698f065bc01e272386636b327c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 26.7MB
        • SHA256 61e827a0b3369aa854078c9d4fc5c9e1402474ad1345f690258a4477cf57cd91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 26.3MB
        • SHA256 499ac26ae760a46c360ac4a1a6897cfda956bf67987512dc9b80f6a3d126042c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 24.9MB
        • SHA256 93dc93d42b171503ffb9bef319496176ff2c85471c89790a2eb7af43b9ee0533
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 24.9MB
        • SHA256 868ab1c4748557b6a107934dcd5bf6132e22b1d17e3f43538b7e3e883ae0ce9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 24.9MB
        • SHA256 f520c4e6eb02de803aeb0e4909345cffc0d472b049d97efed69c883bed2714a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 24.9MB
        • SHA256 ad49ff9ba47da041c7ce2ba1f679cf2bdcf17e533063d2aa62e7456cda941825
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 24.9MB
        • SHA256 a88a16ed25738446018c937b911c5a5d3fb14479155493d17e97342447df72da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 25.0MB
        • SHA256 b6ac9e87779e91430c6a3da60f5d1d4dc2e1663461872afc0683dcce3b6b0774
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 24.9MB
        • SHA256 e4418c1012ce88b3c1facf2ba0dc2f6cb2ea603db2e283faa6cf3ac62323c759
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 25.0MB
        • SHA256 72d06eb7113bc25afcd910d822e88aacb6930d12856d4d78940d8f0123737a37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 25.1MB
        • SHA256 5d9332e362cfed76222d991ab62ed1cc6cd7bc4b8a1bf084c5ab7be16af1d4dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 25.3MB
        • SHA256 a3148ae0e4092fefacee8dbaacf9055b9e5d1249c67edeffeeac5ebd2dffbca7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 24.9MB
        • SHA256 4a8c6f58933e17913b21158e5d2af40f995a232568ef38bc91f0945c042f097e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 24.9MB
        • SHA256 7338303940a4aea5cc7e09475258e7d74804404076463a9f6a2828dae520748e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 24.9MB
        • SHA256 6a6e83b8bf14e69607f495f13d579e326b5a7f820548194400c438b723c90c20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 24.9MB
        • SHA256 84ad53fe6137d566dcb762ac894c78227f83f5643579f793816802cff4a3bc35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 24.9MB
        • SHA256 2e545e0360da65e03848c18be7c84fe9aa1de80af6b2d7ab00f0490cb26dbe49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 24.9MB
        • SHA256 bf20935b8e3b32d0029d3359e4dd6ae045ef92475e2b1eb97d5eb0f8df7b125f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 24.9MB
        • SHA256 4c9cbd7f2b07b9b641d74d345dff748f8a16f2dcefd7b70780129b29ad960cb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 24.9MB
        • SHA256 4376318333905898f6f634ecb0d060c36633290a27cb26f0a7d33e8e4a879f1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 24.9MB
        • SHA256 38b398c388853951cb143d9f9c71109520b641b4eb8406083af2e851069e348e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 24.9MB
        • SHA256 1139f516dffa5bb7b2e05eed687762e8c3cafaab47d4a13752e63717f606b328
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 24.9MB
        • SHA256 3db84b57291a60fa0bc03971aa37d3bb24adcbfd60bd4ffa39d97128d488b3b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 24.9MB
        • SHA256 082df231b278ff1f718a4e782df7e083c1c0f8c8f6aba5dabe03b52b245527d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 24.9MB
        • SHA256 9bfa1eea8a74ff2839c040b8ab94d7756c7f00fcea99abee44f4f68310028d1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 24.9MB
        • SHA256 d7417110f56e9e45d3486e38f6d02df6d7e6bd65a1316a2da93468eea6650130
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 24.9MB
        • SHA256 ac3d36e98db59568fcb04e36adc022fff296cb7ee788c9679cff50586a4906d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 24.9MB
        • SHA256 e8bda13107773599d922152681134d93f12cd715e5fef8835e6489edd79f5d86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 24.9MB
        • SHA256 c34c89874e7e5c78a49e88f489b96c8f7d7301167777b7b93a40ff746e76ec0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 24.9MB
        • SHA256 d8c29f7ab624aa4da7e9ec8dc65773747d55d56913d1cb18779dc0d02f9da967
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 24.9MB
        • SHA256 3183349b0da549149ee1db4e72e8f2a93bd97586176ee4132e7378a3f08d8c32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 24.9MB
        • SHA256 fb613db2ba9b999d26da8ffa3852279369decdcc16f97b64aaadddcf972a8592
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 25.0MB
        • SHA256 f9899ae5fdf7086f05a81fbe8fb2564006f6fc64b4367ebb4a1a9135bba450e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 24.9MB
        • SHA256 3a83c450d01ace1ef36aac2efa8410583713d782971b499edac356de693d76ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 24.9MB
        • SHA256 c0f1a0e3559f2c42ff31fe7a6e38d93861a2c7b3e44795c87bad36c58ee7e199
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 24.9MB
        • SHA256 23a2843e76b0c6d4baffb0e7bcadbb078999d3de4546ef232aaf9908b522ead0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download