Overview

overview

8

Static

static

3

2026-08-08...r_.exe

windows10-2004-x64

8

2026-08-08...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    08/08/2026, 16:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-08_0e9c1a7df85902491a61f7272f6585f7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 18.6MB
  • Sample260808-tzx77a1amf
  • SHA256 29412db6a1c0b7f076991f260110e07bdc196649ab232337d71d507a563013a9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_0e9c1a7df85902491a61f7272f6585f7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_0e9c1a7df85902491a61f7272f6585f7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:776
  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_0e9c1a7df85902491a61f7272f6585f7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-08_0e9c1a7df85902491a61f7272f6585f7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:864

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 19.3MB
        • SHA256 efedeee9595a8d7fd8e722530b6a7580ad881ca854e799fb12b4a4c9213c0136
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 18.9MB
        • SHA256 b238a4bb13cd7d1e5780a700afce67c9b76710889d80e34dfffe1ebfa412935c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 37.4MB
        • SHA256 0739e5a391e230bab6d2cc47118811b78dafacd4fcd15c14e33f18dbb6b15ae3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 20.1MB
        • SHA256 56a3a5313d2d8e15f01a85f080af5e1a84b405eda559aa739fed85419db5359a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 18.7MB
        • SHA256 16a0ce7d5c4291d6b404afcd1a685f2165d8c8582d815abc530561020eb03830
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 18.7MB
        • SHA256 02ca0b765ef30456d51e981eb8c8d60560f1de3b7ab201455d5a9ab17db59a39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 18.7MB
        • SHA256 c8cb42a08dc56bc5278bde920e497fc2196bfa857c77c387cd2a571ee709ca8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 18.9MB
        • SHA256 c8df59d4825ed033c3c3c8cc6dd681a1e80f99d0baeccf3e5924776ceffe5707
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 18.7MB
        • SHA256 1622ff044a655b7da14798bcc355111f791ed1a497e483d71b9d1535bc7b4bc9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 37.3MB
        • SHA256 d21616df04568a92a48ecf1b0b7cf54245a9332c39dd3b3324a2ca9f2cb9fbc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 37.5MB
        • SHA256 e6d4770a8d2f74dcf7588e1af8fb48ee08aab0808adc208c94a34fe132422941
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 37.7MB
        • SHA256 b963f292e1c0f359cb5d4f3a242c5761454ed9bf6706c5c4aedfd5a5881e08b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 37.3MB
        • SHA256 f0b2314dcb0c14dec038f69ee0c6f10d59462e3b03564a6866fcb92c727d3d36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 37.3MB
        • SHA256 931f590822c6c98c81054a11c0bd23f58b62aa7501e2c6e78a584afde55ef4b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 37.3MB
        • SHA256 cd3a4802a9f485d31613407afd8ddf4b2e6d7c2e05ec0405c4eeb21b743fa6a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 37.3MB
        • SHA256 0dbf48d07afc837b8c38dc32d8444f1cedebe8739f9231b1bcb2b70b5eff3ba9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 37.3MB
        • SHA256 d9b9d06ad67584a70f2a867bfe6663b2f4a33d8ade2e3c249e988647b340f914
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 18.7MB
        • SHA256 e3f1731e6022441dfdff18289663b854d9ee8e4613e2b57c3e538b306c45b205
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 37.3MB
        • SHA256 0f5e57595dcb23c5b7ed74e3af6d09e3d9d850331fb8be4b602870f69131a1f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 18.7MB
        • SHA256 5f5e23fed867df3502e14fbd28a1e67f906b30a8ab3552102709579fed9880f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 37.3MB
        • SHA256 eb7645cec4ac7c1e8fac102407edf9722e8145f05423afa2c04ed015ad3f74c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 37.3MB
        • SHA256 e0b3231e04f5b7bb6b5a8c8d69861eff3507e65ec0668f5c6cde908350d0b9d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 37.3MB
        • SHA256 26e05eb39b9fc36ecb0b5e068ad97aabc8825758f5e7c7330252efbce677c0c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 37.3MB
        • SHA256 40875928ce8969cc4ab4c2875d6f4b65a9474394643eee60335d41fca578c657
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 37.3MB
        • SHA256 ae1e17ef2ec3418d331545b85002901bccafa53637cb17d6f5d397c8a3102059
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 37.3MB
        • SHA256 06b8df885c0956db9364e0622aba0e7752f94e69a62333614c6ee14701ee16bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 37.3MB
        • SHA256 0bcd39c63da0a9a2b5728b24747dd5b81ead62595d65fd5107435dfc8b5f517d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 37.3MB
        • SHA256 47a0fcf13ea1fa5fe952db4be462cdec1936b414e98252530d3a67eb57022a9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 37.3MB
        • SHA256 d4fd1bf8d3ae2021b8443ac1c0da35456a68545592adc239608b94a87a87b574
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 37.3MB
        • SHA256 b0a3e15ccd563137ffbad6d95dd22a64235697d7ac33b965ef0f980d1fe39668
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 37.3MB
        • SHA256 cc18e769556c74eabe9bb48ce0d3087181ffb5434e62890a5046e4eb9f9deb08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 37.3MB
        • SHA256 f3f6bb02435f039d6eac616d0f4a4690225d1e92b35c49291cda562446ef9e56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 37.3MB
        • SHA256 1d2aef594854c507c38c1efd3efe565774725ad2502049b2a619fdbb349788dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 37.3MB
        • SHA256 0536f410735e44c945d99aa5f4ae7777a25030d9a6da82f2703dbaea86b947fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 64KB
        • SHA256 79a0b1f3b0958e830806c9254c2ba2af079ac99713004febcc3610200c9f504e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 37.3MB
        • SHA256 8345b3f2462ccc7deefa6a114c8a5ea49b3efa8697ec74be56d275dd7a02c3ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 37.3MB
        • SHA256 d589b9569ab6bcde40395a0d7e77449d587c7a3e9d6988781abc8ff613b8bd22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 37.3MB
        • SHA256 013ee34ed28b712819a1bac30860f43a65a146588e9d8fe24cb3799e80432ef7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 37.3MB
        • SHA256 b11794e36c7853b8d34b69be10cdb94dd14c00b9a99deb4019a96293c146e6c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 37.3MB
        • SHA256 47f86b9afe3ba811d7821f764a4a061a533d5d567785015e16af986783d28ca6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 37.3MB
        • SHA256 39c72e267199838777495ae0d8aa2068c55acdcea56583c482454be9e5583c64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 37.3MB
        • SHA256 e4d5bf540d0c3b5543acfad2059763684fdadc8a10c91732fc4cfc4b029493b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 37.3MB
        • SHA256 327bb7c07326bddb23d71a9d547e913ded9cfccb53e3faedd44ff2c8c0774a6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 37.5MB
        • SHA256 40fc2d1e89b372626c2c3713b7f7435dbee8b04cbc2954b6a8f8867be0e92f2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 37.4MB
        • SHA256 e9188528993d287bcbb5414deae6426c3d04e5c171a880266834fcce53b4cc5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 37.5MB
        • SHA256 84e3b9e030e2452b618afd00112f06e1ca7bd97e40ba34f82890680214e9f1b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 37.7MB
        • SHA256 209f48c57fa36503ec02424f4ac810fc891c5ff5c7799acb4efd9bc724541f40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
        • Size 37.3MB
        • SHA256 2c674fcf6319302456d065647f13533737cb7b24e9a8eaeefc3a259fbb5c9a90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
        • Size 37.4MB
        • SHA256 5cde8ba22df184d9b75c8d1e3e19a809d2a2ce7c6cd7b4381daff529c2a0ad80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 18.7MB
        • SHA256 604369f193a34a2897c343cf3a868b03fa8f5805d33905c9715b55a0a13197fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 18.6MB
        • SHA256 29412db6a1c0b7f076991f260110e07bdc196649ab232337d71d507a563013a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download