Overview

overview

8

Static

static

3

2026-08-08...r_.exe

windows10-2004-x64

8

2026-08-08...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 16:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-08_0e9c1a7df85902491a61f7272f6585f7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 18.6MB
  • Sample260808-tzx77a1amf
  • SHA256 29412db6a1c0b7f076991f260110e07bdc196649ab232337d71d507a563013a9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_0e9c1a7df85902491a61f7272f6585f7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_0e9c1a7df85902491a61f7272f6585f7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5272
  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_0e9c1a7df85902491a61f7272f6585f7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-08_0e9c1a7df85902491a61f7272f6585f7_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5076

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 19.2MB
        • SHA256 a75b5bcf8b7ec7f4a68955356dcc70fce1c0a11bcc5974f815b4c3f11bed0b70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 19.6MB
        • SHA256 1332795d724a3137ebb54b197927505e57da3d4e15889263bd68ae29431d7ef8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 18.6MB
        • SHA256 29412db6a1c0b7f076991f260110e07bdc196649ab232337d71d507a563013a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 18.6MB
        • SHA256 fc06ad6e5a99bcc10806c8944c19b6624f50cde7e8f502eb5d029a38226b330f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 24.7MB
        • SHA256 f1dd36093c30ed7a336945e0159ea462f82cc78bec719e76c6fa7d03cc4df5ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 22.1MB
        • SHA256 f78266dd63c906cee4ca6ee05dfc10155789c3c079d566f6ad1801eb700b6d69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 38.9MB
        • SHA256 d1c6656f6fb69cc42ce5741eaf84d47cc0434d25000f0da3255c9c899a2129a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 39.1MB
        • SHA256 4c09db291060adaa52f3ea0ee29c10133f340374882225f290cbdd85e5ad7e13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 21.7MB
        • SHA256 a9e32cd0ceebdb4cd99b47a16eeab48707bcf040a243c2907411deb5724a05e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 20.1MB
        • SHA256 56a3a5313d2d8e15f01a85f080af5e1a84b405eda559aa739fed85419db5359a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 37.3MB
        • SHA256 1f87c8a7b8c5fcd298a3e9b61f1cf867788a8d0e2d5703d68f7096954664f96d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 37.3MB
        • SHA256 6a9a026ad7a7b24e729b34dc8f80d79caeed2883419e987e4c21245e819057d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 37.3MB
        • SHA256 77ba681fc2fc43ffe582ea16d12985d5b1bc3dd3d1f849601499508baaf1a5c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 37.3MB
        • SHA256 f7bc6638aeb27cc64a8cc0ee83ef0ba472b24cd33a6478c7368d2a3683160a16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 37.3MB
        • SHA256 ddb3adcae14b12660d6c6868453a3d6426717cabe782ae00fb1449d344cdc927
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 37.3MB
        • SHA256 137d275271e2f326b84eec9dba870206759818846e3e62d0ba6025ee9f1f834f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 37.5MB
        • SHA256 34e495e8149c287ec7948538f7631001b0da957b998d28930a05d6556dd072b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 37.3MB
        • SHA256 9f8c0ae232de2b94ba013ac400f2236fc66d461034859cc3f772014a61d10400
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 37.3MB
        • SHA256 d21616df04568a92a48ecf1b0b7cf54245a9332c39dd3b3324a2ca9f2cb9fbc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 37.3MB
        • SHA256 f0c435d12e818228896f2504575f25af40fcae0e13d78420258cb9621722d0c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 37.3MB
        • SHA256 7db2460b8f979b5e6d16aca02dc8d4b141a10292b9f140e8fa042565f9976109
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 37.4MB
        • SHA256 ef0087d142d0bd60f4d3d79b4ff8cba08beed31bf8142c96e59c2d196ac0829c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 37.5MB
        • SHA256 e6d4770a8d2f74dcf7588e1af8fb48ee08aab0808adc208c94a34fe132422941
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 37.7MB
        • SHA256 b963f292e1c0f359cb5d4f3a242c5761454ed9bf6706c5c4aedfd5a5881e08b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 37.3MB
        • SHA256 f0b2314dcb0c14dec038f69ee0c6f10d59462e3b03564a6866fcb92c727d3d36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 37.3MB
        • SHA256 931f590822c6c98c81054a11c0bd23f58b62aa7501e2c6e78a584afde55ef4b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 37.3MB
        • SHA256 cd3a4802a9f485d31613407afd8ddf4b2e6d7c2e05ec0405c4eeb21b743fa6a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 37.3MB
        • SHA256 7c9743b1eb074220bf0ba0ffaabed1b2d6dcdb851a175ca21efe49de9f92ee65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 37.3MB
        • SHA256 d9b9d06ad67584a70f2a867bfe6663b2f4a33d8ade2e3c249e988647b340f914
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 37.3MB
        • SHA256 7be58799bde48ec35752d8524a55ddbdeeb2df54d8a811e15137ecba8f2b56ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 37.3MB
        • SHA256 0f5e57595dcb23c5b7ed74e3af6d09e3d9d850331fb8be4b602870f69131a1f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 37.3MB
        • SHA256 bda9574d07e662e26a484d604ed919d48e94d02ee2f1e788cc454eaf6eb45ee1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 37.3MB
        • SHA256 eb7645cec4ac7c1e8fac102407edf9722e8145f05423afa2c04ed015ad3f74c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 37.3MB
        • SHA256 e0b3231e04f5b7bb6b5a8c8d69861eff3507e65ec0668f5c6cde908350d0b9d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 37.3MB
        • SHA256 26e05eb39b9fc36ecb0b5e068ad97aabc8825758f5e7c7330252efbce677c0c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 37.3MB
        • SHA256 40875928ce8969cc4ab4c2875d6f4b65a9474394643eee60335d41fca578c657
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 37.3MB
        • SHA256 ae1e17ef2ec3418d331545b85002901bccafa53637cb17d6f5d397c8a3102059
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 37.3MB
        • SHA256 06b8df885c0956db9364e0622aba0e7752f94e69a62333614c6ee14701ee16bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 37.3MB
        • SHA256 0bcd39c63da0a9a2b5728b24747dd5b81ead62595d65fd5107435dfc8b5f517d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 37.3MB
        • SHA256 47a0fcf13ea1fa5fe952db4be462cdec1936b414e98252530d3a67eb57022a9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 37.3MB
        • SHA256 d4fd1bf8d3ae2021b8443ac1c0da35456a68545592adc239608b94a87a87b574
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 37.3MB
        • SHA256 b0a3e15ccd563137ffbad6d95dd22a64235697d7ac33b965ef0f980d1fe39668
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 37.3MB
        • SHA256 cc18e769556c74eabe9bb48ce0d3087181ffb5434e62890a5046e4eb9f9deb08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 37.3MB
        • SHA256 f3f6bb02435f039d6eac616d0f4a4690225d1e92b35c49291cda562446ef9e56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 37.3MB
        • SHA256 1d2aef594854c507c38c1efd3efe565774725ad2502049b2a619fdbb349788dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 37.3MB
        • SHA256 0536f410735e44c945d99aa5f4ae7777a25030d9a6da82f2703dbaea86b947fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 37.3MB
        • SHA256 b6fddead0443cb623afbdd3dc79802e982713b98ad7bf863c8eab999b1a49588
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 37.3MB
        • SHA256 3164ab7617014481cd5fabf32fc729a5598e423ace918f37cd173f4e99c1ee0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 37.3MB
        • SHA256 8345b3f2462ccc7deefa6a114c8a5ea49b3efa8697ec74be56d275dd7a02c3ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 37.3MB
        • SHA256 d589b9569ab6bcde40395a0d7e77449d587c7a3e9d6988781abc8ff613b8bd22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 37.3MB
        • SHA256 013ee34ed28b712819a1bac30860f43a65a146588e9d8fe24cb3799e80432ef7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 37.3MB
        • SHA256 b11794e36c7853b8d34b69be10cdb94dd14c00b9a99deb4019a96293c146e6c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 37.5MB
        • SHA256 3d12fa991a053fe032a72ad2287f91f035c58bf207763545a8d49b024689ba3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 37.3MB
        • SHA256 da96b0e252dca60f0dbd2a42af3d92734a22d5c98a45ee4968a3c2f8c292ddaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 37.3MB
        • SHA256 47f86b9afe3ba811d7821f764a4a061a533d5d567785015e16af986783d28ca6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 37.3MB
        • SHA256 39c72e267199838777495ae0d8aa2068c55acdcea56583c482454be9e5583c64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 37.3MB
        • SHA256 e4d5bf540d0c3b5543acfad2059763684fdadc8a10c91732fc4cfc4b029493b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 37.3MB
        • SHA256 327bb7c07326bddb23d71a9d547e913ded9cfccb53e3faedd44ff2c8c0774a6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 37.5MB
        • SHA256 40fc2d1e89b372626c2c3713b7f7435dbee8b04cbc2954b6a8f8867be0e92f2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 37.4MB
        • SHA256 e9188528993d287bcbb5414deae6426c3d04e5c171a880266834fcce53b4cc5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download