Overview

overview

8

Static

static

3

2026-08-08...r_.exe

windows10-2004-x64

8

2026-08-08...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    134s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 17:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-08_8435c7585d126479899f76ed15fb3377_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 9.3MB
  • Sample260808-v8q1xaef96
  • SHA256 0e9c59350ba0c41772bfea51d3638ffcbb9516fd49877c3d39af0e479be11cf6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_8435c7585d126479899f76ed15fb3377_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_8435c7585d126479899f76ed15fb3377_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4456
  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_8435c7585d126479899f76ed15fb3377_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-08_8435c7585d126479899f76ed15fb3377_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5052

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 18.7MB
        • SHA256 8f9e65b21dc1339182e35922e8837758d255ab33ad8b5c8ff0970295bca76432
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 22.7MB
        • SHA256 3f094ddf1e468ae0c523bc845c71d16ac7f5a223b53b1a6d988afc2c8918672f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 19.0MB
        • SHA256 d50769490b3652554ee16469d4fbb6cfbe9d6d5a01cae99a16f09f1cb3b96979
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 42.1MB
        • SHA256 1a958899d8bdc707b53b27701643098ebaf8d0cb805f094962d39f101bc78b8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 11.4MB
        • SHA256 ad9ad36e2f567d1e6f659e614b8a9ab8afbc1420bd26a8a39bd1c767e370772d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 24.7MB
        • SHA256 d82f3fedc12d8c50e42bbb1294ce348d6895aec0ea2863d98d9e6de478a65f85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 20.3MB
        • SHA256 3534578a3e75c9c19e675fe7463ae6188ebf839f9fb50a72f8673de1214400e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 22.1MB
        • SHA256 3c3430b3b30f459832ec03a306f953b2550984aee65110b724d2c5c7bd4b1c34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 20.9MB
        • SHA256 01dd4f3b09ae2aa946bde9a2dfe561f980365e0dd3387f589c2abd7f6e3f9906
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 20.2MB
        • SHA256 bffeebc396f75a445d18b93059a171e43ef279d4e9c3c86f903dcb9b9d444a17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 20.5MB
        • SHA256 0e0a330acff98589ab67c2e03ccd99f650454081ad122d4e6cae1718896bcb72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 21.7MB
        • SHA256 521dde3e34ca3eb589785f616d002461077cef661cf8650c2a53d25a2ad42bdf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 20.0MB
        • SHA256 58562607711302928d0578fc42913535181f0dd0406dcad76a6491a557e64759
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 18.6MB
        • SHA256 0eaa30e34aa825be30291b4447d5b1bc9a79f4c9f426d5fea0c1bd246fed7601
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 18.6MB
        • SHA256 b4de24d328ecab94ddfe7cc1cc075aa1a8ccc290366de40942bf0cd35f14a845
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 18.6MB
        • SHA256 2af6382498da3f9865a33fd7ba941f391280aae8b69e4433f8162a6a652189bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 18.6MB
        • SHA256 60595f7e0f2d121b417f516fbe54877349c12f0a744de40deaf7d7675a9f2fd9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 18.6MB
        • SHA256 417b58731a66f65b775549775e3ce1bb0d67b9451a33b806bbbdba581c5318dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 18.6MB
        • SHA256 658f145f983ed5f12a408491eb22345e062da4d9ce9cd29db5a018272ce72afd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 18.6MB
        • SHA256 7a58d271a23755e09bd739260001990a4a6f653ff75dc745f22faa92ea4c72fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 18.9MB
        • SHA256 112b888b2e4fc00487800aac11f9b727e724a9595c2994a71c7a5e0db601d9cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 18.6MB
        • SHA256 3d72071f24c8568eac96f27213589e66329af9000208c1fb91238b003607ca55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 18.6MB
        • SHA256 159b0574a705d2aad9ddc76174944bc7e4f99dc107625e506a6e8d4fb0a1e787
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 18.8MB
        • SHA256 de97552b172d76f1b86645407667dbdcd5cac08b6e89d1cdaec78788e8586c5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 18.6MB
        • SHA256 1f22f3a735244183fd01b2873c78d47ade91f66f25d61e2db348449d5fb8d3a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 18.6MB
        • SHA256 017d31c0012c45c7f48f59e0bc860bcaff382d2ced7171107566559973364f69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 18.8MB
        • SHA256 b99dd9edc9a32d68d24a9dc5ac6b335c85db055386859159920536b84457f721
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 18.9MB
        • SHA256 703a047987685664dc8eefe700e28a391be4ca1a5a0aec52a73eeef7cc5c543e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 19.1MB
        • SHA256 fec4186e45f6334b2c150f68ffbb8614dffd27c9f2aa19e66e996152b2c1c7d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 18.6MB
        • SHA256 39f2e1bf612a7210e38e4f0ca2cf84de60f51dbffd09ff73fcb93ecee337a50d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 18.6MB
        • SHA256 e2882cca5d29b5942471abd569ee22c2d5d863ee3fd758566a4d73dc294b8851
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 18.6MB
        • SHA256 28855bf8e8e154d4e1e9c1c352b0207e6e8b4e83161e0b04ce2ad9b3fe7871ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 18.6MB
        • SHA256 89f909e5038ebfc69f168d36dde543fa6a8f53e3ded815e39c6379d3b5f58ac2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 18.6MB
        • SHA256 fcc576e12927b01ecb6d739e2637d65b358cec34c41aaec63df21296a8909b71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 18.6MB
        • SHA256 0226887fe4d52513f3573e872a1e5ffc7f7bbbc5a362452a9aad900b5d8159e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 18.6MB
        • SHA256 6c6a73bbce7e8cdfa415402aae0118391bace32ee1a2a2eb5a5d3ed74a3e0c12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 18.6MB
        • SHA256 b77c41bfdd544bc35a58cf858fb00ab63c9139b9f3c2070aed46d6f4f3bc00ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 18.6MB
        • SHA256 96b99b8be0c212e77cbe2b681f1d1e95120ab4906dc97236ac023a6eca511c7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 18.6MB
        • SHA256 b92602d6da9e09cd6f2349e2954415d66c8bf27f48e107dcfa1e4db7f821fbce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 18.6MB
        • SHA256 38c3a5712f7bfdaf169ddedbf903e5ce5861043967409841ca853308707d9f92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 18.6MB
        • SHA256 ab0d7401adfd71aebf7fba28a921dce681ac64a6146acce72b006c273541676f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 18.6MB
        • SHA256 7ca2faaaf9f54a18d87d0b96e9a951d1aa8050c05cf43fe25a91ed15ff102b59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 18.6MB
        • SHA256 1d56ed4ada2bd32d91d1811fe00b41826f7c3a96a4b91bdc61b19108db189b6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 18.6MB
        • SHA256 ec348de8ead82805f8b468223880e95a649c93bc2b0af01330e3d93e9d2f6a96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 18.6MB
        • SHA256 fddd7fb5d608eeabdaa9ced04f0aba22cd2ebd9e531a16cbcaaea859b904423a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 18.6MB
        • SHA256 8572a8134ef2e1b633009086cffed95c028e5387e292d44007675275204d29a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 18.6MB
        • SHA256 f34e8a60688468a291cae0f405ff1fb6e27a3c1e591eb4d7eb3b45b909abfaf2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 18.6MB
        • SHA256 8c83dd4aa29f8cef30c92f4187b2121b42c3243f2dcee077f605a5cce1fed5ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 18.6MB
        • SHA256 af4f6fd199516293dec6ba336e238cf37d7db21f3bfa2a1587ce3072c1c0b366
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 18.6MB
        • SHA256 1b30cac23bc84d58fdf489a20a4862966cac0b803e02cab2daaeec3c84c09d2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 18.6MB
        • SHA256 3a32b0fe5fb2f4981a43ead45ffa1579e3cf6c048487c862a1f0938c77133f88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 18.6MB
        • SHA256 8390aa964934f3364a8974c8f33da325ad7f70c4a06221ec7b1ea8fef4045415
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 18.6MB
        • SHA256 e95e8dd1304b024a9c846d28ef6183a6e2ee15f94c0d88298aa88fdab120dd9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 18.6MB
        • SHA256 3f92bb79f333626de9f6413a44e5465b56769ee3716ada209cd01ff4df903828
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 18.6MB
        • SHA256 6e39761b1dceec246efbd9b1612b2a38a32226501c66577ad688d443d274ffed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 18.6MB
        • SHA256 66023083fa467aa627033d67c9beeb2b1351b50ce7b04a95d0967d0a443ef087
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 18.6MB
        • SHA256 ea2a539519ed0336f518721756d5fb15bbf4aa6c0ee8d4fbdc6cdb42c15b895c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 18.6MB
        • SHA256 fac07053db9c7f5c5f6000552ad8eb71e8a4ca2237d5eb5e43fefdf21d9e31d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 18.8MB
        • SHA256 b479ea0a859b54a6b9fd4f77a35e9cac83473432cd0675379df123622accf899
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 18.7MB
        • SHA256 f3b34facc50a6a77611ad404ca05d5b4654fcb650065d0ee4b05f4b6533881d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 18.7MB
        • SHA256 7e526d9df3cd5d902ef54f511b8302d2e6cd93b5e6edc9897363bb17ce0f6b98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 18.7MB
        • SHA256 a2b4d987f87a9378f366d6f17098548196d0000bece1c61c49cc618a2bb8c458
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download