Overview

overview

8

Static

static

3

2026-08-08...r_.exe

windows10-2004-x64

8

2026-08-08...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    61s
  • max time network
    128s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 17:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-08_5a96e06b6e789539e979fea2eabd4d1b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 27.2MB
  • Sample260808-wfz9jswtfs
  • SHA256 f59b1554677c9b739e4ada0462909444c9ba72082ad729b5d052227155a5e73b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_5a96e06b6e789539e979fea2eabd4d1b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_5a96e06b6e789539e979fea2eabd4d1b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1308
  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_5a96e06b6e789539e979fea2eabd4d1b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-08_5a96e06b6e789539e979fea2eabd4d1b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4148

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 27.5MB
        • SHA256 6ae0caa51c4ce7bd7cb8734a775626542b8bff6407fde18e630e5d63da947a24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 54.5MB
        • SHA256 00763512081e9c7ca64495a860c2d66512746ec7a28acab4c729297feef0c433
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 58.5MB
        • SHA256 e411d54fc141937c00c24939d629efd81cafdf2335fa379209194bd423108bae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 54.8MB
        • SHA256 12ede12d68bda9fdb2917ec4a092c2ef84ab0915ab017f5e0355933bc91f54fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 29.3MB
        • SHA256 80eff8cdd7489201976f834cf982a00499e194225d64760c18d6868663be0482
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 54.5MB
        • SHA256 563811df30acc500401367995252bc1ed0807cc757e73b698eb9c499a949cec2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 51.4MB
        • SHA256 6743cf1db030e52c93d6ee9b4d9ca03888814fb8b7f3bd81bfc55df3e3f65f6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 51.1MB
        • SHA256 d374ff66164ecbcbe03d09264a2d0d99370deb5f7fa8c6bafb91c54012a20a79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 48.0MB
        • SHA256 2ec5a6551c5e8631577ac331eab93664f4c5fbf28b948a4947c850ba50ce4a03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 48.0MB
        • SHA256 6fc8c09d51802391ce690fb26e7333d34781784ebfac05d299507e9a048e30fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 48.2MB
        • SHA256 677e15713e1478746628c5f9d136d2d1b62a7c8dc35496d816a22b61420ff71c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 44.3MB
        • SHA256 7998028b314ba0f6d93c39aecf7822b850881e39ee7a02530dc492744f3c6582
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 43.9MB
        • SHA256 3bb7c2345d14b0ad7afa313b023d2a07347a5948c6fb68b37002e7d9da5b8d91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 39.6MB
        • SHA256 949cdee39a81dfd13f0af5c5193d74f15641c38b7de61f7ca5a417fb3c9577c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 41.5MB
        • SHA256 2bdeeec609f3dda23473fa60dfd58424ccfc9fc65e3be7c9a23bd59fb9fd8c32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 41.4MB
        • SHA256 4ba34ad6059000eea78c136bf80afb4d61c65189d5737f8f34b037aef09f035e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 39.2MB
        • SHA256 24223cde6f163fdc9219bffcab23264c2bb7b82b23aa8388770dbcec0b213bff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 39.1MB
        • SHA256 85fc4696c3f373a091c00d44f17ebac14252ec81e83c3155aea9c098e686b1c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 38.1MB
        • SHA256 4117ac1c055064c534fa380e08b0e1066478c84eb3dc08f0db5dd6102f172d2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 37.9MB
        • SHA256 521bbb4d1d9180a6fa2a27651112d5f3e47a5e49c90cccbe6437e814c64c9fd0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 38.7MB
        • SHA256 180de962f6c9d7df9d5420663925934092785e80c022c8c0fa3c3bef7c4e66c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 38.1MB
        • SHA256 5cbead6fd6dc753210e1f432c61f1329d4ea0eabe67520a3cb9bd86bec1333e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 37.8MB
        • SHA256 c4c7e34058a9da926e10b6424025151c6b07a3ac20c6b0273ff3a0533c4adb02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 36.6MB
        • SHA256 850931edcc4f1175ce4abd717c165e538453f5afa3e8510337ca52c977270a23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 38.2MB
        • SHA256 81cc657803674bc5029b0be4ea2b114b8e02deecb2ddd59a46a16473910cb0a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 37.2MB
        • SHA256 232f433b3d10006ffc5dd66878d2618d26248e670856b47ad73f855f98c2a659
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 38.0MB
        • SHA256 3f091e128c9fe5e1f6bb76bd2a11a6382180f55d898cc8c78e8b3ea2c3d989ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 37.2MB
        • SHA256 c9808eb747a9caf6fd207d64be5b5b7f05af378bd217487b6a42e524d43b39bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 38.9MB
        • SHA256 9a148611d0e9e88da27046b3c9fbcdb745cec34c727d6f017925c74d38dc486a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 36.0MB
        • SHA256 5132ea373850fe8ede57ff5e9071b04c3710b4fb8febfb16324d33fcf8fa8292
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 36.4MB
        • SHA256 1adadabf5cf42e480c9eebc7f0051755d9c7058036bc8afeb1c286d3230da0f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 36.6MB
        • SHA256 19c3f4079839d2140c45bf984c9f7034a6fd6a50f86f2362b6bdcdb966236287
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 36.3MB
        • SHA256 1769b4517e6e53fc23866fdd85178a1698836edefa0db62a63e393854bab3d7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 38.0MB
        • SHA256 7d92420ae13928158f56cfc2cb2401fb957ec1b0321432a5ea7626573cb8f51c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 35.5MB
        • SHA256 c87ea196eb01aaaea8c32a705cc455874c5bc159642d30e4baf57a41b1a54035
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 35.9MB
        • SHA256 b8d0380af27daacbe4f90de0769e91985ae04d4917f1b4342213d75d91d96f2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 35.8MB
        • SHA256 6c41806f6da6a3eceda980a59a71e2504069fbc92ac8723f042eb028562e9e56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 54.6MB
        • SHA256 8e609c0b13cbf8c61cfdcff437bcfcd62753eb0421e8d860a035553a4476ed86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 54.5MB
        • SHA256 85f7651fb7fcb4a30e238c52491972dbdb7e1bf27abdcb7f3dfc8b7e237cdbb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 54.4MB
        • SHA256 8955c75d0c5a00741f36cb14fd89c3a77f70379e9995cb1017c3735e3918beb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 54.4MB
        • SHA256 972b5a843edbda49e6ca9bfe56b39ee8b7b0d08535b3ea7a41a18f073a8d0d07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download