Overview

overview

8

Static

static

3

2026-08-08...r_.exe

windows10-2004-x64

8

2026-08-08...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    140s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 18:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-08_09e38dbcff09dff42df2cdb71957d56a_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 8.3MB
  • Sample260808-wwlfbssekc
  • SHA256 bdff3d572f074425dc7b2a4d990365e0ba72a6b4cd2d2b578244381e387bbfab
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_09e38dbcff09dff42df2cdb71957d56a_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_09e38dbcff09dff42df2cdb71957d56a_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5048
  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_09e38dbcff09dff42df2cdb71957d56a_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-08_09e38dbcff09dff42df2cdb71957d56a_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:936

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 8.3MB
        • SHA256 ca7277b409b34d429ad05891d69e988f75be3ab90e836e6dff342a93cb90ae5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 16.9MB
        • SHA256 bdbe890da833e948bb11e5ca45f37db2f728c2bd191a39e3bf0ee4865219dd7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 16.7MB
        • SHA256 3482efe10eb7ef259cb77bb6f2ca8156ca6f90f3bf2563b88246164cf1faca6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 20.8MB
        • SHA256 f943348b0eb6786d1bdb4a0d0daf4440520558154ee9a4c2d9f0557ca91a197b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 17.0MB
        • SHA256 98927684ed5a1cf80b6e8b2c55c48240d0dd3f9a13e257603cc628849ceae185
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 40.1MB
        • SHA256 e84b4ee787316c194b515d44ee911bd8dbe830475a0864dde9b93a41385d4b36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 18.8MB
        • SHA256 e5468d5bb3aa215ebec974d65dcfc1e44547b18e43d4b19afc68604982fc8ff8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 16.8MB
        • SHA256 dbbd1175b0d7510d056edebf6c86085c20a6a848c83407631cfc713c36f46e9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ConvertToInitialize.exe
        • Path C:\Program Files\ConvertToInitialize.exe
        • Size 17.1MB
        • SHA256 e83748038b19b6fc1611a084b009411c4732b8dad23d11e360bb378d3301d2c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 22.7MB
        • SHA256 ec44069fe7d337dff987806f0f012dc35e9a5fd163a1c398fdfe96e7756d1432
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 18.4MB
        • SHA256 56ed2053fafab41e824549e694decd55d5fa4e3e2d9ca932b663f78e50d34170
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 20.1MB
        • SHA256 3d610fc9d37972753f1a6f266c21dff3fad0b291e2979e1f2912a16c06b3c6c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 18.9MB
        • SHA256 9494d25bfc99f1d6591a701db8e2b725c169b16fb4afd95c454b548f4edbb7a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 18.3MB
        • SHA256 d86f655ce416f366aa8092084bb5ebb745743cf754e80bae7f12b35fec919697
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 18.5MB
        • SHA256 f8ef6801665aa427d2e8c9b2a1ebd01f3fb5e0189824e28a54ee2ebdbdfa91ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 19.7MB
        • SHA256 2312f003eafc0e3a52b896bcf9b48362b818580ba66a3922e5cab2bd9a0a1486
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 18.1MB
        • SHA256 1da285bc11fd23f187a0bebfa43f6943c64152cfc647eca53824322c6be58b41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 128KB
        • SHA256 e52488a8a3c5c15a2f928eb2127c84d20ca0143b2598bd3c627a271a6a7a3d72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 16.7MB
        • SHA256 23f4121aaae92dd200c2c1c94635880bcb5584888ceff56d1b79d32e4f2cb910
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 16.7MB
        • SHA256 95ede797ef1ab624532f44a52decd0ba9067ca5184b9548a5c9b54258a7e8c7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 16.7MB
        • SHA256 e91ab3065efda944e2f530283e753c5b91f3f1674be55c98e801658b37a54351
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 16.7MB
        • SHA256 b3940e4620a24ff92357de66e3bf97966cea3bb9f1b34a4524c56cd6720c447e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 16.7MB
        • SHA256 b986850149914b00f69623ef978ca2785f4d3ce5387d2e4de43ac3dacc3e1f8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 16.7MB
        • SHA256 d37f31ead2b5b930f07eb757f0b09d5e29598a7ad48f66a3eeb3a96ed3be15e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 16.9MB
        • SHA256 0b345643a7dbb5b751ed8d6b15f8f5a3a8da8a057302a7597106eafe80f977ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 16.7MB
        • SHA256 a7069e17bc20167957dcce702f0f3e6fbc5689b404c6626ef9a2b21528fdee3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 16.7MB
        • SHA256 dbf923688315683714993b4c60357fcc22dab2d230152de9566b38cc6511b1aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 16.8MB
        • SHA256 29cc0f3c89335f0bc61c35481b402dd0eb5134dc0dfabab6d060c7e2a3b9f467
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 16.7MB
        • SHA256 97d5d731ccc8ebe452efeb21c8ebbd71c2c20079b8b695e48ba7a1d60b0384da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 16.7MB
        • SHA256 c768b585278d8d3c225fdecf0b3e9219d59bc1d883c880794b8bfc630d7aab52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 16.8MB
        • SHA256 f1d72f4f9adff78cfff1362adabbf3cdbd6611b6e9acf840cd77a3122c45d803
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 16.9MB
        • SHA256 ad25d720b184ebf0a020725ef05fe9f8f3260873db613799f5cd0e79d7bbcbae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 17.1MB
        • SHA256 955083e86223722d1fd4dc5b0b206f0f0e2f75aa4249bbcedd8df25fa0309661
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 16.7MB
        • SHA256 9d66f93fed48e247941675f0f41a7cc68bda0fa224de6cb0fb5baec13b764847
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 16.7MB
        • SHA256 dbe335da6ea7dc9610102073575def7116036f34818ed4f3cafe839e663c0973
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 16.7MB
        • SHA256 f01494eb03f6703db4e8b03110f1b9f88aedcd73121403d9c38610f5618eba67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 16.7MB
        • SHA256 5dbcab65ebccf342a9d95e5f72b095d012b801ef44206885c0a4fec5c3db2de9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 16.7MB
        • SHA256 d7848e1aeed81f73b815362b3d6c367f3f3f5581eb641e1a4d33ab28298d5113
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 16.7MB
        • SHA256 84cab26c0e73345434b34c79e07902f4c110176ff2d0f074fea36b1cb389cba1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 16.7MB
        • SHA256 855a7fb6fa30b63b08f2f4992b89b5b2b3a531abd60d5498772999ceb57fcc05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 16.7MB
        • SHA256 7d8dfd013f2a94ebcbce33c4e1d3504e8690f950ff9b42de2dbbb3dee4368fd5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 16.7MB
        • SHA256 aad01638ea6873ded2e710fad034c7eb6757bf324cf92996a6e194707cfdc858
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 16.7MB
        • SHA256 92d95347735ed005014b5f988a9e5592f8ae0eb99f2101adcab4749eb776567b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 16.7MB
        • SHA256 8c5601d20e2cc0003a25266486c3cad3e4f419390eb8aac15556a8a99bb6099a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 16.7MB
        • SHA256 843dc2be54df3b23901f345e44aa19d92790709f6689e9a795cb65aba00e4552
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 16.7MB
        • SHA256 abbb503c46f2ea1c8dd2a2606d18467a7c07c14f65d2f502bc531cee12588308
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 16.7MB
        • SHA256 11ede86bee05ac16f049348fc325ef0ed4dd455b08b7e5573a2201c7d5b13cc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 16.7MB
        • SHA256 0cf0ac44340bbd877a15bc2542e8bc15430053b99788f3f72055274206a5f278
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 16.7MB
        • SHA256 4f518242e8eb1d58c033f822283751974845c1dd8a24c3dee89dfe7a39ef2a06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 16.7MB
        • SHA256 8e563587f24707357d26ce67c9d09a6bf709bf1c90b3243619de6ec5cc9a3664
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 16.7MB
        • SHA256 07dfffd40677b3a5530abc12db81c6d0c37479e17f778c46bbeed8c7ac991898
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 16.7MB
        • SHA256 74861f0286069caaa0580df93adf78999e4d349391448048cd75e2971a15a5c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 16.7MB
        • SHA256 a5575e1d846f5af5cabd0339630e4d175035b102148c915e9c7ff546aa806f59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 16.7MB
        • SHA256 73b985824d4655f2172db799e7386ed4375361a2bdf31c5cfe2022ccc68b5c4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 16.7MB
        • SHA256 46d0153e4f29f88925b6a996e0f060f8ed27de6b319a0d58b48ac06c4ee1a09f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 16.7MB
        • SHA256 a23c0c212950436a7b1766b41f799a5e871a5135a9f02b879e26c00c2cb571df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 16.7MB
        • SHA256 0d79cdc2f24fb61d77cb890a7867bf917cbce1ef6c295706a944e9e3542617a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 16.7MB
        • SHA256 f4e04527a35fea3fdc08bf220a2c5847582fc8cfa8bc2b8366de718b046140fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 16.7MB
        • SHA256 87147827b50875979f9ad4af81886eddc4a03562e0bd811d5ad4aab2d33e43a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 16.8MB
        • SHA256 7fdb569b0afb92d3aa963854efcc5154d0ddc56fada0e182125f8ba2d8f88ea5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 16.7MB
        • SHA256 f1af78952a8cf4806391feef7f3e70225f9884a1b055d000120d20be1813090f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 16.7MB
        • SHA256 305ab4fb05da546094b52511ea4e03bc5a6c89174274990e0ab5bec2f5638488
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download