Overview

overview

8

Static

static

3

2026-08-09...r_.exe

windows10-2004-x64

8

2026-08-09...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    141s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/08/2026, 13:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-09_9d348d86696c8bda4ba7280734c994b5_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 14.7MB
  • Sample260809-q9lqcsstbt
  • SHA256 674e5eff500f392d350076e0c5234b836477079cd80d1285a78d395af56bb8c1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_9d348d86696c8bda4ba7280734c994b5_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_9d348d86696c8bda4ba7280734c994b5_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:924
  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_9d348d86696c8bda4ba7280734c994b5_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-09_9d348d86696c8bda4ba7280734c994b5_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3136

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 15.0MB
        • SHA256 6363643b045cc719785093159dbaf7a6f024dd847be6aeb2ae5ecf52a00bbd34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 29.5MB
        • SHA256 a40bc17d3fc02963272bb9ee4bb9a65f0ccc4bb657fe5e96d657f0f6460158c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 33.6MB
        • SHA256 b6ee409c036b03d26c17af788b1ca11b6f2368c8d01e9aef51654bf67a0dd792
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 16.9MB
        • SHA256 a591215f1c30704f1540c77cbebf46214622ed4f8f555bfe46fb6da8eb13cd2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 29.6MB
        • SHA256 00dd118a373df9db39930ded488dd35015d3942a3d964b530e222b2e78ecdee7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 35.5MB
        • SHA256 e06e9afce93a45381a0267b4d80c2165f6bc263fab9c588f02c195a64b2b7dd3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 31.2MB
        • SHA256 70a89a3b62cd6ca7d268a6bfe17d78ad570b3d08af6cc76b3a32e9069c464566
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 32.9MB
        • SHA256 3905437a949c5120082f108c285763cf2431e2e921a1ecea41a7462f00bd2fde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 31.7MB
        • SHA256 8e88f8152607ae3078eaa3c0cda762a7ae2a3cbd971ef6eb974797c7423c0387
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 29.5MB
        • SHA256 545e0ef8af44f8ec6304a0dab9a465d572e9ee2ed2295c967c55c3011a152275
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 29.5MB
        • SHA256 165d7453510b5b4c77f34830f0bd981c9f9170f70654d5f3def8c940ea844d6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 29.5MB
        • SHA256 fb01b5aef7a8af19ad319ece74786fbfc24c6ac402e383404bbf6b5961fcee3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 29.5MB
        • SHA256 cc90a02ae7bc6107e53d47c11d278bb8ba7545d66ec3444cbb4e4850e3d2061a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 29.5MB
        • SHA256 34e5da8baa5ac55570af1f610fbc8dda6fc8da57b94eea419eab4c8a33af06a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 29.8MB
        • SHA256 846478dec052055c9c791d4cc710092a527c92570bec0d1ddc77e9a74ebf6dc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 29.5MB
        • SHA256 a4f4b314fd9a71b44481e384fbd5c1873b019f36a20812308bcb78a40f6782bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 29.5MB
        • SHA256 934714c48062c9095328ac080cb47d14c6eacb564f1e08bd731fef20596546d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 29.6MB
        • SHA256 083e9ab0842eb93236527ec19f3cc23eb16b0bb319032c76c53a4d7a95c70cdc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 29.5MB
        • SHA256 3ab1c4e02c2f94a360c9e88cc44ecc08ca20122f08bde15e13fa0642d38989c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 448KB
        • SHA256 30fda89260062596f8473df15f576de632ea44d623bd575d46ec46d32766b91b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 29.6MB
        • SHA256 e6010ba12bb7f2062d7b1a7d5e3f0d96f41572a53911f6c38320022bc8f4e4c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 29.8MB
        • SHA256 4c56e19dcc58aa366c81e32066f36a62de439723c82a4fe85f536cc97e3ad18a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 29.9MB
        • SHA256 b69509445d6c74c1b80fe6a0f609b3a55b780a940bb72cdd81455280b3dfaa09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 29.5MB
        • SHA256 586058644fe431afc2241924dc4b338c3a22bdb912613a2679e0ab4b70f5da71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 29.5MB
        • SHA256 5e8f8884a0ee7511e086cefa05e7052555cc454150ceafa3365b4deeec7a0ed5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 29.5MB
        • SHA256 6b8281a16331faa7de4c28bdea9104c605debba5e8723d8cad5a3405abaf265d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 29.5MB
        • SHA256 6e935db71b87395f9c4e26d0deb8bbfb75e3ab251c5b15e9dc1736ec10c20741
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 29.5MB
        • SHA256 f0d6ffec26e122303dfdab9aa54de942a4f606774cda41500c63f0b284cd82bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 29.5MB
        • SHA256 aacc8a40d3fde9a3d229faec236ea09a9522fba0dda99e5f43244740c6c8a7ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 29.5MB
        • SHA256 1bc4252b6ba8a1ddd8cbcf582fc84906a057c39b9a5c1cd2eed183d6497008af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 29.5MB
        • SHA256 3a6727dfb4536f8b560faf927e3e882061d1d23b73dd7528c04e9d9520405522
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 29.5MB
        • SHA256 aad8b7d8dbab8a61c41db05432d718a91db1442246d2c0e45ba351380b17ec72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 29.5MB
        • SHA256 3ead9473feb7972d2a893b2987e23d48d40883fef8a7c744aa3b75c4ceb8708f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 29.5MB
        • SHA256 5998394ba879c45e40672e37b6b7c57f9c51ab0bdd1dc189264f4e613b765ed8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 29.5MB
        • SHA256 255cab5852373d38e194fa4e68bca7a416722d5bf6d86f136422c5a796d053db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 29.5MB
        • SHA256 cff9799357ca39f7445d321773d5a2bc1370d02dfba6347a7c336c5eb6647433
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 29.5MB
        • SHA256 2c7234deb21ec6c88cc94a56d9a051de94dff2f28e9ca5eeb98bf78977bd9eda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 29.5MB
        • SHA256 0eb5419ea094c7d23b94d7ad93d84f6feffd344ab17818b346fc7e7c25052e09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 29.5MB
        • SHA256 c03621f3c843664404a1e556713cd340835c9233034579ba3845e8371846e4e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 29.5MB
        • SHA256 8decf014e4b10f8600f4da3d37243788a5e06f35f8a3111570e53d388faa7540
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 29.5MB
        • SHA256 864ae6733afda1ccbe094a136d1301bf39fc1d5a2895b0edc08c946a5eb1c22e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 29.5MB
        • SHA256 5f8b98f9ef5e981f9433bd994e9661c009fef65b6df07b9b23915ea500707215
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 29.5MB
        • SHA256 b61039c15133d6b9a13c49dbcb84357ca7baa8bc0adbbf3f4bae4f92c00f5c4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 29.5MB
        • SHA256 0bfff6366e982f751e4e0d8856c806a7328da3e608a7ff59db6fee37bd7dea6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 29.5MB
        • SHA256 c2e30617ec09c54ec365b4ae71d2cbb03ae323933a7cfe01cafccd94cdda4603
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 29.5MB
        • SHA256 4f58e3192372479c17ee8eb0df703ee43cad55133115a3f0c0500a15b5101736
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 29.5MB
        • SHA256 38aeb62205d0e6e6606eaf75190be65e4c1511140ea6fb3130661ef8bdd35bd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 29.5MB
        • SHA256 803502647d4e8521be51e8c42db38bea281be54c252f81b904506f79d3a7ac3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 29.5MB
        • SHA256 543e72871a70028d7f78f00bbe73d5bd18a0c9587c34c2ea88b82f76da96c236
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 29.5MB
        • SHA256 b86b6c7287273aa803894ecfc6a153a4193c6f97d9fdbd1fe1004b18d84fa66c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 29.5MB
        • SHA256 df068d9f34e6b8f35687214592b0ea138f76770850437ddb65ee4bbf2545e876
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 29.5MB
        • SHA256 f2c3fb164d26ecf8c9d9fdbfd4ffaa484cb1ad4d81ba3495d61adc28e525c80d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 29.7MB
        • SHA256 f8866b4d1bbd6655612c671f3db3672e46ebc9a55de1499793ce2c659d1256f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 29.5MB
        • SHA256 3c9595b4a334cbe9b5bcb5252bd981a9a8b4fa8384372aa07903563918f70400
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 29.5MB
        • SHA256 ff2c5d4061c269a8a4223efe941623f90a07763111a1f0929bac0eb2706c6c20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 29.5MB
        • SHA256 dd58a3191cdc0dd1dba5bc9dbae2aac3b4441982eec95dbd58073c4a2c181298
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/924-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/924-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3136-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download