Overview

overview

8

Static

static

3

2026-08-09...r_.exe

windows10-2004-x64

8

2026-08-09...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/08/2026, 16:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-09_b02db2e39b4ec460ecd7b6e5e23b0a37_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 16.4MB
  • Sample260809-tmq84st1as
  • SHA256 75ff70d2d193430c14c692f06908a748797b9a53019bed5c7974249bc7c7546a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_b02db2e39b4ec460ecd7b6e5e23b0a37_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_b02db2e39b4ec460ecd7b6e5e23b0a37_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2744
  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_b02db2e39b4ec460ecd7b6e5e23b0a37_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-09_b02db2e39b4ec460ecd7b6e5e23b0a37_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4744

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 32.9MB
        • SHA256 3da5fed9efff830df35fb19baf1954bef4f6346dd96b0e3e24472164954ca592
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 36.9MB
        • SHA256 fd87bfc63c684b01bc92d812b4d947a95837f69551002516cde590fb41fd4bd3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 33.2MB
        • SHA256 dfbe800fad746f4d2086eca550eb6cda4db1feeaf61ffc00645ef3aa5274ddae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 56.3MB
        • SHA256 da3c7282c0e056d420fe3c1c6b7eb5cfee3c0fe52dda1dcdb88f2b63884c1ad8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 18.5MB
        • SHA256 a162b6b270e28014ea9d1848146a58b3c3617fb78a9731c3d4cd3a4aaace6e32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 32.9MB
        • SHA256 0177014356bb35e7b16430cdc96ad8c839c44fc98c1052b08c1fb5e494314f60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 38.9MB
        • SHA256 03538ba17151a0810be6232fbd763fa5d4fffdd5b55e8ed2555491698342c594
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 34.5MB
        • SHA256 1391531b24168b5d15248eab0d66fa73bbdb47fef8788256645b3c0c10eda557
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 35.1MB
        • SHA256 d492bbd31cef2424d5c0517c12036e168ded18eff1c16833e2672b011ed216b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 34.5MB
        • SHA256 705d0ef3038841059e1af86e1a7db6049a0713ac050d8b1a5bf343711ce64cd5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 34.7MB
        • SHA256 45cc25182824688864c5cc672324540be495a1e67f1b219abfd0fe9d5c62ac35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 35.9MB
        • SHA256 0f45840350f6caa2dce842af211142425e0add5574858b5a54f9772313421022
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 34.2MB
        • SHA256 1a5b4fea12fcf50140de2c2874cc90f19c38ff3ade3a7c7557afee737838ddab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 32.8MB
        • SHA256 f01df76477e331d3f2a275c90b14efe93b7c65a8be33e1cc850e3912e3c36f35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 32.8MB
        • SHA256 dc27307f164921eec22a444e307cdec8898692a9c19cfc1f266913e0df2370ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 32.9MB
        • SHA256 4daee08162ee15fe0894556bb3e7da6f17b6db52a379519b97ed96cb71855c5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 32.8MB
        • SHA256 66b046a2db7d198394b29ecd1a63881f81e9be4b9eaf6991ccc98c06c6d71ab8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 32.8MB
        • SHA256 27b659480f1fe37a8586e20824ad45c85d5a78bef4c392879410eccf01c9f927
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 32.8MB
        • SHA256 5283ef8fb554fa6557bd6370dab8c2b0d8180ce5dfcb80dbad116a0f19a25f97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 33.1MB
        • SHA256 c2e3f629d7f9676a3bde4932523501543515b3e14b16c11d03b1a0cc6cb93cfa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 32.8MB
        • SHA256 73947c7888126e4d51c2c8795b06167d54e87850996b6bba820dd2da1decd544
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 32.8MB
        • SHA256 07d2c1dec6aa79dd4fe24e29a78da6a1848ea51a69a1029636be53db42572e2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 33.0MB
        • SHA256 32144c3a3dad4fc75f7acdd2d4bd9f4609de15471b82cb422c9e03be7054e29b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 32.8MB
        • SHA256 f43a57a87865dfb613202159bcce4e2d005b46520948ddad1f7099251ccc2f5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 32.8MB
        • SHA256 79fd650a258fae3dc8281e99d98b6d94437c9e7abadb16fef61a82217b1133de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 33.0MB
        • SHA256 fdf8d2a34057af17cc161269843ab5e50fc1429f3817afd31887a75d4e2c7616
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 33.1MB
        • SHA256 fc337e2eaa0bc76353045e3eb21c6811615990351f04428e3b812942928bb315
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 33.3MB
        • SHA256 0de83d7b7e8c095952a31360c5f85f9e3c9838cb6ab02d2529c81e9086b5ac09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 32.8MB
        • SHA256 6f523c053c6007f5a8106015bc1b6755b4a2b54881732680fb792e8cc8c29db5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 32.8MB
        • SHA256 fb866538e83c83395563b821a581771ed8282681964887fc0b9702c877c04996
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 32.8MB
        • SHA256 40fb4d75797f20e453f20fe6e409f564ba6bff09519e7fb8ad195eaa600c0c35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 32.8MB
        • SHA256 babc2183c8cfbfe90c2a9b8eee9cff72944fa8ae0849e86655f9c9b48bff098d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 32.8MB
        • SHA256 7a3d0f5dab12dc648bff4c240e8298b53c61b6d277058cf67ed855c847443941
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 32.8MB
        • SHA256 9a8f4cf69e935dc80069413592fb3e895a53b30ed5dfa6e00cb87f3845e86c05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 32.8MB
        • SHA256 0cafe26988ed7a19d14ebff953c08af5fba653475169f1027b79190973f8ecd1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 32.8MB
        • SHA256 7029eff64a43baf1e4cecc260ad987ba5712c24cda01cb53551546721b24383e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 32.8MB
        • SHA256 a2706137eef697b6bed2d4b7c97f906db09f734820bc64d4b5c280d9fbf162ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 32.8MB
        • SHA256 a70ea4d4cdcaa8f03ee4f399b26294c85b8bb94ea8cb44625ebfd3de1cacac46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 32.8MB
        • SHA256 53346373ff56a0680a444be7ea9945ccc21992c9530868b8d72d2f44d8a64834
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 32.8MB
        • SHA256 47f2c0ffd96cfc894dfd556665c38f5cc40c4ff3cb0a154f13c5d4b608d8fb00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 32.8MB
        • SHA256 53f53702c8dc36dcbd4b3eff9715a6e3c12cd19f9bb1abcfa224fae1f64cbce2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 32.8MB
        • SHA256 c9a5aa6b6c367ac5d13d3318203ec02ab08205f737dc27e64ce3856137b090b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 32.8MB
        • SHA256 320d432c7d50ed5efc2f6ffc167f9e7af71d6956f29f9b8194a7298a5cacc358
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 32.8MB
        • SHA256 abc0f510d7fdecb5d078a956cb4278a18df077304b7f9f0a2d68cae5d1464e2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 32.8MB
        • SHA256 2030cf050269aa02858e2c70a1e94562e9a48b9e37b7ca9c46e4d4ed50ed9b91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 32.8MB
        • SHA256 b48afd1b4b74df07e48111366ead1cc1276b139da393485c3a0e33b064001fa1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 32.8MB
        • SHA256 de269f5329c41c5dbc00c0d29640b38d11de3dc9846a1358ec3e25a8b075967d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 32.8MB
        • SHA256 ae9294f7088ade1a14b37e60dcdc0c2f259464298f2d3f110094625b31bc415c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 32.8MB
        • SHA256 9f025e9313c6487482553f6641709a999993576f63090e8e843e0de96216e00d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 32.8MB
        • SHA256 6e46cfcc75a9174082f63f4ebb482b0a3920e1352ee220f0c4905dccb31cc6f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 32.8MB
        • SHA256 4d9dc99f18b05600153edd117beaf5ee60d3658c5772bd8700f99434bf59da37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 32.8MB
        • SHA256 9ca140aa9f2c688a2a16f691417fe98b4f2f7437ae823287a2d129316ec42313
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 32.8MB
        • SHA256 75c393560d015ad084c5d24a12ed8a10653fb7a4bcaf7aebf26eb9ed78ed05a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 32.8MB
        • SHA256 1897805698af7e52e99b9fd3564bd5eebd94f882a5acbac1eac38a4e9a2b51c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 32.8MB
        • SHA256 5fdec18c4ab2d59aefc3925a887fd5c721a00f0374fafe8a38e9828a43534a6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 32.8MB
        • SHA256 d7004e7044ab3b62de284a57e5b9dad9fdf915498abb7f10b2ce92cdc117d687
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 32.8MB
        • SHA256 2da81a1e01a91d4577a443b143542a676ebaca04efe23d567fd00b04e1c43333
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 33.0MB
        • SHA256 cb53983b52ede1318024e995f77395af0c6c7c0fd53c3a71ad58b5fa5822f6ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 32.9MB
        • SHA256 d565fbd73d955fd475ea8101a45e639197f1b704bd3e4c9bfeb1120d306029bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 32.9MB
        • SHA256 0f64f78fd5de2fe38547963399cf8eafc24da71db719056aaae497492f0159e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2744-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2744-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4744-7-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download