Overview

overview

8

Static

static

3

2026-08-09...r_.exe

windows10-2004-x64

8

2026-08-09...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/08/2026, 16:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-09_9996af6f54592049ebea2a09e1ccf351_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 15.8MB
  • Sample260809-tsmswahr2w
  • SHA256 f546a1ada9027232ac69826728877f0d5f0d426034f830ae7573d1db8e610276
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_9996af6f54592049ebea2a09e1ccf351_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_9996af6f54592049ebea2a09e1ccf351_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4868
  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_9996af6f54592049ebea2a09e1ccf351_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-09_9996af6f54592049ebea2a09e1ccf351_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:464

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 15.9MB
        • SHA256 7f8c8eef536587fbce0cc8f11fc35792ff8bbd5c5ae5078e6f7a32444d461bf1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 35.8MB
        • SHA256 bfc6fb76383077dd055c731588ccbd857f44e132797939979c9d69b0d5ee4a7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 32.0MB
        • SHA256 0fe7cc014e8128860337dac7666ce8d7a49cb68937dc24076ddce2a17733e2c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 55.1MB
        • SHA256 c66c4012e22171a469d53669b4e6e9b46daca03327b347b3cd0089583aa02d36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 18.0MB
        • SHA256 116b9970e21b012a9b8eeda5a264ad54b32d8427bd088d8070fe7d5b7223c7a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 31.8MB
        • SHA256 8fb61dab2cf28a333a999fca13d29430e4e052170f242c463bf2c96021287b5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 37.7MB
        • SHA256 4c4540c15a38ba6043f301c87a8a19223e8c876adb5a1375575ae948b121b015
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 33.4MB
        • SHA256 2c03544cdccc0d2a3aa23332f09ff7c9bf82072b222fcfb22bc9c5dd4c236364
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 35.1MB
        • SHA256 10e74700cb8bc0e33023667289e24759fc75a097b4d8a6d9a13c217fb67ffb65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 33.3MB
        • SHA256 acc4b52e385bab2d60a7eea1501caba660b6bf4c16784235d12277c9f1f36578
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 33.5MB
        • SHA256 99a3f960b48719c0b865cb7af40ce989eef397fcc576aafdb938ae9147031e6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 34.7MB
        • SHA256 025566b86cdb9c98cabc29aae0b7ca819effeeb140f98295ebb715828d8b6537
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 33.1MB
        • SHA256 02951123ebf22d0252991a0e3d43a439e0359e7c089e716c534383aec936d660
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 31.7MB
        • SHA256 ba29764022bde9286aecae1c1b1873e03f34c2d96d74539bf15cf76036840e25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 31.7MB
        • SHA256 79f9209f379d3e189f187b174a8a51627b1d59e0fdcaddcbe2a15254839fe18a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 31.7MB
        • SHA256 7c93d70b3efe5adfe93cac464ac8521221f00a0c90e9172cc2f3140f885d2c7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 31.7MB
        • SHA256 4300827c9386192b3f9f57dd0f30e27ced62616c952305a763db19a54d00cbe6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 31.7MB
        • SHA256 2884fa647f8a3f46834ff0c0675f3185a2d3f552555a0cffcb111455ed752c6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 31.7MB
        • SHA256 8e48dba4985785b2f64fe021a046603dc4a19675ba2f506c48802f3ae3592641
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 31.7MB
        • SHA256 ff3966bbce7c8ac295d89148dcf0d0d557d9c80eddc27f0cec28b28b129249f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 31.9MB
        • SHA256 1773a0a2fd6fa34f96a5146f099e97b8f97047eaf215590a6afb988d8aab67e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 31.7MB
        • SHA256 2a2b733f0cf49c041d1e98745b9b12d7f8dd575475b610fbcfcf9bf534ede1e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 31.7MB
        • SHA256 eb06062e45f1728447ee19077f9f6a1046afae8f1929d1b5422e9c8080de3a2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 31.8MB
        • SHA256 6535aabb338ff4d02d0f3b31e78c22c008ec85d1511de1c33a21278ecae5e5ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 31.7MB
        • SHA256 560ef0319f0324a2fe0bf5daeec587885aee52a1c893e283a936a51be9ca0abc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 31.8MB
        • SHA256 06e2b74d75736e4256d39300883eed9d6cdcfebf27dadd30a4a59ed9a09e538e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 31.9MB
        • SHA256 c2aba4d0fba3f18c693a36b767a133c1757328cb792755de79714478036114f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 32.1MB
        • SHA256 8d1fe97691178430c32f2f8e6a5fb162a3654c5b2c0d56fb98a96ebdfd073069
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 31.7MB
        • SHA256 76d3c0abdaca249d0e250d371e65fa2052352a4d765d5de3a6c7b175355a7e10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 31.7MB
        • SHA256 7e5870502823eb2adb027a5d8d14ee39fcbc3e95a0bffeed35a3e172c3434e1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 31.7MB
        • SHA256 28714f702e07f44db275711dd9651b098487215e166f1773dc08c5e6110b3006
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 31.7MB
        • SHA256 e3112453f421fed6ebb137a6a54f0f1a4a75e57f89b56b7fb3d303d325ebe27d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 31.7MB
        • SHA256 6d537a7e62db41b5328a1c1347a34f145cba224495265daf734bf6377e7d05e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 31.7MB
        • SHA256 dca523aee2cc90a5e2deb3b0c71b8e575fbb6536f957dfa748b52ea40e5d0c36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 31.7MB
        • SHA256 a0422c29eaa540f6f779f70be9c935fccaf7e7d614529f9853a22956fd9bc8d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 31.7MB
        • SHA256 c9c8fe23d698da90f1e7d01f539d7b31fad110c3d0da7b094ff69a2f8cfee39f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 31.7MB
        • SHA256 013dc7901a4353c595f85665d88f5f5f121caf5b5b6935bcfaee81dd76cd731c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 31.7MB
        • SHA256 c9851a57a9f67568ac29923188b080102fb365b95210824e7f9c5a5776b8e6ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 31.7MB
        • SHA256 55c155005279b28a1cc63764dca1d87124542d0f1953a24529eef218c34107ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 31.7MB
        • SHA256 cbdfcc6882b891f97380ff42244c5df6cfc2ff10024fb954fe4e30d0d1eb1edb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 31.7MB
        • SHA256 0ab11eb93c3155143e90be0ce2d3fe407bafda5299abc292e12d282e6f8a4247
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 31.7MB
        • SHA256 655d8db983459a899120d4b98d4d2bd3f9d730d7a4db290d738f238d4c8e552b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 31.7MB
        • SHA256 a2cad3d170f1ea85b10d2fd5c2293945bd30b34d9b48cde4be9f10625bccc336
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 31.7MB
        • SHA256 b40a259907e3c3930a6a697f39c85881e25bf676e16841d53a079cc14bf1b163
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 31.7MB
        • SHA256 42af8e021d51ad27ec2523c1316d7274a2f9fe65e009bf03b44246ea82b52aaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 31.7MB
        • SHA256 5ba3785b0ab699a8a828ced268288258b6efec6860e42aee1cb31962a09faf29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 31.7MB
        • SHA256 7d5def163b328831c13992c365c96cbcdb050aabc24629c1560619c020c266cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 31.7MB
        • SHA256 2d00679dda21f754facec9e5f42e3773f2e6c8702395659766f1ca3f1e4cfd17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 31.7MB
        • SHA256 6d7415a5a79a92b76a18b56a547c3f95ee1d175a95d887fc4380d5c405ff2d17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 31.7MB
        • SHA256 caee277a72fcb384182093889707b9ad6e06c7fe57cf6690e16223275b5b0e40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 31.7MB
        • SHA256 01a8aefb946f9401c94314964b38361ea86cae4bc7cacf315933f86ee13750e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 31.7MB
        • SHA256 47a6413dd9a061247ac45e29db67a9191064ca2125431f927e8046d0c218dd39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 31.7MB
        • SHA256 0ac961fee86b5316e59fec8995b895136573cc2bc97d2de0acee64bdc42098c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 31.7MB
        • SHA256 bc21b44c648067bf058d29614545420dc383c09985aa088e8d91e0d2858ef690
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 31.7MB
        • SHA256 0e067f3e43d9e4e43eb591cff8f04be0b6388151beaa0873e71a61ca831f78f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 31.7MB
        • SHA256 39ab25f0d7cba2a517c9e1f39e0333c1489c5ba47608d8339151c95fa4a9667b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 31.7MB
        • SHA256 e51421f6b866b585a00ce69e1d01713da804bd3ee991ee8ca6aa35091ac0eac9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 31.9MB
        • SHA256 dadb40fd30b59942b2309a5bc44f332bc4e9b4e9be44cee64f39b537c4911e30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 31.8MB
        • SHA256 088c7cebe3168974dad1f9ffda28418ee0c0b92a9123683f11930ad87369af30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 31.7MB
        • SHA256 a5b3c9ce1b72f75413f96250907fbe4ff6e38bbc12277628768cb23cc64db2f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 31.7MB
        • SHA256 9155705862e4ba47413209e4605a5d2d411cd4e5b743e100259b83385f68ac53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 31.7MB
        • SHA256 62d17dff1c0187e6960e7fcbeb65378f846bcd60750980b345aeb7f3b655b8eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/464-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4868-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4868-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download