Overview

overview

8

Static

static

3

2026-08-09...r_.exe

windows10-2004-x64

8

2026-08-09...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    69s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/08/2026, 18:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-09_990e389f4a584960ce23b4692777b763_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 14.3MB
  • Sample260809-w1jsasbp51
  • SHA256 3328e94294211264da6bc46bcefb58a26eb685960bdadc7bd2627f4282229934
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_990e389f4a584960ce23b4692777b763_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_990e389f4a584960ce23b4692777b763_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4888
  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_990e389f4a584960ce23b4692777b763_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-09_990e389f4a584960ce23b4692777b763_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3340

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 14.9MB
        • SHA256 fea708a5610c74b7e734aa6b0a9f13540bb4c212b5eccfb81cddd79ed41a5952
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 15.3MB
        • SHA256 7bf95ec3a959f3a6f7ca25da249aba8ad0c4762e9ab05a0d40a57dc6eac66562
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 15.0MB
        • SHA256 dbcbe819fc13562c1f8b613448e68086451a494fcc01e79930d3b0d8933de8da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 14.4MB
        • SHA256 6ea55dc2c5f3abb1e67136db8605d20ecbcf6233f551456456677f957f022a4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 29.0MB
        • SHA256 3d0bce34b49a947751fc527ea4e917e16c5792e667a4b1c73900f6ef65908033
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 192KB
        • SHA256 cc71df767f30aa32b4d730d3c0244896e3d45eb216f18568c46371d93640cac9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 32.8MB
        • SHA256 6d564b3ee3ba02864278145714811f0f6d06d9a4602daaeea8a46f540a4ddf35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 29.0MB
        • SHA256 b10d32a4bb6f36d9606b26d59cd6110cf5e52e8d1eb9f4f49a1c42dc7ce9b3a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 52.1MB
        • SHA256 9c3298eab1a26130ddaadd7bdbceba1cbb680dc628ccf387f95e054303af13d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 30.8MB
        • SHA256 f72cab445fa5ab6ebff3b5d8a3ef273941175abf4c9ce8a911067951379e6cb9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 28.8MB
        • SHA256 1d585a29bfa81e531bce327b6e70f0b454990dca510b6b865ddd51bb35a0c227
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 34.7MB
        • SHA256 fd76ac190ab593d55d0bf4aa72b2f6a8e5494c33841cd2cbd7c737f37c943137
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 32.1MB
        • SHA256 0b747cb28cd396aa0f914f4129230c6395f9f7e0ad537db93b5a1b60d24be206
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 30.9MB
        • SHA256 b8741b72ee9550891d71fc171d519391c30f55ce7e160b55847abebd42b56d5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 30.3MB
        • SHA256 6aa5efb6e45992a3a82684f5f3c5d6405b15be0040b0f11401d2ad4238b9a024
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 30.5MB
        • SHA256 4ff4fc6ac2608ee0f129362251f222bd5a5bbd576835501eb0bfc921e8ff94ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 31.7MB
        • SHA256 c9c56cf478b18e8094a84372ead84dbb930586c7ccff02a56d7d0bd3ec63c908
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 30.1MB
        • SHA256 5041825448c3137c08b166f183cb603fbb3e5872ed0971c595381938738c2557
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 28.7MB
        • SHA256 95479f1be8ae42d4820d685257f01cef5404ba03033cd75cd01b5fcec07e58bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 28.7MB
        • SHA256 754cba9cd150bfe0489faf334891579109314eae1bbd8a5af910996a03dfe497
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 28.7MB
        • SHA256 1435bb02406054a2a94e8a0a859b0274fac6ba349615ffb20dd206804bfa3f67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 28.7MB
        • SHA256 d82967ed05f7ed0912560c16dd0c1256cee9b74108981cafb178539ca607fd65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 28.7MB
        • SHA256 499f8ce3ae6e98435698171e0a7c8742cefc1d8736699ac85a506148c30f74d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 28.7MB
        • SHA256 eb4da795a581ce47a889e4df3bf996f7a6f07ebf55663688a9f468f2e295e2a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 28.7MB
        • SHA256 b5847043ded6a9c299a93e90d4c9779e5f8753d3892714ca0666a7ca70e57394
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 29.0MB
        • SHA256 a48cf3d0744527741d7ecd5b74b7896f1d8430681990928736cecc544a6fb61a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 28.7MB
        • SHA256 ee5908f8d650538a7393b20f0ca2978dd869e450a24f8471508f005746acc904
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 28.7MB
        • SHA256 d9356db58566a5fded49e2ce5e0cdee42465154af45c1aece7593c73a51b3223
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 28.8MB
        • SHA256 b6687462d59d99dbb9c0f427b9a029c1d41c021e48a7b07cf0f5f891f9b8837f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 28.7MB
        • SHA256 39b4b59b62899ed382570f61a326752945dbfc16d5bd3eeb659da887383143c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 28.7MB
        • SHA256 1816eb1fb4d031487f65a3f21466f562b7d0b7d15bba17c4a2161cdd166bcc21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 28.8MB
        • SHA256 68b3d9c5260cd75846e357afe6f65e37088675910cadd731eb33a7a2ef52a55f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 29.0MB
        • SHA256 1065e951a02f9dce82b14d98d6420933112590bf150898dd4a1ea3f7ef047eaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 29.1MB
        • SHA256 d046fb51afa36e13dfac3a2ce4643a7ca8076430fa152d9404b4a5d16a9c9576
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 28.7MB
        • SHA256 c6a7c896c2b54f2dc56a7cc0f425fa269a7adc94bb38ac6b21632b11458b74f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 28.7MB
        • SHA256 3ddba2a99425bd5b7439e19f742fc2ea21dc312da5eb95d0627da5498dcd2283
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 26.6MB
        • SHA256 645aa370900943f13415a74468889a853eb932650d139fccb51114572fdc95fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 27.9MB
        • SHA256 c02097733c64f5d8c1d6c1c3777df56ae7de9ecd5b5be38a72257a4f876aa8fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 27.5MB
        • SHA256 6c4540cac912ffd359d6d14331f185d13d4167e9762819e3dfedd4316f814571
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 27.1MB
        • SHA256 b00e44509824df58bf483fb0f7b90c75a75f27248438550ec42d741b26bbcddb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 27.4MB
        • SHA256 52c80481d5a4688f2f3f4dbda7950463cd5269f60de87ef7091db5f9221dd4c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 27.2MB
        • SHA256 a657274b9fdf9cea5b36510094be34151732d6499eab43e2a1dcf75fa7d47125
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 28.4MB
        • SHA256 2618832d3889bf2db7a0653854dc7ff774dfc981febd804e62a122004108ccab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 28.5MB
        • SHA256 a502bb035c366e5988b46e94a13be24ac50ab663766ce61e3a143de826ffa54f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 26.5MB
        • SHA256 78ad42a9f42f9868c3a96af622576fd89172e3221c0deadf08786c5f41c7b3e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 28.6MB
        • SHA256 fcaf81e4d32b837953af77e476b0d2e9743b3c6a4e81fd9f1b01978892cc294c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 25.4MB
        • SHA256 142f5ffbfd8a13a0132e6179bb184ead6037738f6b32ec3e55478eeec3ae7725
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 25.7MB
        • SHA256 cea832540c74633f38be7b9c1582cb6305289dc56b96410b3abff0f43aa86114
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 28.1MB
        • SHA256 a22e5cdaacc06bc25bca63c79ef1dac8774b56cddcff15d8e410f67aa54535aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 26.7MB
        • SHA256 fd930afaad6442df7cc67e3fa049d8ad0927e2ac0726d9e079959769c2191fde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 26.5MB
        • SHA256 7d3923a356d2155a3d6ce6d6cfbe2c44fee82077f07c96bf3e6b30e5e35faf79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 25.6MB
        • SHA256 33c9c2fac20268f4386e020ae69f14ec44c4b60a840d51a6de1d243a57e15e7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 26.5MB
        • SHA256 e6062d381180079873d24e4a5b02fc54cea0337e4b4d8f208339ddfafb86d06d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 27.1MB
        • SHA256 87ce0143526d90160b1d5c20e8c10255a3b402e30b82147e7a574b258b115c86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 28.8MB
        • SHA256 4e8e5a8e21248896490de0dd34974bbeb5c5c160bda4d566d6063ada3694a22b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 28.7MB
        • SHA256 61aed0e86064d8109ed066553b5917b2701e6050c1bd8c486d3fdf3eafb04564
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 128KB
        • SHA256 018b597827351ef5fba9c0e1d321cfa9b45d887ff0f8d5607452eb75d8626cb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 320KB
        • SHA256 21e9dd8769a39db9165211e397543c288db6cfea67fb378fdcbfa803d9a215f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3340-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4888-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4888-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download