Overview

overview

8

Static

static

3

2026-08-10...r_.exe

windows10-2004-x64

8

2026-08-10...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/08/2026, 21:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-10_b7331d67eeb06cf18eec6859c1e08622_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 12.0MB
  • Sample260810-1rtncsak9x
  • SHA256 63f644c19f3f381088b352012518bdcf035e3af7dc2e3304bdfdff23a29bb2c8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_b7331d67eeb06cf18eec6859c1e08622_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_b7331d67eeb06cf18eec6859c1e08622_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3080
  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_b7331d67eeb06cf18eec6859c1e08622_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-10_b7331d67eeb06cf18eec6859c1e08622_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5800

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 12.1MB
        • SHA256 db4aa2eff0db049b94c8f53b9b9afe9c893d46cf9aaa69be716873d6fe5a18d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 24.4MB
        • SHA256 636dd7187edeea835ab05c684b2a4da531bc2aaf79d3ff895b6fbf5bb9f698e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 24.1MB
        • SHA256 492cc86eda137d1e83f0b7e5d011962824fd438f3b6156dc4819da3d055b3949
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 28.2MB
        • SHA256 0e137c5f6ca42ef3b2978adaa200675e8270d34d8fae30e6b701bf7142236c0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 24.4MB
        • SHA256 3961a66bac934d559ebf468c44bd39008eeaeb8006138e8a4f4ad5e0b7b1afc3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 14.2MB
        • SHA256 c269821df8c6c0ea615a12c3cfcf5d2abb565e10ef215aad3e1e81b99131680a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 30.2MB
        • SHA256 cdfbf9243289b49e37c21bd85b543502820e9ddaeb515d387c090faa9ba4f0d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 27.6MB
        • SHA256 bc8eaa782c14cee3837623a86075453c3cca09eebd47cfb8f42203901a216974
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 26.4MB
        • SHA256 ed4a16ba12dff086956e60dcd9953ecebacec85df34269926c0adf70a45c7bcb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 25.7MB
        • SHA256 e2fac806948febc7c3a0da6e6efbefd6faa0fab8f111aad1a00d4738b6320f92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 25.9MB
        • SHA256 b09be8242699a5e1a5a6b0beb835dad4f0e1a1fb37d0afaacf40af4521ba4131
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 27.2MB
        • SHA256 7466b8d45c3388152d5a42a8ad8decaa2836f8c9658548b80cee9aa3ebd2d4ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 25.5MB
        • SHA256 5b78c91c38a8b9e65a81a1cd91637c8bcab2de02e7fd4f5eb904f5ff88e631d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 24.1MB
        • SHA256 721801e38d2a3a0f8ecbe069ba7cbedcd7e3f4da13358afae6cc07f1c1bcd757
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 24.1MB
        • SHA256 559a9804fece2d3722eeb20c532d05e89ad37a8aaa645ef4b0d6509ff3adf699
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 24.1MB
        • SHA256 ac49f88de64608814955038f657fb8c6e6609ce14a12eba975e4745b38b370e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 24.1MB
        • SHA256 b267cc3833582340e57ee98c8b1da65d6271859302f8d17af3b670a5d5f6634d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 24.1MB
        • SHA256 83334dda01f32d44d0539c641f17c4b594766248c9704c6da86453f923b9dda0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 24.1MB
        • SHA256 4da31820255c0dd731cdc27442cd3cf398433173a90de0768ca355d7b32ddc74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 24.1MB
        • SHA256 83ec666d931a25c2c162d30e4716839ef1b2feabe1655603823a4473d90dfcfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 24.4MB
        • SHA256 ca8ac5e54d225ebb339736668a5ab2b859f6f779ccb0bb31773d9963c072e5bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 24.1MB
        • SHA256 1ec7bc2fc94879b971b2f0be7651da650b82c96b3d53c8ea7c632ad5d2664269
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 24.1MB
        • SHA256 d62c4d9d317023bdee5b7435628638bdcd83a479c23746c42c9e7a54a09e8c9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 24.3MB
        • SHA256 9aa0751cb149cad31257181e1cfac4be72bccbf6f539440d83589c9ce370dc74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 24.1MB
        • SHA256 e736da6d763cfbc37869666af28febc51aeb6d4a296f45b729c1eb288435a571
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 24.1MB
        • SHA256 08b1795351a7b8edb3d9ab1183b9467ea7aa9427b53369e00211126b58558bb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 24.3MB
        • SHA256 0ee2ec79cf37b96434f007a01e55a65e830f4e9b2893be0eb73d637dbc0676f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 24.4MB
        • SHA256 3c5aa088ff5ca026e61fb22242e47f0439e3dde4a56a1b1b817c3e51c6f6de04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 24.6MB
        • SHA256 4f9629aa2b9b424add686cb1be2ac686177211741ce16e40f0c0cd992410636a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 24.1MB
        • SHA256 ae8a2d3ed463909197bcb63ff67f40d01e411eabd35f875979f7b85d185b615a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 24.1MB
        • SHA256 d7cdb83b604ff3d36892011a27157605bfbf014b91b79f20433bc6f6a58e1c1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 24.1MB
        • SHA256 a5c85ac72c866a255ba04584e10534c92332ee28f2d107240ad26a56a6545cee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 24.1MB
        • SHA256 d8cb0c2c5e6148f26871ca6379e54e2fe5d05e3d6232086453384d34a6ba7d71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 24.1MB
        • SHA256 967f397583a31c8591fe6203a7e800fefa3ab32906f208246d0e7e3f6bceebc8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 24.1MB
        • SHA256 3b72f824ddd791f276aa60b5fc287040bbb88b38e21c311769a449c243100cbd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 24.1MB
        • SHA256 62382a42f13e9f63e8e6096a277123de9c7144797879580cff048b82c12f5f6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 24.1MB
        • SHA256 5776c725fcf194ba5cfc61ef42c428ca31fa02fb92ef66921a35bbb978262110
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 24.1MB
        • SHA256 1190c4e13d1389c1fe9247b1f2852aa578879788a2dc2b8981b53535c2ebb1ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 24.1MB
        • SHA256 2aa508926ad72f407cbf2f4b3694ae2440c4cfe3a7ff3105aa9ce03b5c87870c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 24.1MB
        • SHA256 5c3954631e60b4c61ad58b43cc279c1eb7936a28504c452bbf049e01b9f834c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 24.1MB
        • SHA256 d89b1603bc251af0f97fe22e0d4368b7015a8200e52cbc4d37f154c46b5073b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 24.1MB
        • SHA256 2e543d921c39b09ff8126094e7c6ac181a557b603d4bbb1a53c05b9db1077bfc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 24.1MB
        • SHA256 a76edac47e9b2e2ea08ce8255bf4ceae9d311c554c60edeeaf53ddb3ebe8bbe8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 24.1MB
        • SHA256 0b6f5b6b4fd35b1adb04ade6c55a174ab0debe26d8879917c56896011d3eea51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 24.1MB
        • SHA256 67abe2372be118c9ebf75e7f242d65c9413ba759e767c4db6928db2d83d0e85c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 24.1MB
        • SHA256 4caad58951f863997a412a162171c195a67a8ad38836eed95eff9cec2c529463
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 24.1MB
        • SHA256 544f3c3e652c03d603e2ca7f6e644a04d7227a288bf9ffeec3209b379bacb6fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 24.1MB
        • SHA256 1843c93c6790e3df0f7563362616ee77c28fb699948132f3bbc2216312566a49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 24.1MB
        • SHA256 d6e7b14b86535b77cfe6d74bea6b97d3e5fcc57a4e12d60908e811b3294dd67d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 24.1MB
        • SHA256 a0faad91640f8c8635265eea1d1993c58efff7355c12b40bb753174b5b34d251
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 24.1MB
        • SHA256 7848a2c777d78a3c3f3abd594a140677c0d29505eb80790faa571b82df3f5561
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 24.1MB
        • SHA256 554adb2a8e7bfa6efb47856313f92e8a4706dd2bdab0872f2abe53aa24ee62bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 24.1MB
        • SHA256 d610a8b5f520d037ef354b1f5b2e7714dc9069abcfaac812c0cc4a598026c021
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 24.1MB
        • SHA256 a090fd63e2384fcae78aa872127751da039987a290fbc9b8570d3cbf8d9f405d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 24.1MB
        • SHA256 b8b724af6d67ffedb447ac1d496ad26df3d8fff916544cd0ddd7ef7c6809f7fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 24.1MB
        • SHA256 df2f5e1951e2b2bf20834be06bcda77e52bdb2a1e0cfe3fa4a4db0d4465845ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 24.2MB
        • SHA256 18ab5e3a2457f6714a171246c5c718c520f08869227175d247644d9fdd781d99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 24.2MB
        • SHA256 bca1ca01e7325802dfc1c871bf74c4c0bac8cd1c61ae0b945e37f16b1530dd7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 24.2MB
        • SHA256 f6a161081eff42a1176dcadd9146375cc7a30a8c37fd7a61450b4fc07bd22083
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3080-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3080-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5800-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download