Overview

overview

8

Static

static

3

2026-08-10...r_.exe

windows10-2004-x64

8

2026-08-10...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/08/2026, 16:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-10_1d84c456c6563f2d2926743fe435a360_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 11.3MB
  • Sample260810-t2tyjsdj9v
  • SHA256 04b9a9e163d754dc3210f26d3d58d0c76a906ed284a3ea33607c5a9c05f1df78
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_1d84c456c6563f2d2926743fe435a360_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_1d84c456c6563f2d2926743fe435a360_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5904
  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_1d84c456c6563f2d2926743fe435a360_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-10_1d84c456c6563f2d2926743fe435a360_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:248

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 11.8MB
        • SHA256 02938652e0251d28812b3ce930aceeea80f88acc4a8a76018d60e302eb757750
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 12.2MB
        • SHA256 07e74711e19935d2c684aa6a9fdd9977df643e5fdfd77b859a949390f7d95027
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 12.0MB
        • SHA256 998ab92f2bc254637daf84083fa10819faae4dcc6f90df2a0457c314ce10c76e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 22.6MB
        • SHA256 98c04eaa4625f634449bc82b707dd6fefd8439800dbc04ee5cbbd0583b16a50c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 22.9MB
        • SHA256 f838c770e999459ae9e8fc47c9634171fa98749ed7f1373b8b1e612fa937bc90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 22.7MB
        • SHA256 c7d8b24958d3a8ddde4eb147703c958023ae3cf89ce3fdf9819e3498791e2cf9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 26.7MB
        • SHA256 be61d576348ccab13f5ce0507b6b3954af9ffaab7273d803fd50fe72c8dd128f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 23.0MB
        • SHA256 04f66d0659dd67f0f6e03b324db41faa32bd64314bb7eede8920b427f1d70717
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 46.1MB
        • SHA256 730e285e46fd5b9d61403e83c8ee5a4cea6646df1bcaae44a9f453c5bb2dd35b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 13.4MB
        • SHA256 fc2e75c1903499de3fe57ec02b869b8879fb9e0161e102c7313a52fc8e94b824
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 22.7MB
        • SHA256 5834e8907d13d627b3d9806eed44caea5adf60e20488390fca3d885cfb690f8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 28.7MB
        • SHA256 ec446599514ab3a2c4790bb50f768736c10c8e42c2908861cf6e79d42b18b30e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 24.3MB
        • SHA256 9fb412d8322b71a89a03990e2f021e65159e5c5bc958eb5a7f2baa5cd4d28453
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 26.1MB
        • SHA256 17f98cbd2abaf95c7bd4f7d4768880a34728b63cc399ad17f1a98e684c4611b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 24.9MB
        • SHA256 00fb73097f5be17c206764869922eebc13ba4589bd0aa2a7b81b1eecbc0a0fb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 24.2MB
        • SHA256 d9670c89e22a0a43135e6c031cc05291e94059c363e3a7cc0a003ab9f22475b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 24.5MB
        • SHA256 88cde6c3db7fbb7f2b06e3bfbb2485858c6b491e4aa081d8b387ff40d70ad538
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 25.7MB
        • SHA256 4575f608aa708439dbe8da784895c54625b8ed7deca9c93f84bd3cf29677bda7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 24.0MB
        • SHA256 8a3e582eeb66ad919f8b53655e9b587c57fbc9408003a39a04b7af4395483c52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 22.6MB
        • SHA256 b36c282761ec2115082f64828cf221ad4aa19087ec63b8cc8f304b829996add7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 22.6MB
        • SHA256 421559eb937d3cc5a81b145207ff00ea1fc1c9e61de915c84768acfe2532f6f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 22.6MB
        • SHA256 8e7ef7e3ebba6d9fe2d7391b78a487d6a651d09e6cd3bfdc0bd057f99b5a566f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 22.6MB
        • SHA256 93fa809ffb8afde97571b359929fb5a2c2683a0eb24890564e4fd4e45643b6dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 22.6MB
        • SHA256 bd184498c66d382ad58332e5b77130ebed7618620c01190859f7b41282e963eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 22.6MB
        • SHA256 5dc006d1c8f37ed3f87697bad08d61b995b8fe40e05c27c68c0a5b9d75339164
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 22.9MB
        • SHA256 9539bf9a46cbed3e480493ec4e00bb4428fd48cd83a690c2d79e5e995b55251c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 22.6MB
        • SHA256 41513e927ef7272c256d90244f8409cfcabb74f8468f473bf121f0f59dc6b857
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 22.6MB
        • SHA256 b5c25903289cfe418700da3522556484d4267e9a151f8dbab93d29a42aa0fd38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 22.8MB
        • SHA256 ff644c676c3ae38a35a7d35e29992511a4d028780362f6ed91e73a46a8464ea4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 22.6MB
        • SHA256 707af6da22b6ed479e11624d0d90f12b03eb85277bda4502c00861f22b92937a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 22.6MB
        • SHA256 57ae96bed620c6d1695aed7985a0820477f06278a189d693dcd4422bdda719f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 22.8MB
        • SHA256 04be47a3c29092db727bd2a26d77eafcc5560ea838a2e3968d1029b1f9deba8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 22.9MB
        • SHA256 8866deefd10c9f346c3b56eb8f3ab522900833c19bea8336cb3977fdb2f58958
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 23.1MB
        • SHA256 5d2abe556281e3f1275a20a5479d708dc8fc7fece932800ed8690ad9b4dc4282
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 22.6MB
        • SHA256 95b6fc90059ac359a59e95bfd4c4897153383808ea5b3d5a39aee684483ecc58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 22.6MB
        • SHA256 762c3938c214524ae19091b8dd332038bcf9608079d18702aeabe829ef838da7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 22.6MB
        • SHA256 0afec9d8aada3764c6c09cbd18c1426640086bd0bb73c6690d1f42ad8a53cbd5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 22.6MB
        • SHA256 cb89ecbfd769fb664380137ac701b8931705b202d781bf52918f83cc9cacdd28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 22.6MB
        • SHA256 e2aeb8c804655e06fedc41af4d8c052c34777278a95675d8cf88c533815cd1a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 22.6MB
        • SHA256 86424c3b48ebf8bcf49a453298d2da40c08830e2fc302a913e8f21f730878223
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 22.6MB
        • SHA256 acfbb3fa322e1f463c740727a19178e6bbda4f347aa39f1b816a3cddd35b940a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 22.6MB
        • SHA256 9c9219e3e5d1084760f3872410a1badb390528bc17b7419d6695efd276c777ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 22.6MB
        • SHA256 65bf6ed5be6e356b74cf1c0ab68b24c73ce0d7557d0a455c4d27c4b0e6098a8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 22.6MB
        • SHA256 3676141169f2695ab3c239a6b27cd30ee3d7ad5313ad6adf956824fefcb8ba80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 22.6MB
        • SHA256 886504d36ea0d19a7d52eca0c8f17f733027ea4daeacd266bd262eafa902c229
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 22.6MB
        • SHA256 c2b17815282c637f6be546cd9a502e821ac74a3cd82455f14fa1f08bbf81e336
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 22.6MB
        • SHA256 4cf43d6c9f85de9bd855dbe30cea82baf0482162b756c70e8b6d9ecb0d69f447
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 22.6MB
        • SHA256 88f4366ae36d7535f500cbb282f3c4a64ad38f135c44d0df255b84012d54947d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 22.6MB
        • SHA256 4669edb3623e251622a984485bea9768c7f4ae1d2d8969c177c96c1f6329956d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 22.6MB
        • SHA256 4395bee1972dc7ff64446e37ee91185f8f805fac25da7bd6a5302204581b3a73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 22.6MB
        • SHA256 26d39dec93d5f37e7db2af5571540813fd2d5d1f1624fa51b096b290cb9fc3d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 22.6MB
        • SHA256 ca9a474c6544d1cc6fe217e6f53b94edb37c9738d897f3a4ffa3c718c652eeca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 22.6MB
        • SHA256 550860e3fcba23b05125163f9921a15159f3bbfb2e1b3e5c7d04c578e90e04ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 22.6MB
        • SHA256 c7c660a6a5c32423f22556a02a352dd12d88a565a8ae7fad9a0d39a37d81d79d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 22.6MB
        • SHA256 4bf2fef1bf1bf01e3c3d72f19b60a38d215ff00238b5734c4c78672037dca9d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 22.6MB
        • SHA256 e386bdf533448acb1a2ce46e5c44d22df4ecd97ecede2b22c19157e952df3629
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 22.6MB
        • SHA256 faf42f1d057f527df312386c6374d2531746ebce92a5952c80c8cbaa9feb125a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 22.6MB
        • SHA256 f88c347483f84b3d96d399050c27825520748b32545397f2519aa5bcc6a63989
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 22.7MB
        • SHA256 5b9e70078c8d99e60ae685ed1d0914a8846f0675ef20dc09645e8fa9937c4875
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 22.7MB
        • SHA256 c3ed68715cd755e3102f1fad62791ddcf93ad1762d764cfcda00536928bcd155
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 22.7MB
        • SHA256 4423c393e02e88e3f8c06e7c96800bd2754b902d49234e2c57226338f5e35db0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 22.7MB
        • SHA256 ef3ac0114c8ad647393c127db98648e178b3f6e798d2be977d7122ebd7796935
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download