Overview

overview

8

Static

static

3

2026-08-10...r_.exe

windows10-2004-x64

8

2026-08-10...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/08/2026, 16:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-10_4e7ed0e6a4260816e3f73c11592f90e1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 16.1MB
  • Sample260810-txm97sdj2x
  • SHA256 a0f0044f5e4023fc7622facf205535ad2b2e855378ae09a4afe150a5b0417df8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_4e7ed0e6a4260816e3f73c11592f90e1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_4e7ed0e6a4260816e3f73c11592f90e1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4180
  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_4e7ed0e6a4260816e3f73c11592f90e1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-10_4e7ed0e6a4260816e3f73c11592f90e1_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5080

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 16.8MB
        • SHA256 e6823ee3aaf85ca0d627fb4505d2cd32ff400fdd90b34e1bda3925ebfbd7450d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 38.3MB
        • SHA256 164063e89f9fd09f48acdb7637634cf0c6477486da5a1398e042de6ae179f51e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 34.0MB
        • SHA256 5b70a54e5a244be6020ad9b732d7ed8a4d1539972a22979eb8c082d97201561d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 35.7MB
        • SHA256 e625220c8b8af5bf14ea014a436da9b49f97a063250b8fe9419a3d887e74d580
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 34.5MB
        • SHA256 17065350db7ad56f020c91f483841f40ed1427fb6399310e4e0d08241aee2dac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 33.9MB
        • SHA256 7e77fdabf9dddc78763b9eb44a3ee35068eac0eb1412f5a331d07b035a825e1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 35.3MB
        • SHA256 26324905bcb533a7ebd563426a5277d5c3869c1a28f4ddfa3749a6aae8d3b350
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 33.7MB
        • SHA256 36348da2cdea029636102137be0658b2028e2c2810925943abe2a87c8f93aba2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 32.3MB
        • SHA256 7704313ad0e2d05e004125c3a20dc0bd462dfd292edff81eb482efaa7a6e3584
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 32.3MB
        • SHA256 d772895acb491f5755b8e3c6a0494034ec581c6fa2279f6280a04faaf071b642
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 32.3MB
        • SHA256 4ba1d4d625872147066769ee20ce22b6f97cd75825f07a85d4eb959af1b64154
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 32.3MB
        • SHA256 fbe4c69065a7eafc932b296070364fc65fcfca62ea2e4c164b4bcab407f8e493
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 32.3MB
        • SHA256 4888bf8f73e1311f9e69689b4688d914abb1b972e9f618a0ce8f46e3cefb2dc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 32.3MB
        • SHA256 b22fe9cfbb5fda6b3e78a9b539a85ca125a40b067457b4e025f66c0d58dcbea9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 32.3MB
        • SHA256 73efb226d6cdb7a19279d8d6b1f86aa43f8042989f9caa2b79c957274e0d1875
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 32.6MB
        • SHA256 b9097678f5507b7f241d61dcabc070d5cf5ccdfd193b24061f88ee39a8d768e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 32.3MB
        • SHA256 043c1634beb7af623876021fe08a60a16737979e0ab41960d7df9cf44d59d285
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 32.3MB
        • SHA256 b7c410e6a6e7cc95e4c28f5a1b309fb9da2447fc1d39b0c52dcc044221e03567
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 32.3MB
        • SHA256 8b8a4f2f5ca94ec28df2597069716e8cdf47e9bc7b0f79c143d706d1d3d023e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 32.3MB
        • SHA256 2cc89dd829115dcc8c6e361204dbd613ad6d978987750a7c6baca23a9944f8fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 32.4MB
        • SHA256 4e3e58152e6365fcd180467089f7e0097818e4e2d86e49fbb0c8ed84d14544b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 32.6MB
        • SHA256 2108a72f82e39572a449eb6dc3fcfbef3e5a54e3f7937474e3c8ab14c3462744
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 32.7MB
        • SHA256 e6d6a6ff5cd5bd664807cd84cfbdca2b0a801d2d99f0c9843c60cf761ed79234
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 32.3MB
        • SHA256 cb3b4592671e35eef059eeacc69c687a1121a5dcee78f422f44e0eb3a10fd720
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 32.3MB
        • SHA256 a4743f47c4e541d9e42fdd6d2ba1d8a60eb8f446316d1657c0fa53eb00a837b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 32.3MB
        • SHA256 479d1cf41e9530e5a1f85970bf2f5a326ed3a427a6ccc7f7faa51a9b547ecdba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 32.3MB
        • SHA256 7a4fb434536925be949d8d32586140ec51479bac70fb1fa3f992ebce9165c7bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 32.3MB
        • SHA256 24e7e2ec7332a3811ac6fb5a6c34b870f688d0da3edd39ae1b92e1212300f10e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 32.3MB
        • SHA256 21b0f4ee6f8c4d42425cbfa8b1755960fd85e0aaea6dcabda1854cda646e7a7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 32.3MB
        • SHA256 15f3a2a50645664bb2d964d2033c438b3f5b408447c189eb265a6f53a9c87d58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 32.3MB
        • SHA256 b87a478995334f34f0874476ffa7e4114aa019da39ce1e6f4a033b801a9fb3f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 32.3MB
        • SHA256 24b550c335866b4c7bd873d2ea62125abe08a21349ea19c2f60f015c004f8f68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 32.3MB
        • SHA256 a5b00990a7456932427f5b141064230632e2785aa424d86ca663c17fe2b533e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 32.3MB
        • SHA256 e332a594789aab5165700a8f2c44883c0eaa8f5eec4e7c2f38ee539417766d25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 32.3MB
        • SHA256 8617bdbaf53a57a4289a4cc1adbebf07ca37803e23d3cb068f251ba462e1e0b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 32.3MB
        • SHA256 a3f91ed566adb525ddb906dbbb2e3e42d97c0ee62c92b9f4ed2f7d31fb27f765
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 32.3MB
        • SHA256 bc85c1d9c7b868be0e8c9b592cc9f9e19f6a1fb7ec017f32fa15caa1e46f402f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 32.3MB
        • SHA256 d474715957aca1ade6ebc5da2dbc04a138f46b87b31fb051e183830a2cdc4bd5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 32.3MB
        • SHA256 972e6ca7cbf8c48ee35a01fc8b619ae32bcc14c5a642b409260f71ec03c15390
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 32.3MB
        • SHA256 484e9bddc1d98d20a0a9b1505a4d77712067a7dc7c5036583a8efb637bd87ba9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 32.3MB
        • SHA256 fdb67ba52661af3f60f4d8cd06264ad4eb647ee59aa6550cfdd00b16c3b02d93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 32.3MB
        • SHA256 d2f578b7ad4b8d96c6f1c919e18cd4dfee1986dbc82936fc320aeec8feb908a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 32.3MB
        • SHA256 84ef56dca5465a20c955286a57f69386daac345568d577a8349ed1acdff1a05e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 32.3MB
        • SHA256 49e6bf4248f0234bba801e7e471b689efc31612ba4f72f742031afa46afba6f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 32.3MB
        • SHA256 03710a497800ed0716d0511599609257cc8ef7b8cfbd132048f4dfc258eae1bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 32.3MB
        • SHA256 7ae9241a2ed359ec77222ec493c6ea57507377577624f6ae92cddc007ca8e60b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 32.5MB
        • SHA256 ae0e5cdd793fc88bd47c932d15decb2c3ff78729c1f953c276d00b0e2dce9ad3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 32.3MB
        • SHA256 e4da2be4dc37b4c1df7a4a174ddf2a02a59e0c0867bf8ce4d4f35e18a6987626
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 32.3MB
        • SHA256 adf10f855f406330a2f7bf34ae5ce456639c9b38933d8ed2c88bbf52a5aa40ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 32.3MB
        • SHA256 3f2054628b35bb765396d3882a122135b28f90361222aabd122e8f3d203818d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 32.4MB
        • SHA256 de2441322e09c8670f6e7b306af220e796e3cb45310f51794ba160acb04bc2dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 32.3MB
        • SHA256 2b5b24d9f3fb7f9f2f5e3715a2f1c357f0e5a1647893bf9b27e1376e4ae43d15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 32.3MB
        • SHA256 1a4e948d19cda21cdc730343b85e376d26d6548aecad67a5f50b8e3cea8a9fbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 32.3MB
        • SHA256 464879bf6e05d0d21e6f25555b24d03d6c05965877d4b534729e98b73a4b7c1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 16.1MB
        • SHA256 a0f0044f5e4023fc7622facf205535ad2b2e855378ae09a4afe150a5b0417df8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download