Overview

overview

8

Static

static

3

2026-08-12...r_.exe

windows10-2004-x64

8

2026-08-12...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    114s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    12/08/2026, 11:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-12_3090e1767de2840c224edb4267272da5_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 11.7MB
  • Sample260812-m7yqcssxds
  • SHA256 5cb03017576ed78a743f243e8acf0387f24ec0cf3b26b22449354c377a390fe0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_3090e1767de2840c224edb4267272da5_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_3090e1767de2840c224edb4267272da5_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5992
  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_3090e1767de2840c224edb4267272da5_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-12_3090e1767de2840c224edb4267272da5_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:236

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 12.6MB
        • SHA256 2e9762d3e6f42eff1daf875fa1f75373e9551794f8ce7a0b9d2323fe960cbf41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 11.7MB
        • SHA256 be21b3fea2d3b0f1c555d956e9073862be5cfe11ab6e7d7cee5669ed4722e79b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 23.7MB
        • SHA256 86c95c7b9fea073ea65bd0f2259294cba65cd4c735e82abf01b59062d3a1fa68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 23.4MB
        • SHA256 715bde3eccaa8b9a04219a826fe45b35430608a0214b56e737a6accdba07ea83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 27.5MB
        • SHA256 01b2b4c14783f744718a3ccaa3a0f98167f894fe882ddddd6b9540eb5869097c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 23.7MB
        • SHA256 8844c1c59caf78b0e52d2344a4a19e54e6aa26b8250cfdba469c2728ffb27fa5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 46.8MB
        • SHA256 7d77bc3d755fd9f52bc99aa52e537088d0620457a17d084801faed970b45a930
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 25.5MB
        • SHA256 dd03c0d99fc5a989ab79fb6c0bcce170a486f5c7a3c82415ba664ca58224180c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 448KB
        • SHA256 0b68170553edf3185b314e238395ed1eef14893f0c425d6106982546c0eaaf45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 29.4MB
        • SHA256 832a6e252c7b6d56f9f48f35f6e5b6150c0d40d1f90b141ef9e637d1bd52a54f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 26.8MB
        • SHA256 fa09114d13c54bca41cf73fe7bf780ddfc2c299f0f2ada6baa52a1c792f26754
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 25.0MB
        • SHA256 4466d7bd3accecb2a8d50e5edec8e16ecd3a7d14f13702f8c785c65de8223c47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 25.2MB
        • SHA256 f736a9ca08344f2ebeb2e3e721bf7d401128898309a74b4af4d88577c6e61e59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 26.4MB
        • SHA256 eb2499d378c45b3c4f877e27980ba7da1d120fddc399212455327271f9b87ba0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 24.8MB
        • SHA256 07c2c8980ddfcb27f8fd60519972d12985097dc44fb57c3cb374ce09633875f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 23.4MB
        • SHA256 5c38ce2bad3150e81db3f1c99b4704b154d086ef49baa6790797717032ba107a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 23.4MB
        • SHA256 5df54883f8b4ef9c1ca506d91d1576e4aa61d1fde884d20a50c0b4f40ed2e565
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 23.4MB
        • SHA256 b6682f91441d274cef3d359d3cb1f0c2aa51ba4ffc956ce4eb85d277f0a34340
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 23.4MB
        • SHA256 712c0c14c447a5fa1b021c9996e984885d574b65470b955668202ee9e7b0e10e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 23.4MB
        • SHA256 2adfc72a9332f3e00f43c38639af2891e379608ccea502ab043e8004aa1726ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 23.4MB
        • SHA256 0281b46ba8dc31944e762ad753a3081405ed74c1066f4d6bc14d3b7c9796e3de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 23.4MB
        • SHA256 ebf0abd5b57a3b2592dbfe663c7e18c51d5e92c9b32969436b3abcb9da20aa75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 23.7MB
        • SHA256 bcbeebe50a5fd8b94dee4996538257df50847e1136484e788361351e76f90418
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 23.4MB
        • SHA256 e5558e26ae8734bea62bbe166a58805f7b8a53ba2dc46d538104dc0b1a55827c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 23.4MB
        • SHA256 0975a28364ea38c6f6ac9558b0fada6a5f3ec08845dad992db41816a72b47aaa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 23.5MB
        • SHA256 92e61d3613078d95688921e781a37d988be276d82ab4ef81566c5fa9a258c81e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 23.4MB
        • SHA256 85879723a432a8602c7f64d41e5211c8680b107270affc58ebfe2d6b5bb90663
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 23.4MB
        • SHA256 df71123e1f5c388e2fbc5d1cc36cb4e4b4fbd8c123f44fed6ccb0f10f300be3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 23.5MB
        • SHA256 1b86d705131fdd5947b997466a470f5607d615a7cef727ccfdf10d5bf6b5c0ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 23.7MB
        • SHA256 4884fe2c9b8b394cdf129a3a75a4041f776118e6e5bb93b61731281128180aab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 23.8MB
        • SHA256 7b1a71e2e2a661c9234b1fe3dc88e03c8027ffbe34e81c2603988fe9dd7b2c68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 23.4MB
        • SHA256 9d6810b4408cf4cb50f2f72f0ba2958df127e55f7a7337fc803252c4ee82fe76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 23.4MB
        • SHA256 5a081d61c6d35bafc32ef4d0b019361f17c1bf998333e1a6dc0938693cd538de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 23.4MB
        • SHA256 5edf8781c6a6b59b9cdae15b72c491d8b33aca53009d2cae6ac59f0e6cff3255
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 23.4MB
        • SHA256 edd9ab5b97492e7a45028f2817c32e937a7f045a6cdc450fdbf8b1be8287d6cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 23.4MB
        • SHA256 54d329afaf455f4dec829150bb0d8ed7ce597c4552dd5e54e8010f3c7b1fd162
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 23.4MB
        • SHA256 1917bb6dca10779e0adddb88a0b0fa6cb18c87d8bbe3fa926605b8df268d039c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 23.4MB
        • SHA256 42fb6c22bcdfa8d1533b536ccaf5411ffcc9714184556eb42afb4f180ef29cf6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 23.4MB
        • SHA256 ce851547ef34ac39f0607cb5be1bea6ed9cb326196e2c27a5f94505ae2fb80c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 23.4MB
        • SHA256 5c14c439e071ef1c92d0014971a026b144139b5e41efa77c723019dd4cce392d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 23.4MB
        • SHA256 5529cf814a6b8d72e4554bf693f9828337b4245db54aa19cae9a61c054eb9996
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 23.4MB
        • SHA256 2081cee62163a5a7e9181b97a50f68a050c22bbc45ab50bb69ce04f72ba674b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 23.4MB
        • SHA256 9afb0f74bda6d46b7a9ba88e2a623d9acc3aef57a731b295134e6a8dab60e687
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 23.4MB
        • SHA256 2008bd6f63f6be06d0d7ed34348464570562eb7fbb3c0c20c0f04ccf61677d8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 23.4MB
        • SHA256 1e0d3e97111f442db9eebb506f240601e87b69cbbda1de625017a58e63690b2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 23.4MB
        • SHA256 f3a40ff0c2322a51187198d0d5e150dcca45681ca1e66d76d3f082262016413e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 23.4MB
        • SHA256 55563d588129cad047618437209e774ec0c2fdbc40b9336170c81397caa8a0ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 23.4MB
        • SHA256 869813d092ed8138ae16ea3da800c191e61e943082421cd4e3d56d330234fce9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 23.4MB
        • SHA256 9d56e7be90f067a3609c00db6703590cbd7d7aed4b914495b08071f617c37477
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 23.4MB
        • SHA256 258b64cad92a13536678a508253d256543f537729b5071904c9a9c01605b127a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 23.4MB
        • SHA256 925c280054f2d30ae078604097c4801af10fb59442a3185b59b171455bb299fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 23.4MB
        • SHA256 b5677b19ce5cd31001afcec582518a2cbe615774887d7d98ec5f5bfb33d3292b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 23.4MB
        • SHA256 5b46ec4468fa3c4441617de4e09d3adf4cd3a65f23d52de8c6f25b9838538129
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 23.4MB
        • SHA256 1e50d0cf4be049327b64d308bbf976fa70173965698d23341e1a6a12d0b9bee4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 23.4MB
        • SHA256 cc62739202421a2cb953278379329411a343f89f6fd26b0b64eb23cc9aecb462
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 23.4MB
        • SHA256 daca2aaa4620a38491087b64c6403cf2994a3092e3f995ebd36b527a6a8ed666
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 23.4MB
        • SHA256 31929ffa01de5119f7202552c7a0bd7ca1d99596ebb60362292370a7be308045
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 23.5MB
        • SHA256 8d664eb4e8e7b06054ffde1791319f4e6cb4199c9f310a9cfed4614cfbef14df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 23.4MB
        • SHA256 a6d28514b27979bf56cc8ee62797c8f946ecbbcc3593435ea2ff3aabc77bd25d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 23.4MB
        • SHA256 ec8a190e861de8aafe3647c3a88a87abe563be242168c6582271cc92d680a2bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download