Overview

overview

8

Static

static

3

2026-08-13...r_.exe

windows10-2004-x64

8

2026-08-13...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    125s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/08/2026, 04:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-13_81442b504e8f0037c1aa0e06daaf157e_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 7.8MB
  • Sample260813-e26vsazxat
  • SHA256 11a2526135eaa03fb2d1c943064711d6710deac2657ce7d4b08f1506cec10a32
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_81442b504e8f0037c1aa0e06daaf157e_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_81442b504e8f0037c1aa0e06daaf157e_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1648
  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_81442b504e8f0037c1aa0e06daaf157e_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-13_81442b504e8f0037c1aa0e06daaf157e_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:932

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 16.2MB
        • SHA256 739711ab653eb8ee04c4aa89973b7dfed644d3a07a5585b10bd3bb91df141676
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 16.6MB
        • SHA256 40dea44e99e1202b0f91fc38a227f946e2abcc12296379fd8421a6611129ccc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 16.4MB
        • SHA256 579a71a195924f93c1fc4fd300885a4aa22ba6bd09c9bd4c345d6808c751897b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 16.0MB
        • SHA256 583dc1871ec2a96ca905a766360e0b3175e82a9405e2b56a21cc18d388b31d92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 11.9MB
        • SHA256 039445acff5a1262da6abfd866b5eebb6e10f5ee791ea32b90031aee5ad8317e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 16.0MB
        • SHA256 364550a3f2c4e96461d37ab7cd08c8c6e2dff5cd8f7ccffee0a51ce2117cc5fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 39.2MB
        • SHA256 9d60c06852fc82d745e5a007c06f7a0130f633a5194a016bb61b035e39bbcbca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 15.8MB
        • SHA256 22208bfb158ef342d416202c2e439260cb5d21e3cddf10b53e8a0890a20136a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DebugTest.asp
        • Path C:\Program Files\DebugTest.asp
        • Size 17.5MB
        • SHA256 10df731cd5e9dff89b0cfec6f82a92c20842925946101c08a99d80f9ea27731b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 21.7MB
        • SHA256 a949168323a5663f000dc1fb7569fd0e01406a895e40749397e758768ebff89c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 17.4MB
        • SHA256 e2f785d30ebb68e7e8e2b893d1c07a32562f342e249ce82e7803e223d95b9007
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 17.9MB
        • SHA256 cc8b6b4451eabca8b621dbb88da1d16d8ff087ac9ac900b5915b6731632ec9c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 17.3MB
        • SHA256 fbdd13fc12c575ee06c8762b9e7ce586b8886d0f8779b3596fe9bb4bc7ab63b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 17.5MB
        • SHA256 d325f99254a13c968ee078b1cdd79df58432addfe2a00bcd7a7e280574b8248e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 18.8MB
        • SHA256 439483a45dd19cfa8d14a305997b795426fe98729043557ba70e7f173a87922e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 17.1MB
        • SHA256 d01428092bbba8ac930ecf0866139c59335a6801e41b6366ad201406212cb6fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 15.7MB
        • SHA256 d7c572495bebd45db49d1e49fedd70e09df31181d2724b5ad54c25c5e7d349dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 15.7MB
        • SHA256 1e40cf70ec21230bab9187443af613fc1ef1a0ab260efc7429766c17f53e43ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 15.7MB
        • SHA256 104fbca8926a4daef91733a2ab6de4105769298ce862f34447a3cd6684f8a6a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 15.7MB
        • SHA256 66e11911139e150ac5d275b27646deb6cf8f4381864ccf87b49adc6598768a92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 15.7MB
        • SHA256 3a45f2724f8328cd0251b4341db58c8cd8645d709d0dcd68db054d98f3c7249e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 15.7MB
        • SHA256 5a516db0f417a9d83555499da0ac1954937ba1dead9ea5a0176394c81504087b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 15.7MB
        • SHA256 70a953e516dd0c21fb3c0a0c4c375e73065656512cc6a54bca6ed60cf5410c8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 16.0MB
        • SHA256 d98da48ac6ec3881b8274499a5ed5db16e5a679d95060405595dd528326ae653
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 15.7MB
        • SHA256 19320d68f35ecf91b62e4d74d1df952e5a9bd846d1ead456c4c95620abdbbd88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 15.7MB
        • SHA256 4cb0ff062851a9f3a9a22af087292daf71661e63a91ab22a42e0aa7b944e393a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 15.8MB
        • SHA256 2661d385a65b7baa03ab7b1449a233ff447ea88a9b032d105e9597b715d9c0c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 15.7MB
        • SHA256 d9177735dc0e73cec7e7ffa8a4f1cc0188264d35b9beae09da63cbb7ffd1c182
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 15.7MB
        • SHA256 4abd9476cff56ac914eb661acc1c911b7596f3c0b2737557deca2ff80953a69c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 15.8MB
        • SHA256 32eebf7d2934e308d7259dda2b70bee70284aafa06de8163e48f1e80ae21d583
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 16.0MB
        • SHA256 2665f66424e565715cbed48962d2143344873a2ebda4b4b39b2f2b74c20e6ffb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 16.1MB
        • SHA256 1f3d8fc05be1e4d83145cc3cefb527f7bfe8446ad63df2beb38897c048099a49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 15.7MB
        • SHA256 0c81fe62b73fb6e215f997d98c1babe7b52db4907fdb3f86566b7c76b3d5c406
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 15.7MB
        • SHA256 15854aa8255ffa6d47a5be7420762d7196ae59c01149cd375d79e970eff9f4c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 15.7MB
        • SHA256 c6271752ab82a83e62041828b78d14024ccd6eec50b5c6ad07d930d06ed75d48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 15.7MB
        • SHA256 0de7b751589f8d052c9f74578fe6f37348ccf1c5e124c19416a97ad980a9de40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 15.7MB
        • SHA256 106e73db3c5c6a3ddd559d208ddd062bd2eb2103bcd685b8d58f15b01d3d25df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 15.7MB
        • SHA256 35b54f9b66e67385ed6909136e6b54a61a08ac86a0894e47490fdb25daff98d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 15.7MB
        • SHA256 d03582613ce49f5cd41478252dbf2b771f80d7af1c1fb900732f276130d6e4b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 15.7MB
        • SHA256 5d46cbbbcf5f70834f3946ff763d05b4adb32296469189ed0d21d53918149dd8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 15.7MB
        • SHA256 0e0eb90fae41e44d5729883f2a922ee720738ea90653daa66be56499a7304e80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 15.7MB
        • SHA256 68dbfbcf360d85feb03116b54d8a379fe8d75928a2ae6cb4ada385da8bc1d788
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 15.7MB
        • SHA256 2e74b24345cc4682a4bf4fd2c87969a86913a2940e0c1b8588c012fea91c0f21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 15.7MB
        • SHA256 84e15dbf9e7a36a06ef4392beeb1e191719bd3b6de9c007731b568fbdc7070ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 15.7MB
        • SHA256 28aafe6d7af26c1979cf2aaa6c6fe457a2625ed324ae866f1260196f9c07c529
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 7.9MB
        • SHA256 eb4ee430d6673c484a0522419c19a112075219e0d46e15a4c6c0dd77823b1746
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 15.7MB
        • SHA256 7b421f1bfbdd52ba00c7407628667a9ab360ddcad3d1c066a5a693995c1269db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 15.7MB
        • SHA256 537b8e52031552b5d075c2a401f9cf4ef2b8553c194f8e81280de6a232d1908c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 15.7MB
        • SHA256 4464515d86ef91fd7e2cbd86dd3c9def996ffa3e4cc9974aad6927daa22daab7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 15.7MB
        • SHA256 b92aa820dd96bc2bb3259231b07c8e4238a327421217fa3e2549b5927c7f0cff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 15.7MB
        • SHA256 53ae7907ea8b98dfbc936ad721f9f21cf80fcf5c7d41367e3123e9848e79517f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 15.7MB
        • SHA256 cb0f52c59d03423335122837fef006ee0beae4318bd65bca11ae9d48d03a7706
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 15.7MB
        • SHA256 7ce024a4a7a5d7f440ca387815bcb3a742391da685224e3ff23ecc7c3a9dbb2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 15.8MB
        • SHA256 1f3c0606ed6f79ff62648eddd917e5deee4e23c184480c2f15c084def6adb01b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 15.7MB
        • SHA256 71132c8b5120124720a81dc2b4330c9bbd63594819313a9ae8979a7a0a8c3608
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 15.7MB
        • SHA256 e1ec44f385be5026d398f19c02d3285170cac6ebca4bbc8330b67c70ca9c01a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 15.7MB
        • SHA256 b44e2e1599b9935dbaecd260db3e2713f682a4b149873da998c18240009efa55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/932-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/1648-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/1648-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download