Overview

overview

8

Static

static

3

2026-08-13...r_.exe

windows10-2004-x64

8

2026-08-13...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    13/08/2026, 04:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-13_6fd357cfcea95d549b2eeffe7f56a26f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 19.3MB
  • Sample260813-e9qtjasakh
  • SHA256 d53b5959e15fb1017635496cf8d21e3f2b96f182334e7219e38038dd0c4c413d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_6fd357cfcea95d549b2eeffe7f56a26f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_6fd357cfcea95d549b2eeffe7f56a26f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3848
  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_6fd357cfcea95d549b2eeffe7f56a26f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-13_6fd357cfcea95d549b2eeffe7f56a26f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3864

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 20.0MB
        • SHA256 da9fc4353d949baf36bbe1c88ba3cac418023ada40e74962139653d82c519f3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 19.3MB
        • SHA256 3641fe68640c8be30a60d4caf270973f447564de19f79f1e45d0d943f6a7c021
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 19.3MB
        • SHA256 a59a8ef62f591b540061a14f09e21505d6d28107f375be61a08addffc1c06fac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 19.3MB
        • SHA256 e4bd2c3bdf8f5bb9f009a7b967534d9cf4c7fd77ac2b5c9f97f7555e247c995e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 19.3MB
        • SHA256 ce97880d5aedf44e81a3ea4da4d61aad2da5e86ef1dc4660d66b95f0325aa0c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 19.3MB
        • SHA256 23533f88512194d728e81043572ef719aceb28a7d5894ad90ae73783a75dfc17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 38.6MB
        • SHA256 3777b0c2af1f56e2b6d7f2efe53d14f7450a7fc1057a6964aec1a1634b0795cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 38.6MB
        • SHA256 f7fc8b38c738f61bcee9bf3be912972b23a22f123503279fcad99fc7fc65dbbd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 38.6MB
        • SHA256 40655c665901ec776466f73090433c86168416a43da0c373f03f43062139d41b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 38.6MB
        • SHA256 a05432bb9a34a4fd3ba17074ff5b82f27e917727e62e49e4ea3b1880f950db9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 38.6MB
        • SHA256 4dba581de3fa67145e545105292092843030a6196916ae97ea24c362cdbd6963
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 38.6MB
        • SHA256 976e6225bda6f7f055fcefebb8e5102077347e041c8421eaaba12d575567ca67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 19.3MB
        • SHA256 cf2a5c7fa3d66b041acaf78ec3e32c3fa9f35555e11d67d16c918801dcfebc0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 38.6MB
        • SHA256 241920ecbffccffc3ed6c371bf93568af9a435a80d51b522b43b1b12070e8cd6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 38.6MB
        • SHA256 7753df33c7c42bf0f9e84d97e79e51cb24a7fc42d06212845b2dcf849172557c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 38.6MB
        • SHA256 868445903fadf2ca13f349365b01a5ba272bda68f3a9ccc923441f4f12286f9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 38.6MB
        • SHA256 6b28d1f9aa20756938082154c53cd6f7d82166227f27281acb370067983e8815
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 38.6MB
        • SHA256 0f507206ba8bdf73f3d63e3acd58b695a770e078afa99554babe76845b535f6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 19.3MB
        • SHA256 4c241af0b72d60ce980b38844aae02b3aeab6f1721fad77cdf0cb0728ddb17b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 38.6MB
        • SHA256 4c50c252e30db8fbb333e4747b37e2d9777fcb7d55224890c333dd4497aa3381
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 38.6MB
        • SHA256 1d4692176a8d78f2f8e83bfe1937133805efb3a9804233c185e971c98386a5c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 38.8MB
        • SHA256 26270bd6b7e2c2285f17b159fcefb292cdf88fdc0bc784815604a45df3520a2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 38.6MB
        • SHA256 e01f563c8ab05307fe18faa4ee5bcf243a6d0af67df95818343fb6dd57b6149c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 38.6MB
        • SHA256 f64d09723ebd0b4df73dc0c22f28e6f83382637eba3690e1d27c09d53f1f77e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 38.6MB
        • SHA256 a9407446339fa25ca5808124cee4e47829d3545dcf6525f586cae57063081a3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 38.9MB
        • SHA256 44e5a20db4818c404cb90f87dc59764de2f2a456f88045c43f19202b16eee87e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 38.7MB
        • SHA256 764859e51e368ef058d14e4b1f77a5249fa3611252154c7d43994724aef39068
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 38.9MB
        • SHA256 a211f65fccf981acde5f3f4eb840b220061ea75cfb15be47f92e6432816c56a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 39.1MB
        • SHA256 aa5e86fc084442d607c177c93b74415e8ab23092531a0905a822d8e326502983
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
        • Size 38.6MB
        • SHA256 f9e17541a7b8d8e9099d0b8ec62c657abee0df11b72f228ef1582d7379860fd1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
        • Size 38.8MB
        • SHA256 d354888afbc2806ea4bdb75cd0269029e1b39655a67bc5baa9cd0190fccbf22d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
        • Size 38.6MB
        • SHA256 eca4526dea19c0984db0f38c676bf9568bfaa75556b974cec405232ec30eb8fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
        • Size 38.6MB
        • SHA256 74302a0e84c6d009669c482faa2457450338bdc88ed531555020fe06c496c164
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
        • Size 38.6MB
        • SHA256 5a99314b32a3d11eeacba61e010cb1f1611ce104941bf76dc27eab07ce3db474
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe
        • Size 38.6MB
        • SHA256 5576d61a6d260025f217882c4b0c477a3feefe675c9509be66d6f6b723f14325
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe
        • Size 38.6MB
        • SHA256 305eec8caea2f1768ef529af0a483b5d2c0bfb553ef7e44cef51dc522accc15e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe
        • Size 38.6MB
        • SHA256 920f7e306ee799e04e1c66d8654b64e45d122052d48e491078bcecbc89ea3dd3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
        • Size 38.6MB
        • SHA256 a5a5481407d480552c6f80742009642bbe573dd27583c5b5f418bfc05dab7744
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe
        • Size 38.6MB
        • SHA256 8a5def6423c866a3eef9682dea7a1309b79057ff2710e93e4ffbc00d41361df9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssvagent.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
        • Size 38.7MB
        • SHA256 3c2925f78862a0ecf5fdd94bf936a2a2ac77079679741333fa17f033f61436e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe
        • Size 38.6MB
        • SHA256 7f15e2be66e0849f92b9788d99f6ef003e28c8c770dc85f26f3099bd368cf5a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe
        • Size 38.8MB
        • SHA256 d80e348a9624ec805a20bdc69e76d641a95323a58db33afbc97b9b22b43ab373
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fontconfig.properties.src
        • Path C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src
        • Size 38.6MB
        • SHA256 ac53a9b18e7bb1982344d53002d9c14ceeee113547546236a4436ea15e307d91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jabswitch.exe
        • Size 38.7MB
        • SHA256 e2d4318aaff858d6c961fc18313c3a273d39eba38495d118fb975fafa0049ef5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jre-1.8\bin\java-rmi.exe
        • Size 38.6MB
        • SHA256 fa832472d6298032389088a9be4903d6922e8ae00fbe38989f0456692b27aaeb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javaw.exe
        • Size 38.9MB
        • SHA256 5200382f3034119a9e6d9afb3d7830659eb00591921d9e49d4a532bb826810f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jjs.exe
        • Size 38.6MB
        • SHA256 c6035bcd1faa7f9637cf05c592483a587f0269d70350d73f036b70ad2e84fd8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
        • Size 38.8MB
        • SHA256 ab8136cd65159e9008d92c1976dfd9792ecbd9e48cc41f31c5af9fc8d77b6aec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jre-1.8\bin\keytool.exe
        • Size 38.6MB
        • SHA256 c371f99e93f01f9569f54affe383a682f2b94b4aba9c5c626f8d5cb232812cd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jre-1.8\bin\kinit.exe
        • Size 38.6MB
        • SHA256 5e87b52946620c44421563be76dd47d207163e74e2641a97d83694d3fc64b150
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jre-1.8\bin\ktab.exe
        • Size 38.6MB
        • SHA256 af1d28803fd97d228850b2f3d84cb1f7f8b054d31b5e2816972e262b7cd11408
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 19.3MB
        • SHA256 d53b5959e15fb1017635496cf8d21e3f2b96f182334e7219e38038dd0c4c413d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download