Overview

overview

8

Static

static

3

2026-08-13...r_.exe

windows10-2004-x64

8

2026-08-13...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/08/2026, 08:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-13_a97d38372db873723ede5742db031840_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 20.0MB
  • Sample260813-kdhe6sdq21
  • SHA256 2ba8a23add8b4e4dd579dedc5019403665df5d6b9e3252ea16a71e7ce574ae81
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_a97d38372db873723ede5742db031840_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_a97d38372db873723ede5742db031840_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3224
  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_a97d38372db873723ede5742db031840_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-13_a97d38372db873723ede5742db031840_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3392

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 20.0MB
        • SHA256 0ef640802fac52a5ac82f1144a068f87a04eebfc15c13e263530c5465b21642b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 20.3MB
        • SHA256 5eaed05d81784b3d8d0c5d38088ab9be31064f14a42ad0defb6320921cb4e4a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 20.0MB
        • SHA256 2ba8a23add8b4e4dd579dedc5019403665df5d6b9e3252ea16a71e7ce574ae81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 20.4MB
        • SHA256 5bf5b778e000fb62567003022b4c0f2e4ef31d37606898c3e5d7c0a529a2fb20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 46.1MB
        • SHA256 1ec59e601b047fe14c7c5752d51e12b9219d2349f5a5efb17b6077af5a1bce3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 41.8MB
        • SHA256 c9e64cbc57df9707338ee501909e33154a04fde6a5a4143240560c0b2b91c9e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 43.5MB
        • SHA256 5615ae05cafc31bc3bb270054415093dd0571810af15bafa735110298ff03711
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 42.3MB
        • SHA256 34853a1ade2b72d5f813a04743c6afa2f27402b91d6d331176f6ebc3289f4768
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 21.9MB
        • SHA256 a209ff34ab043ff51366a18f5bc2ea3cce7dc0f4778e6c11cddaa71bcd93a9f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 21.4MB
        • SHA256 79229b372503dc489b92e92db251ce0e61728ccad5a97ea9e713e1ee69617fa8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 20.1MB
        • SHA256 a5c12d2044924687a6efd7d5e4cb0d694f67a94e4b8b334d385b02b563310b4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 40.1MB
        • SHA256 d03018e44d3ce270a47120e6033961406dfd4497abc1a002fd471beaae5a3d69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 40.1MB
        • SHA256 eb80c6c253eea3b7653e8f300fa5daef99761cbc3315c5c024c5598d0f17cdff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 40.1MB
        • SHA256 248a8291c31b3b4bb195f27349278fdca449499f49223988e99678eaaea39a90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 40.3MB
        • SHA256 cbda6debbfc9a25358b4aff49d54602fbdbb006c53f53ea9910e60bd159e122c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 40.1MB
        • SHA256 5fa0b94f0a8e32555a3aabad61dbb320de519f96e55d28ed719148f4ada46490
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 40.1MB
        • SHA256 4cd5f80ec4cddfb30f272c0af9fa21ef46a0b7c2560c7e475af5bc3993d3e9e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 40.2MB
        • SHA256 7ec6ccea21a6816eb0aa75ee618323f1eb8ecde280c7520a41bbbfc19fb24619
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 40.1MB
        • SHA256 9d2cc1be0018368305a00ae1573a015cfca6cb32775796396578def453312a04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 40.1MB
        • SHA256 400a1acbcd42957acf3467d84d332946ac0fd249f2a172823c6a702ff8b8a8e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 40.2MB
        • SHA256 7968ddbc88384abe1b9f1821ecd9aa770a83dc144d356264696eb4743eaaedd8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 40.3MB
        • SHA256 8ca56f88787b1bc85afbe14030606186dd714d17efa478c4d07277358e03c703
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 40.5MB
        • SHA256 732fe74e908cd80581cad9b4f7900a97c28c4a428b11691d956837672917ac4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 40.1MB
        • SHA256 a90097922f3ee3df6dd742b0a0ee2d1471c13d76820bc8f0f21840200037f219
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 40.1MB
        • SHA256 0dc3908d12ff14c22ad517b669b14772a9232e21cee03eba2f3c5596735d8357
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 40.1MB
        • SHA256 f824e636b6a621e03963b3ba38ae84b46e028cec84874a5b74ad3eb9474863a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 40.1MB
        • SHA256 4eb903f83b1f9bf66a3a0f6c1ca5f0ea20517e14df7d46502fa358ba4346c6f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 40.1MB
        • SHA256 c732dec5a88ff8222b51b91b0367bf20ee945b45ff9336a85b24051adaebcb3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 40.1MB
        • SHA256 c1a86872ae30d36e7c865c37ae1e7dab87c83266bba2d85f344e234b8f63103c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 40.1MB
        • SHA256 07dc11909a3f353dbc441a3eedbcbb46e6c2e942c2c2ff016706e61e42f8b079
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 40.1MB
        • SHA256 7f1e802a5f2ad6bd816b0be00af99fd9f2da25805aa8df767728f73084dc390b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 40.1MB
        • SHA256 74965f8fe987eb6e974dd500001763306c435983dd2933a11693aa97f16142f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 40.1MB
        • SHA256 5731248b246cf96d99865ffa6b1f0d65f59ad53b9ddf78fd9e9f3a8bef8a7b86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 40.1MB
        • SHA256 ffefc12e98530a2a0f6b725b684597f7598e274c6bd9f5f7326c3db6d71816c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 40.1MB
        • SHA256 f627f298adcedb24460c1efb3810a3d522ee00849bdb4bd6c4d1f4581ed5828e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 40.1MB
        • SHA256 b095ca0957622cd635e14a6c3a5f3ce2720a0be079971868761200ab8ce37407
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 40.1MB
        • SHA256 81b640b6ef794bc3fdef09c173bca0da91e505cd3b3bfc8020fa26a31568b2dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 40.1MB
        • SHA256 609078c583b273bc3a9c24aabb6834cfe0540111d4a5db30fd71b7e1ea7560da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 40.1MB
        • SHA256 2de56763a5eabeff7886d1bf5a8c08bf21b0df67d4c6d3e962ae04deaf9c12a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 40.1MB
        • SHA256 d66773a7ac4c927f7b0e7deb3406df8926a840bdbede2357dd7aa75a43399e29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 40.1MB
        • SHA256 62650a5308e7bac46449b7ccb86f355d2d23da7af07ae934b882ac51c1541aba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 40.1MB
        • SHA256 58ce58ad83d3c7d0aee7212d6333bb4b0479ad3585b56a9def41d3cbc5faf3ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 40.2MB
        • SHA256 21a75da3863cc900d0dd8ec96b23399c88f30a04b64c9737844118a84e0575fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 40.1MB
        • SHA256 0e5bc2507b4414e8b4f25af9b66137d5d9a61216a959ea549d64ec36cc52b394
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 40.1MB
        • SHA256 abaf6dd366a4804a282d604c9e17e83ae541c28b90329de9be72effcd81eff05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download