Overview

overview

8

Static

static

3

2026-08-14...r_.exe

windows10-2004-x64

8

2026-08-14...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    151s
  • max time network
    155s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    14/08/2026, 09:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-14_c046ccb2523986b4e753209a9f9fa320_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 49.8MB
  • Sample260814-lnrx2azgra
  • SHA256 bc2e536a4b332d6cc249fc7757e089791bb67b17febd1654893d28ed8ec0f5b8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_c046ccb2523986b4e753209a9f9fa320_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_c046ccb2523986b4e753209a9f9fa320_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4476
  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_c046ccb2523986b4e753209a9f9fa320_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-14_c046ccb2523986b4e753209a9f9fa320_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2892

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 49.9MB
        • SHA256 807f3a6060e67ad14d4bfe4c71fcc8760d5ecdc9b942d5a38c36d6c4410d7e54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 49.9MB
        • SHA256 7578f664995ceba173e63aa14118c0d97da76684616864d536c2b577082e53b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 49.8MB
        • SHA256 bc2e536a4b332d6cc249fc7757e089791bb67b17febd1654893d28ed8ec0f5b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 99.8MB
        • SHA256 bf831839684c9a07e6d9030d6490c9a7d0d54f0d9ad2755996b580974c0631a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 99.7MB
        • SHA256 94b2fadf8227004cadb3f42c1987f89efc4464918c8c3ad0d4b9b4ff8d072171
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 99.7MB
        • SHA256 1a05e2158f2ed1ae02673063c30ba5ab829eb795b96b0c1ac5481d9a41c09990
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 99.7MB
        • SHA256 f291765b855c2d9f3965ebc9035165cc3cb41fb6d4032c8a498dfe003976a81f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 99.7MB
        • SHA256 2e98f9e7e89e7ab7be892e0b5aea9baff4fb773dc595da515d0445df54eff621
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 99.7MB
        • SHA256 804d58de0e91f817a6e151c51bddc69f0adec75621aa7bf916dca74700718696
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 99.7MB
        • SHA256 a5b05603ef56d8f8247b298db309f57b57ad4da81f362dadc5ab85f5d4af799b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 99.7MB
        • SHA256 496fcea615e8c38e8aa30245983248890936db599091f7f38709aa8a38564d7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 99.7MB
        • SHA256 0c77712711836d543f64ce5b523e63924a3fcf9216a052ec3710a6ba7d2b1ffe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 99.7MB
        • SHA256 bba4a652cb159350141ebb28c43e9c145a91a7c053281d471704322e483dd82b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 99.7MB
        • SHA256 447519dc88ed8adc7aa281acc2c124bc20fd2697126df6dc4b7809d2d15239e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 99.7MB
        • SHA256 9266a0e4526302597f38f139e4be4b79d892086e29d38d6353463016441cf876
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 99.7MB
        • SHA256 f11583bfb72b0785b7a4fa0e6855d4f8326fd18815fe51dccb98f48203d65c6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 99.7MB
        • SHA256 1b4bc2d78e2bce0e18127f2cbc18e6056fa58ffd3df4af491e4c22a3bb86dc73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 49.9MB
        • SHA256 8929ecd19cfb555288297e848e64faac1a060191c6f02cc053743a391023676e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 16.0MB
        • SHA256 93fc5ca6b0057dbeaf05e78ac1cbc3001048c9c659ba727e06a534baecaa5def
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 11.4MB
        • SHA256 bc539c41e41b68b8ba795e724ecca07e42dc6df566c6194cd5a5580d57450164
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 8.8MB
        • SHA256 4d7cec70ccaa0ab8e10a25644ac2eea9830e6e24b907411cea18120278f752ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 5.9MB
        • SHA256 36bdc95339dfdf80a8a5b00a4618df6485a7f646757833ee426187ab2643e3e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 4.7MB
        • SHA256 600ac53581acefea4f5b6266f31a7f9f0001d038c39b177d1843ffe8202a10b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 2.0MB
        • SHA256 4f590f2f7ff92576dd3153c3367ba0f890fef88ad4878aa91e7bfaf93e2fbfe5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 704KB
        • SHA256 d00fd9890e5b8b4ab20c6c689c78fd344e6f1bfc77541401e70ed34840570659
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 99.8MB
        • SHA256 9fe4362bb5525bedc27cb115578600e8f7c8a6935cbe4a621707a337f6e7f162
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 99.7MB
        • SHA256 1f285729c80dd50a6b357f9a56b10ff994a48cf04fde23b376c278ecc432d919
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 99.7MB
        • SHA256 8a8b30910bc0b2a9943781a8e418eba4f2c5139eb3f221d617583acb708e1118
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 99.7MB
        • SHA256 080f9a5507a7b34448f1fbbc444a844a8f649a38311bfe4b757e86053e94d7ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download