Overview

overview

8

Static

static

3

2026-08-14...r_.exe

windows10-2004-x64

8

2026-08-14...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    151s
  • max time network
    118s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    14/08/2026, 14:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-14_2c5479b5a41b53ba54765db800cc226a_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 46.8MB
  • Sample260814-rd5n2adj4w
  • SHA256 caa3087caf70210e8d73afd719b3443efe2af7d55cdeab796d2595ed81d33cb8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_2c5479b5a41b53ba54765db800cc226a_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_2c5479b5a41b53ba54765db800cc226a_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1500
  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_2c5479b5a41b53ba54765db800cc226a_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-14_2c5479b5a41b53ba54765db800cc226a_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:240

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 47.1MB
        • SHA256 b2db1665faecb6041f7f4953ffdd23d0cda548c9e67eff5c022b309b66a18691
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 92.4MB
        • SHA256 081387a624520006d881c2a88d696e4ad1c2550f37f1916a68374468d69faab7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 85.8MB
        • SHA256 dd5140af91d65694e07c84c6eac51fcf57d86c18d50ba2767fe238f734966905
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 48.9MB
        • SHA256 eed16d108326353a4aa2bb33093cf6acbf36c1c14a4b9863bb3ae6ee1d746ba1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 73.9MB
        • SHA256 f2afd9038513df3a81ef9a206359f3e02142b61a899138505df6844f5b7c647a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 62.6MB
        • SHA256 1b23470fbcde88278fdd9ebcb44e353779adee6165b798db7dbf260bb0316172
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 59.6MB
        • SHA256 268849b06874ba48312658829aef51bf878b8c1eaca753ca4ffbe6d339c1aa39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 50.8MB
        • SHA256 b103774a897cf673e824924d4d60f05c1afe6fcf9070682e8cf41960399376bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 49.0MB
        • SHA256 4bb3ada5daf14b022cdbe88612ff2f5d4ae90a351b3519af1748e5ce9b3a8b35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 51.1MB
        • SHA256 e6e668d29d9d660e0824add753d559cd70fc0cda46ac08d589b8275945402b18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 49.7MB
        • SHA256 d57d6304796c44ec4e140bf6d2ea0ef9ac92fc8242309b3d102ddec00887bb08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 45.6MB
        • SHA256 42bdf8d59a8ff63958871648f4aeb3f8d9b13eaa94db9bb06d18c7c5820d484e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 44.8MB
        • SHA256 ab894690f2c7924abb3cba28576f26a0b78da2f5ebbfa7511fb10ec8b963ffab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 47.1MB
        • SHA256 459f827c2498f2ff9800b780a8076bf9f399aad8a66999f15e946f712c9de147
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 45.9MB
        • SHA256 ec949defcf6f236739937c3e6b72b39ae29d9c02e2b53b0d0db9e219091a122a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 42.4MB
        • SHA256 a86df93fa27d899f7916ae3017b1e35b49ae3acbac6213082f14b20156001a5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 44.1MB
        • SHA256 7c3504460cbe089430395fc0d461a971a3ce6a0689bea979693063928ad4d53a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 43.6MB
        • SHA256 744c903768753aade6a6e3e85e64a4c86fbd32df54f5771aac840e7c044f5d32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 41.8MB
        • SHA256 7b5220fb7e6ab380107b225282e9624dfd53724477de0fb17243715dbd451428
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 39.4MB
        • SHA256 2716f68907e2a1c31165d6dd9a899606c9d170f84c666a394592fb05f353ee92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 42.2MB
        • SHA256 4540cec0880a26cbccaebac8d3402624dd0a890a5d4ef3167a04e25a750bbc40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 39.0MB
        • SHA256 5da453599b9e90dc4d6a7db820a2c203f8ab5357384c71d21b05ac8409a3da2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 39.6MB
        • SHA256 8d80c566d508f6bd319ca3ad37a254c47efceb1ff57e40b7c01c955e3ce45164
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 39.6MB
        • SHA256 2f73264d1c532ea49eb7939d2e2456fedc590ef98e75237ba5192c04a7f0218a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 39.1MB
        • SHA256 8b672692d84ffb8d943c4a85bd916ee1439c9ea89e9291bd81ac3df718ee13e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 35.4MB
        • SHA256 e653e8deae52d82d5b8019b2484639c5a85a8b31c6ba734ecaffa0936e0ff32b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 35.4MB
        • SHA256 fe41b09943191c149eb4b1964649608a402fb4878e509313b3d9dd615b7dac84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 37.6MB
        • SHA256 2c053b01808b41149490ea138eff8277c4cedcfaaf19bf8c66185cf3b8b94e29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 34.4MB
        • SHA256 5b4861b989385823f87b03b738793c1fe6dc61c40146e4d638b07e8df850fc61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 34.9MB
        • SHA256 f8a82e8dce9cf36bf2a9768826086f0549666bc393ce9e5415824d1a13ca32e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 34.2MB
        • SHA256 bc8ad05dce71a5f70c1eb77108de014d66f1a0b02752149a576ddf36576582c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 34.2MB
        • SHA256 400aaac65a5431a6429e641c85f3eef01fda8df41eb2811e804745ad32291cb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 32.0MB
        • SHA256 78b9785eb01fab1b80690fb307cb63c40662070506d5357aacfb6594dbcd8565
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 31.3MB
        • SHA256 4aa132b40745cf86647d3468534a2240be7a05210dfeb552b71a02eaabe26226
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 29.9MB
        • SHA256 4aeff7e889a616adab5f732b2d78c3d5a4dbf6e69d7a70145be9e6a4c8ce912b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 29.2MB
        • SHA256 3ab72b9b6c53ce4fa8c210bb99c00ad3dc1d0a841a060d8946baf92beb68d05e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 27.3MB
        • SHA256 4ef787b870a564b3630373e0865c94f8f1aab90704fe6df222d0345c3225ad61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 26.8MB
        • SHA256 4f08c1dbb6e0698517030cc0813f7aa9645902d58d5737fed28d906387ca1341
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 26.0MB
        • SHA256 7d1f9317092303ba14e2d3faafb8d25483c590b7ff72a0b7c9f6076626fbb3fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 13.9MB
        • SHA256 e854ee21b211fdbaf28bd5cc243f7d8535d83246f8ba330bb0e401bd805c336d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 14.1MB
        • SHA256 c774867d6d83b255f512694aac2d708cf12b98ae1572bc19fd338d9a4a78fd38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 14.6MB
        • SHA256 8658655d971b82f7706c8ac4bc48a577af1dac89787fdd105da6e8af425f2f62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 12.8MB
        • SHA256 fcc51787efea0b157acd7b8546ff65c8b09bcd3e037b3b9e0b622c198a44c361
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 13.2MB
        • SHA256 97fed6911a3cd26abc6c76a40f42e9ba6090add30a3091d01fabbb00a5a6df12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 11.5MB
        • SHA256 7f76e560542ae1b30f107333784374d50ee1addd9b7e8168f3d8f35ce0ac1a3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 11.6MB
        • SHA256 3511c2e51ff9e13206ea925e1e9a5982bc6ea59dde2e516129de6dcbe17820b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 11.5MB
        • SHA256 7174c430504be45f97e33febadc31e25eb85a9a6e41df4c3f48495db9d05cf7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 12.2MB
        • SHA256 c93aa1b2af014e97dac5b57d28dbaa176f7639930dfceadb63350e0c57d66857
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 11.8MB
        • SHA256 0cddf7d9ce4ffbd0b063f0d58348f6700b34d8148f0d6f5773b575e5692738f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 11.3MB
        • SHA256 b12fcde0e816abce01688151f3a6aed19ccf729ac1ff874abd8c5db35786c0df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 11.0MB
        • SHA256 1befe37acaaa780bf263ef7598bf5c0c754d783bddfe514ad066bdb19e3bab0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 11.0MB
        • SHA256 8d157c6f7bc90f0687c562ae64e3641190916315d21fe31ffdc3169e0c6522b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 9.4MB
        • SHA256 c1c241848b6431ad9beb09d0f74e15bf0faa4c3f805268cb1cce0392ae1fcf65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 6.4MB
        • SHA256 228fef6b7889ff68b960d941b6a7d2a49b4336a5ba8029b350b0c4a9f07cb1b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 7.5MB
        • SHA256 498ae12204cfa79a3e3b7e9428b20eef5c2e518426ed87846852ecc29afdff42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 6.9MB
        • SHA256 02f00032d4b8fad47a1df33344f9dd5939e8acd46ac527fe5a6a6d2630f3652d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 71.6MB
        • SHA256 c0ac7f554c878cc3e96f5f55a6dd9f153a526963428c540a5ab5ecac1ab67b5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 71.7MB
        • SHA256 5dca363b1c015f859f909991101cc7e5655daef56b95402cce88e71ce02008b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 70.8MB
        • SHA256 08aefefebe27ffc93b699fe6321142f56a0a3cddef5c3d7899ca92cf276483d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 69.8MB
        • SHA256 0281b0c123cde96253989e8a954bc97c011826d1650e3455a935a2384d58a039
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download