Overview

overview

8

Static

static

3

2026-08-16...r_.exe

windows10-2004-x64

8

2026-08-16...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    16/08/2026, 10:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-16_6c2fca225198e9c45956c21ff291b03e_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 8.0MB
  • Sample260816-mt26macg84
  • SHA256 b395c5bab44ec826892da26bed3459d1304c1a8af4c3de3234a7d30a82aab05d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_6c2fca225198e9c45956c21ff291b03e_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-16_6c2fca225198e9c45956c21ff291b03e_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4524
  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_6c2fca225198e9c45956c21ff291b03e_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-16_6c2fca225198e9c45956c21ff291b03e_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3584

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 8.5MB
        • SHA256 c56e551abca0b0640e44e1cb3500ade2ca90cf895b7ec275e22491cb47507e7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 8.9MB
        • SHA256 3f72013182b1a4573200306b09dd1277b3558908befadcb98649a4bb3cdb2994
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 8.0MB
        • SHA256 61f21663e0b731dd122624a5887785740090e6c89dc018685d7fdff664fb22f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 16.0MB
        • SHA256 64fafdf9ebd1abecd02561e1df3b18cf55a618cc3ab4dad40338ddac529aaca8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 16.0MB
        • SHA256 af5a7de60b007c27db230f27afc2e471cbf9f0a24ae502d946952b69f6f5cc7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 16.1MB
        • SHA256 0074761f03a9a647b93b009c6fb745eec89a4ac7af7ab83ae70344f0df9f7242
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 16.0MB
        • SHA256 658de40e5a365f3e9ba254e04fa7fa2785bd090084a55f16923943259534a198
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 16.0MB
        • SHA256 9ab5aad3ebda2185e8943593ab919cf566cfd497610346ae45531d887af33cd1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 16.1MB
        • SHA256 f54e0095bc451585b915323d3e20d4a342615a842270e2e9d2329f5a73b3140f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 16.2MB
        • SHA256 73ba217972ff033d02c506e3545c723bb30620b41463d9407e006b010bb6458a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 16.4MB
        • SHA256 65d024e4549053a9bdedbd9524883c181f618d5f59f61be2691159024c68bf64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 16.0MB
        • SHA256 537472d1505bcdaefeaed772e73a50d1a2e8b0cafe0a907d81202ff13de533f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 16.0MB
        • SHA256 37552d477afd23465205343e0880c3d5256f6cff3aae4e06b2263717dbf9c742
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 16.0MB
        • SHA256 30f76a1c0b6d382778a3125ab2aedd9f1259157cc10c8490482c4400e499f618
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 16.0MB
        • SHA256 f3cac621019d9f66a7e7c90377c5e389571354f8e117f6158dbbb2f571b553f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 16.0MB
        • SHA256 8d1e48d078d199163f07fddf6f4b3a862c17f80269f51de98ba67cefb224db54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 16.0MB
        • SHA256 9550af00093a2a74220f573517aed31d9beced886d92b3e38b901ca2351f390d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 16.0MB
        • SHA256 597fc6cf3e75b3bc19f743d25a17013cf1f7210ac69146710278f45f18ebec07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 16.0MB
        • SHA256 7588a2941e41b0bd5ce14900e9ef5a79dde72b76bfc8bfa8ccbd5fe7a23f2ec0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 16.0MB
        • SHA256 92d1ee83399576f7ce744049c49899328b7b70344b9aca115ad4ef8a32476296
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 8.0MB
        • SHA256 dfdc2d9d53aec6ae498bbe1515a5182cd9a3a2feb771408f369f76750595a999
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 16.0MB
        • SHA256 b289b031c709fdd2860e7a8127ca427cc921661ecad158b7f4d79785c48b8960
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 16.0MB
        • SHA256 48a9742c429db67bf5413955b5216206a015181ce3eb23b2d02870a91d8df21c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 8.0MB
        • SHA256 51c8d35cab2e79cbd10408f9c0793c4829ffe672bcd403e2df40fb17bb75a845
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 16.0MB
        • SHA256 36e4a54f1101c84501bd1492c60753edf3a87135fb9722a6818f8ed6f3cd7829
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 16.0MB
        • SHA256 78e22282d32f438ea2af35885987af6435901098c78d60d5670d25013f416974
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 16.0MB
        • SHA256 7b7acc199806db992ef0a3314c269b9404cf3c2bc1a70b09dee7583a57bc0e9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 16.0MB
        • SHA256 bf95530c810a094d8a24eca08fc25fdd5b6410b3f075737fb677d416b7a2d05e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 16.0MB
        • SHA256 e36af7d8b05aacfc4f03052acae4c232cda01165af8db0b81c4339d7311771e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 16.0MB
        • SHA256 d58de39ebcab72a2a058819b91c2918c753ef861a17ac975881b57432f8ddaa1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 16.0MB
        • SHA256 71092b62733027d66114d57acb3a3d8c940730b5af55d298210b842e840b4ee7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 16.0MB
        • SHA256 f7398d25d9c4d231b399f872bcc375dd0c52b41cda5f2c4535235c21a48e72f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 16.0MB
        • SHA256 cd6cfa41136279bbf8aece648f3391ee96f15b72c3483b45f47c2f8b204588c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 16.0MB
        • SHA256 6a5c242830c9c1008703d6432654401aba540454b726ef04d64003a1a68ec5c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 16.0MB
        • SHA256 495bd52db72411b5b086cc3816ef3adb1b84d01c85fe077e947b315c52981036
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 16.0MB
        • SHA256 b3900d57f95c1b177b6f18923b9ca87da3659f1cf9cc666159f768659d2d5311
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 16.0MB
        • SHA256 2615d98f41c50300439f90f0fa28bbe67267653f32aa6d4d49c6077b5d6e2d3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 16.0MB
        • SHA256 eb36aab534f793aa397af25a3ae07ee3e16e30678ac7a3a7b3f600d5265eff99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 16.0MB
        • SHA256 5de4108dff188663fe0789345e27263f5dde58ad635083ad30e22e97711c20e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 16.2MB
        • SHA256 319ac1df65200bd15ae88226e4cd827dcd855089f3fca9035899473f7bcafed8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 16.0MB
        • SHA256 e457a7fca77cc3d70bf3b3c34f31a21e381c613a7664bdec6b5dda54eab7b2ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 16.0MB
        • SHA256 98d07a75bedf1f73bbd3efd8e3b28d618d822aaeb9671183839bbd1030686bd7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 16.0MB
        • SHA256 942ff140e3a3f1cb828b155500ab3aeccba4f40ec29c91359a33ac6ea41e7f4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 16.0MB
        • SHA256 1f463cf18851892fbae2acb7a1252b1b10e80a6fd4e6e8a47a7bc5f394c36481
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 16.0MB
        • SHA256 af40517f38d0ba84ab47acfbad505f468f3357d82f52c00b3461d430f4fdfc6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 16.2MB
        • SHA256 edd675d8b372e3ecb6900715d01b144780fb8c23f5aaf4b4cf35cb96e074a0f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 16.1MB
        • SHA256 135ffd44b37bb7560ad0dcc92d4cd7661eae61c9d80b0d1c747cf16882a00b1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 16.2MB
        • SHA256 1f8652bfbbf88edd1e0153105c1c1c9a0b3b8edb4a7fb5a655e08025dfd33ab6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 16.4MB
        • SHA256 787113820236f20b2ba00343c2b00e46a1b1caa3f5208961efe82ec0645c57d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
        • Size 16.0MB
        • SHA256 8ce625405422af2fd3ab19e8c3a0403fae30240b8b682ab94bd374eaedba0b8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
        • Size 16.1MB
        • SHA256 23c8c6836bcc29f92bb706ac30d5eefea02fc9aadbb7fe60f37c7c52d6b7fd63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
        • Size 16.0MB
        • SHA256 2f78dcc19200bd6f09c6c18e68af95f630c21257194a700d192d0b4e6d93a9bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
        • Size 16.0MB
        • SHA256 1c347fc226292903f47b9ad4068a78e6c3bd677bea365b30a68491158783b1e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
        • Size 16.0MB
        • SHA256 953ce0773dac04c2f991df04d1a370f6b5a2454ebf2195997f89d388f430c227
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
        • Size 16.0MB
        • SHA256 33c1736760a912bef48ce7a727666e4eb4c513036eaebd9cb9e202774def48ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
        • Size 16.0MB
        • SHA256 6d2c900248911987945833629a8374b0b11fd38c34c04ec0c0b957140a61fd10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe
        • Size 16.0MB
        • SHA256 0076b8d1f0e35ed6c98a3dec4e29114106c2b327dc3f1423aa7f4ff35a1e4612
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe
        • Size 8.0MB
        • SHA256 12f1773b9cbd9b384b88c9919072b190891027d9cd84cc021bdc3e78cf95f309
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe
        • Size 16.0MB
        • SHA256 f76f037467ad271403ba44505cd9c201a2dc5adc1e7ec68ca656985c54fc0ba2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
        • Size 16.0MB
        • SHA256 ec7c47bff286f0a7956083e1426b5722a29f85c75aba78f77c9652471070d18e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe
        • Size 16.0MB
        • SHA256 c7f523a90320d2828fb7badc5d82f8932bcbfa5b714e42027199e99bfb7180d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 8.0MB
        • SHA256 39aeb6a9447e9501f2bcc59d8930267d023c0dff760e9dbb0058b2dde07d01a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 8.0MB
        • SHA256 b395c5bab44ec826892da26bed3459d1304c1a8af4c3de3234a7d30a82aab05d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3584-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4524-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4524-4-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download