Overview

overview

8

Static

static

3

2026-08-17...r_.exe

windows10-2004-x64

8

2026-08-17...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    17/08/2026, 02:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-17_4b81a8335f9c964598efedd523307864_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 29.8MB
  • Sample260817-cq2qkshb25
  • SHA256 319185c3a5c5c8b7a9d3619694ec2bb7189a6787f67b81c268426c0bedb7e9b5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-17_4b81a8335f9c964598efedd523307864_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-17_4b81a8335f9c964598efedd523307864_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3424
  • C:\Users\Admin\AppData\Local\Temp\2026-08-17_4b81a8335f9c964598efedd523307864_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-17_4b81a8335f9c964598efedd523307864_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:828

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 29.9MB
        • SHA256 eb4207a7936accd621d86ead9eed52eac5f936ff54dae4ec2301df097f432d44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 63.7MB
        • SHA256 f87b5f600622347d2f0c1d10c691c015d0e2f384ada2ed2cf5bfd4c39813e758
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 60.0MB
        • SHA256 e8a6b473e8982fb82a0533d55bfa1617609cd9fb56eb2aa64cf9382c200689f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 31.9MB
        • SHA256 dd994c976c161f397fe218ba4c44bb05d0dda1603b298c080e87f3e8e3900a24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 59.7MB
        • SHA256 22a22d3f01d472dc301ae30dcd40da05ea90fc638339fa48608a91ed3658b04c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 65.7MB
        • SHA256 93a9158ac014a8f81de8f86f322be8b5824760dd54d0b6b78a2e3455782c8be7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 61.3MB
        • SHA256 f95f37674dcaa445b1d2c95fde869c5c5b5ec3968d54756cd5d235dcd8259fc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 63.1MB
        • SHA256 52e64b6ff0ac834da858cc8fb1e3db38b14b675c04f1597520fa89624348705d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 61.9MB
        • SHA256 aeb0e382ca7e299d755823b5f06eaab7b732033fbdd04020da3ccda830dccf51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 62.7MB
        • SHA256 1a0fcea8d29a612f82aa9e5c7687fbd50c12afba0407dbaa13d89e41f43fd737
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 61.0MB
        • SHA256 b38851e78803413401fd7922aeefb8274fa77bc51546bee9e80e0237ab42e84f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 59.6MB
        • SHA256 5ab82126eb4197cb11a43364eb3aa06c27053c96e88cb492a0ee5b26d5ce73b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 59.6MB
        • SHA256 bd4e88c15807984ed9099ec4009b903abb46aa15a6ac65c0105d10f7ac6cc2f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 576KB
        • SHA256 f3bd2dab7382b72175192fb3e9f89598203ba5c57a724633b594102fdf17e510
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 59.9MB
        • SHA256 65f6287edb1883a2a3d2327474419ba7ff06ad3ccbfb504e880a1731c5aee7ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 59.6MB
        • SHA256 26036a89078d472b3ef939bf476a59c1750c2107d27e44e223a04dc00c12a4d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 59.6MB
        • SHA256 1a0d9738dde68ce1fbb08694ee8abb31d556a1b1e8565b35d1923c9b19fb6132
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 59.8MB
        • SHA256 d36870ec670d0c8e66920bc95c630c61d80fd5d014f9903041222a977a21590c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 59.6MB
        • SHA256 0743e4a63209fa27c217c3ee6ea7830f0f34c8757d06a6703baff51b6f7d2a0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 59.9MB
        • SHA256 ef89b50fa1915e1b6ba1a1af978f3a8b01d3844352f4f4efa3d5180757d711be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 832KB
        • SHA256 b983604409cb7b55389c7b3aaa4c83e30ffa9318f52a36406ce2a03d50073086
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 59.6MB
        • SHA256 321ece8108777862297216f254f4307e8302c01e2a8356dd89ee57be93d0334e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 59.6MB
        • SHA256 6af80accb9bc4d9ccf86e20126abb2f46dd24c55dbb959831fc7f62062be14b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 59.6MB
        • SHA256 86f48593585b9cb42000280dc7d4ffebfc9dcf9539900ce013ef74a64c30e867
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 59.6MB
        • SHA256 7a8747a21e5705251ac6e86ef8eea191f5ce7fc78b0232742353a1b3b0c0f32c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 59.6MB
        • SHA256 ac76167d643b829d2f25fdcd5b1d91b78d900baa583d9f58c13c8c811086879d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 59.6MB
        • SHA256 5769911184b28391a00a554b7947fb5d83d023d86ed15ae66626a26ccf549912
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 59.6MB
        • SHA256 b9c544ca7ce37ab177177c548c3c4d0b5ffa547d0ed31a47b524a2957da2ad87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 59.6MB
        • SHA256 57ab21482a2f66ef0c100d3287e43f88baafd10909ba6ef2486064521781c68f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 59.6MB
        • SHA256 c8c97df0127c1f9e3987f504cf2ecb3839c9e1ff998a5baa2f87732a541e9607
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 27.7MB
        • SHA256 578c367c3a972b30780bb15dd2b72bf659a32c698f37c4408faf85349103fe39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 24.4MB
        • SHA256 e2617bc9adf63d78b4c2919f9ae1575d954eb1f76b21eb965d07f6243a8428f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 22.8MB
        • SHA256 078a0350fb830b72782511ec0087db6be58383b54fc11997409b98ee124b2da7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 21.1MB
        • SHA256 32f1e69a8b434fc8d1935e8de5f072fc9c60cf3d45a0e7304ef773bb16e385ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 16.9MB
        • SHA256 317ff3de53881013a314a336739875a0ec38e43bd65c7cb6b37c8cec0c107ba1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 18.4MB
        • SHA256 ea013a72932eee4b697bd40bdc45a105d16725ae67f0e284efbe6af58d001499
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 12.7MB
        • SHA256 b00877265615c59885487e981b1c864a8d91016f9e1d63be6e7cbeacf0482cff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 17.2MB
        • SHA256 2080a7c24ed7bc3f6b7bd39bd4433fd1e5159c39dccfac82f7412cffa131193a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 16.4MB
        • SHA256 729cb265a02a2ff043cca870d3614042486ba0cce4d4bad7eff451b04f9b0178
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 15.7MB
        • SHA256 b3d527922741f4cbc3366f614628c1ba4ae4e2aced3f1cbd2aa65679fa92bf1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 59.8MB
        • SHA256 4d9a5a984c1a7ddea94234b599fec929cddc3af047620f82cb70415ef38d99c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 59.7MB
        • SHA256 ab68a5f21272cfeed7307ab92b0680abec47859d6816718f47b86d574ee52858
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 59.7MB
        • SHA256 c11a61eb31baa7a94e890af9e746ec0df7f61c42a83686d7257c2af3d918cd23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 59.7MB
        • SHA256 08f4f5295de8ecf9baecda2b107202cae3c3b0701e2ccc0a13feef68c14e9b6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/828-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3424-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3424-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download