Overview

overview

8

Static

static

3

2026-08-18...r_.exe

windows10-2004-x64

8

2026-08-18...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    136s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    18/08/2026, 17:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-18_5f647a87a7c2d8a08d672af805c32f13_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 7.1MB
  • Sample260818-werwsaxcpf
  • SHA256 b68ccdb1b222ca15ca73a1d4c00a0920de85c2f4c1e890e77cfb4496ecf4eaab
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-18_5f647a87a7c2d8a08d672af805c32f13_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-18_5f647a87a7c2d8a08d672af805c32f13_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5564
  • C:\Users\Admin\AppData\Local\Temp\2026-08-18_5f647a87a7c2d8a08d672af805c32f13_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-18_5f647a87a7c2d8a08d672af805c32f13_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3392

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 7.8MB
        • SHA256 fd09e1bce381ce0facbc07a5d7591f3162fbdf18314e516e39b57f6f2eae3abc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 7.1MB
        • SHA256 b68ccdb1b222ca15ca73a1d4c00a0920de85c2f4c1e890e77cfb4496ecf4eaab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 14.5MB
        • SHA256 973d60b26f0da8f2e5669014ba622085ad781c6a402958b7833dfbf0aeeddcd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 14.3MB
        • SHA256 08f63bddce7e834d39dcf999a123fa64df3f8964094e274479641003be7483a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 11.2MB
        • SHA256 beedd6b99af5889a28531b88394ec0334dd6e081373bb756b462819523da29ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 14.6MB
        • SHA256 bca82cb77222a277e90881ecd850a9b4e3acae57ed5379efb4ad8cf8e58f9546
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 9.3MB
        • SHA256 925e50f9b0978e9b55095cecfadb7834c2fe45f20bd6d17142362c7d6767fc8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 14.4MB
        • SHA256 f56a715a132c87dfd0b7f59e0b054faf97dd6364e7d9b52945e91dc2741eb0cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 13.2MB
        • SHA256 21ef794998a308f5deaec1011bb229ae7d5e023239348dd2496032f1529297b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 20.3MB
        • SHA256 e432b4231ea8140e680f7f8aaf2470562d1fdf9637c2c8c09c5039fe99a13aa9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 16.0MB
        • SHA256 a10a28c05b90348704b1cdc02bc6712b894f9bbd1ebf00e9b42a9c6800cbea82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 16.5MB
        • SHA256 169067c7a1dbaf6edf5268b5f5ff49b9176616d7ab3ad989f97fa1565437b4e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 17.3MB
        • SHA256 587db20bf0ba28e8d32f1c5c80c9eddb85325b4b1862e792da6609daefda0841
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 15.7MB
        • SHA256 c9eb8480463d2afb2dcec483bc58c93dcd6785a4f9c7da2bbc008d720714d756
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 14.3MB
        • SHA256 6eda8719015f042ecec3cebb053ef41aa0be2322a3317c38b589affa49a65466
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 14.3MB
        • SHA256 098104ad613d94f6ff41f82d16f8692e12719d36c88bfd9681acf65f7edde301
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 14.3MB
        • SHA256 ab0399f35d4c7be1fcbeb52ff9c0dccdf85b47b4dc266afe935f17778b55756a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 14.3MB
        • SHA256 86c8b1338e9a9c1a703b410ff430206c9853a4c2244223c0f59716086bf775ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 14.3MB
        • SHA256 d6f46457179a1dae49f4ab5f6defdd8d3748a100c58da8321dfefc4555c63668
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 14.3MB
        • SHA256 3212e03fbdae3ab1ff4818f34cf4072467e2cc3069f7edfbda9945e8788d11ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 7.4MB
        • SHA256 869f49b4098ba0e9adbb391717dc3a45c90ca68e257ae897009cd749fcc8d23c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 14.3MB
        • SHA256 588c0c50fb603e8358311e81905fe4707e585beb43970446d23b9f2b7daceef9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 14.3MB
        • SHA256 b6f44c5341e7b09974d6f5b81b05ae66586e937a1e681b6eeda0f5e66c4c026f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 14.4MB
        • SHA256 2bc5aa4e478ecf0cd178f4f4d6abcb1abf5b4d2be47a4a0ae7cda45bdfffa363
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 14.3MB
        • SHA256 6cd67eb0be99e6a00336f62eb1361475d14456f94389870d280612456309ef05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 14.3MB
        • SHA256 247142343337e6d7ce930a1db722bcebd85d8a8edea816d7e6626467b9acebde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 14.4MB
        • SHA256 5b9b73c402608e9a346644e92aa8855ad1a985133cbe72a7b5c16a1149ced651
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 14.5MB
        • SHA256 1a166f29aa9b248ffb211838f9e6e03f103b8243ac0dccd5db4eb5793563dcee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 14.3MB
        • SHA256 71b1382a2f33a707b911b8a646b9be9c0c1762abf5a81986d93e33096a511ee2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 14.3MB
        • SHA256 b13f2df428dec864f37873f93b2c087c54ec1a7931e17fddb2059d8f9d3e6378
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 14.3MB
        • SHA256 0f8ec82c9086b586eb2b1a7330e8f69dc2b3fdad3695775c18d5227bb31c25e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 14.3MB
        • SHA256 35655006de5d986abf3c734f1f7f8f9e517fbc2abd59d1337c91e3ed2d689cda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 14.3MB
        • SHA256 4ba00474341b417ba2ec288296a75c7268ce07e4fbe710626d1ef5a7e1c9105f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 14.3MB
        • SHA256 cc9c47bdd711c8e0a5b830e456690bf2f7c449f12b67b7bfe0e87f5bab9a4827
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 14.3MB
        • SHA256 cdb7874e06b296857793315e1b396f54f3e976e19def7a2a2446419c19033585
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 14.3MB
        • SHA256 fe1f3a8635f592ff9d6727869caedf2b2ac4b4ffde5a4cd2d46b18983d80510e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 14.3MB
        • SHA256 04f7bdfe36c673de44bfe4283a7d874cb7d0ab79c5c239702e0ff6834dd663fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 14.3MB
        • SHA256 ca3aa0b3a5ff83c45968a6156d108a083e5f0842be4adb98e39b6d23f676340c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 14.3MB
        • SHA256 bad0107f17a5bd1a16c19bf92ac70a4bd7a9d81348be2c7c4b52d67c9cabb4cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 14.3MB
        • SHA256 0624c46f7ccdfe73fb42695ecb1d13617b310d0b5ff4403246c45a6f220ed9a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 14.3MB
        • SHA256 b9fa81398a5cc8972e095a9a3175df9a59e0de66c93804052622bee2223fcc31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 14.3MB
        • SHA256 157bf5a40a78e69e4c512c0c20cea2bac9ed747218f02b6d6d9e793395b21f79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 14.3MB
        • SHA256 c23d417b87893a45f5759af38968df2f52e008740db063469eb51c19b99dd387
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 14.3MB
        • SHA256 c7b5d7de1cd58d47de01c0faadd754de12427748e20b5ac276b81802223c69ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 14.3MB
        • SHA256 57380bccf74525890f9e603e30c84f6f5a66a234544a7e4e110c856557127120
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 14.3MB
        • SHA256 900deb054eebc65048ed154487c823cff479064cc1616c00fb07be953ef901b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 14.3MB
        • SHA256 a76e4b41c63a6893ac05459906bf588dd7187975fdd9083be331b15abeb435d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 14.3MB
        • SHA256 5f34717e1b50688c00344bb912227746b0fc6993fa86a4d9d39f79a1d3568e73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 14.3MB
        • SHA256 cb9769a97abb3121814358df762af6f5fab43e82c4222c17b1cb322de937c5ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 14.3MB
        • SHA256 9006c49f72379159d96129041539befbbb7be280124149031161c9933e9f9658
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 14.3MB
        • SHA256 679d05e0cae33bf73e283f2188943647f2cdd771b83bd268fdd1ac57df583d15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 14.3MB
        • SHA256 b6de9069b369c0323269eb75b62adc5a2ece2be11ba49dcf2e82aab591d714c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 14.3MB
        • SHA256 a5e3c5aa0f1a2793d85c0c6a32f9e34732f398635b64924017ca3e1802d4bd60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 14.3MB
        • SHA256 09776d3907dee9f67572b9bec2018ea5a938e415bdd72ca192c497463349a276
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 14.3MB
        • SHA256 86b82ae4f752c10f6c43c5b44bfcd550786271ab434e711fd0302b4da88a265d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 14.4MB
        • SHA256 47ff8aa71102166275701760cb080244c45c0173893760de47a8ad8ff131e389
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 14.3MB
        • SHA256 2e4662d5ef0438578d7795c018c861719c48642ed590001689f9c63dcc2c4a64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 14.3MB
        • SHA256 b48915055248f63a311c845b170cbe3e23bac334e812fc318427652bb2ed1487
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 14.3MB
        • SHA256 57a159859fad038a1b4b6c728429974d56e500d4ca0bf579605938b82993bca0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3392-33-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5564-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5564-9-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download