Overview

overview

8

Static

static

3

2026-08-19...r_.exe

windows10-2004-x64

8

2026-08-19...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    84s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    19/08/2026, 03:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-19_f59d8d69f6b9f6b5a67889d23c044072_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 14.6MB
  • Sample260819-ecl43swcph
  • SHA256 bd36d7c564a6ff1fb416e69345e0e317d45b68466e317c04f065d619ec2fcece
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-19_f59d8d69f6b9f6b5a67889d23c044072_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-19_f59d8d69f6b9f6b5a67889d23c044072_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1012
  • C:\Users\Admin\AppData\Local\Temp\2026-08-19_f59d8d69f6b9f6b5a67889d23c044072_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-19_f59d8d69f6b9f6b5a67889d23c044072_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3756

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 15.2MB
        • SHA256 93d95e218ab5f2fc9143bf6fb498ecfa8256c690610055c09351f719c3b143f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 15.6MB
        • SHA256 fe8e0fcd2697a040340ea1eeb917a5cd8bc61379c65542bf3e44eee96326e322
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 15.3MB
        • SHA256 18e4736544b23baeb76dd1e7595fbe1302dcfede213cbdf50b656a3900e49ea4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 14.7MB
        • SHA256 feb8d5890d8ce7a32e8ca2c1f5c497f4be17c779a3fd8ea6768763dc2734bf18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 14.8MB
        • SHA256 43b999a772b25ce5806570d1e5aecaac4e1ab3f9fb9d5b1eed9e8efcd4d9a737
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 29.3MB
        • SHA256 932cec793aa839e012093069fa1e7a33402fe4a7635c3f12c594f63484549aec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 29.3MB
        • SHA256 7c539a4445ccf7a1d4017742b3faf628d7d6f7314a2120358dace60819446226
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 29.6MB
        • SHA256 7c9968e05b88a8de6a4d165fb953d0602c2503780d060a4c3960e5c800c64747
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 29.7MB
        • SHA256 293945c81d3a8cfc5c2a260a858db3a14a2f445a645a2ea75d4dbce8e40577c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 29.3MB
        • SHA256 75b9230324690a1272fdec063cc1285790f9c3f8e2301586e1357596b41cd240
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 29.3MB
        • SHA256 a7452025a9baab43c925b2d2e1801f0bbba8796e70a576b5e46d7560ba1a6d48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 27.7MB
        • SHA256 f20d021d19044c9a53363e7c336d2587ee5d3c2ea3b6dceba3262dddec3ebad8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 26.9MB
        • SHA256 57bac3c1369283d3c266fcfa1171a54265e02c45f1bf7eab9d5f7cf3da3c0490
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 28.2MB
        • SHA256 fdbb6d8549414f0e17fae6552a15d8c97f075cd282b410af7e552eecb16d1d94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 26.2MB
        • SHA256 3854274437387d1e47e9a3400a3a90a45664173677f5f2e71a7b7e633535e3d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 26.4MB
        • SHA256 8f76eba68b642c910ec45a59d0aa724207d585e25538d3fa01188ef48f27861c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 26.2MB
        • SHA256 c04ff8694ce9f1f2226c32a04aa405d553ae0ff405fbe1a89a5d598faabb17d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 28.2MB
        • SHA256 f2f9d92afeba43687f7c0859c1623e371f341c37b3b17308fea31ce0e5b1de08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 24.4MB
        • SHA256 8016f503edc92c67ba9acbe5d0b8332cc50dfab89d131c98524e905ff3c83e3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 25.5MB
        • SHA256 5508047f611da0347ec499e203dec44207c07b10f00ab43267ff8ffde516cea3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 25.9MB
        • SHA256 30ef760ffd45afd308a4a74df8f1d2c64707a94b423121d9ed2c93891cc0ae02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 24.6MB
        • SHA256 aa9e9b8a9ab7ac69467c9116c82ef196d14947360dedf1c82389c6529c1691c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 26.1MB
        • SHA256 df6c610e650691bcefefeea2eb5f7a144a4e400e90f61ec06bf1554ea0c626bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 23.6MB
        • SHA256 8cb2e730643f800d02ec240cefb36fa19d43d4740816a6a541ddc8cc8df9b9e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 26.0MB
        • SHA256 a71947275fc16710d84c936eb45d62fea2d6a310fb68b2977f39f8c18bd34b50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 25.1MB
        • SHA256 00ec0437cdb943f28d44216454ac5d146a782b77eff144b60319ccbfdaca933d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 24.1MB
        • SHA256 281e73976f330f07f80d1aff945e3616383623cfbabb40758956474ca952ab2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 23.7MB
        • SHA256 dc3863be685bb77ab426e5df03cb56c17961662d720704b73f38112173587117
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 22.9MB
        • SHA256 3455f02b8c28a59b262bc5e06d18bf5f945da995fdc993034e29233846282552
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 22.2MB
        • SHA256 d3f258cd5b861e26f47e24dabbdf69bfebd60d75f909522cd937eaa8cb57dff0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 21.9MB
        • SHA256 7307195cc332ba4087993390def5d57feb9a85317ef0d7c039fcff29961d00a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 23.1MB
        • SHA256 34928d975a220625d32d274d5e17ec14ddc041d451156056ed87ef0ccada2a97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 21.9MB
        • SHA256 d1639a8677d21458d22ae311655a9617b8d278bd3fcff8cbcdebe498c0c4cb50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 20.6MB
        • SHA256 17d924d6d74726ea59721bcc5164a0d0932fa13450249429710980861cf91463
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 20.6MB
        • SHA256 947848c420427d8a089fd7684e19571f01c0ad481b58a48da99f737e0795e6a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 20.4MB
        • SHA256 e8d0855dfb43c61e3322f7b5802dbf9d90a5fd0ce9b8d37ae47f60ec0ce7ad3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 20.9MB
        • SHA256 6a0e87b54f20d8ad62717d1ba0260db0631aa5edd1e89a16dc87c88ccddd4b2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 21.2MB
        • SHA256 60fb192bdf7d813b9cc950e0d5836d27f3153b11dcf1c43db8e8b31893d14e72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 23.8MB
        • SHA256 bf2255d3472b02661326de48d5c79005edd8bcc532f66978099e0a24f96ae58a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 19.9MB
        • SHA256 db3eeee7708f49583a0812694a91e2315438ea09bc91cfb2dc31e451fa044509
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 18.8MB
        • SHA256 6d9e7e6f7a55432097d3f47ad84a04b17ed0b14cc6922e7067a6feb0763e0ade
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
        • Size 21.8MB
        • SHA256 6fd766504a3788406efecf9400eb1236068c803392e9da9971565e0c502b64ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
        • Size 19.6MB
        • SHA256 ae71da2457974d82891ba0716c85a60822097bba0c8c583b0ea78e972a87e510
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
        • Size 20.8MB
        • SHA256 8f12fcc08992f8a19a5d115c86995770b8d99466f95c2eeff47826b8f52d7d8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
        • Size 21.7MB
        • SHA256 fa583ee742ab023d36b12b5378aa02ca30998e8930c51b62314f109b97e90533
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
        • Size 18.5MB
        • SHA256 a3e48a277ab3902b1ba79cbc001b212ab795e140f22e743911fa6b0a1a01e44b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
        • Size 19.3MB
        • SHA256 b561df4affed1e7757e4733b1c1fc610bff0dd04df71c65aaa997d7aec13d22b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe
        • Size 20.0MB
        • SHA256 7205c8965bf4bf264931a40acf913af1485ee14c5d227bf48bfe2d0cf2b865a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
        • Size 19.0MB
        • SHA256 e13dee345dee754f96a504871dc4e876be7202ec44b63afdeded5abd844f0392
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe
        • Size 17.9MB
        • SHA256 bbaae1d8bae08d56bd1a06d621887fa053cfa0da59ee199e8ec8752544ebcbd1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssvagent.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
        • Size 18.9MB
        • SHA256 7e41ec92b62482080dfc30d886e3e11aba6b70c024d24cd0f2ee46e37d100b37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe
        • Size 18.2MB
        • SHA256 9778ebf25df0a79669dad5a038b938373be534823a2d4ad16507e589c48d6186
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 14.8MB
        • SHA256 e4fed5908f7171b98bb68bf56bcca4de50bf31c949c70a7e42bb75e1ea11e460
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 14.6MB
        • SHA256 bd36d7c564a6ff1fb416e69345e0e317d45b68466e317c04f065d619ec2fcece
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1012-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/1012-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3756-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3756-6-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download