Overview

overview

8

Static

static

3

2026-08-19...r_.exe

windows10-2004-x64

8

2026-08-19...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    19/08/2026, 03:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-19_f59d8d69f6b9f6b5a67889d23c044072_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 14.6MB
  • Sample260819-ecl43swcph
  • SHA256 bd36d7c564a6ff1fb416e69345e0e317d45b68466e317c04f065d619ec2fcece
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-19_f59d8d69f6b9f6b5a67889d23c044072_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-19_f59d8d69f6b9f6b5a67889d23c044072_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4376
  • C:\Users\Admin\AppData\Local\Temp\2026-08-19_f59d8d69f6b9f6b5a67889d23c044072_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-19_f59d8d69f6b9f6b5a67889d23c044072_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3324

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 29.3MB
        • SHA256 e7d18af164e7359d2b2849266a1adead036a2dab6716d9f35112dc5db627f310
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CloseReceive.htm
        • Path C:\Program Files\CloseReceive.htm
        • Size 29.7MB
        • SHA256 f658835ce09305e883b1c13ee924ab8501fd268e040d0d1b862801f69092b99d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 29.6MB
        • SHA256 58e62aebc57d563e5c30c06af113042ada414955e9bff85933d93f5b32631662
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 33.4MB
        • SHA256 c516f7a4a41c9e70028df8289bdffc609fae54cf93fb1ac82c3347f50e1dfaf1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 29.6MB
        • SHA256 a90bd5b96ccb3046a15b2913d89fab0c1fc8b59510bf7618966fc5622c2081dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 52.8MB
        • SHA256 28376160124f6968612a30be6b5f7c15fab2d898db3192437ccec60d4221ef0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 31.4MB
        • SHA256 32cfb10b55bc778f21290493efb449704834b6ef9c459e93cadb729f591b0667
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 29.4MB
        • SHA256 be13f9b8439bec7ac3d9a276ec9bf4a4d692ed2832c93b45810e96a5b0c9bb8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ConvertFromUndo.htm
        • Path C:\Program Files\ConvertFromUndo.htm
        • Size 29.8MB
        • SHA256 7962d7dffe2a885a78386b9c3e1d30e82fef2ea1afe8fd4561eef912921ff136
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 35.3MB
        • SHA256 544e9da1d3936f6d878e721a9d368fd481323bdc900ec9bbb5182aabe9a3a3d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 31.0MB
        • SHA256 fc232db365af56d4ec99fb142fd3dbe150b77451e487de512e9cd5c7fe1546f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 32.7MB
        • SHA256 f7088a55d6baaaeb9ca45e4c0ea65a68addae0d7ffb3ef09d97cef9857b4447a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 31.5MB
        • SHA256 ca19759da781ae298b0847c31322e3865175076ef13fa70387c8755e0d7d6e73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 30.9MB
        • SHA256 65cd504062c035aa6f4837c5bdb0fbbef137bd9f9c560d0147e1639a2d6971b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 31.1MB
        • SHA256 c06b4e04081529518731e1d76bc5e00fd07659cda3270d625e7fb3dea2ad5288
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 32.4MB
        • SHA256 5d4eeb92e7b5f78207c4691955c6db3361ab53f58a4324212b46069f1dbed46f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 30.7MB
        • SHA256 9e847526ad1b3e3ce769b661cd3e6fa1876d4142b26e987ce827db28e3ed364a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 29.3MB
        • SHA256 b2d2c6f061f0a8fd5374c9750041ca4a278ec81861ba9937432cdcb8ab109b08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 29.3MB
        • SHA256 01099d6d176337d6a99dd844c7f79061f474542a2b20c9f610d4a218dd0773e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 29.3MB
        • SHA256 2024f5f8a707d4a21a0614adb07771baa498173a18f9ddbd13e04faa0a0a9eb1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 29.3MB
        • SHA256 7253c95cd92a924a25360eb304ccc96097d42440e73a589f8037a8272a9ca69c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 29.3MB
        • SHA256 3562f2e528a32e746e4fecc75d90243f49cd7e5197e4755a3789a43f9a2b7c4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 29.3MB
        • SHA256 752b4a545bcddf79da9dea992f44f4715cd16d001d5bfb4b80bfac10d906a8c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 29.3MB
        • SHA256 bc13544b139794d1f74c5b768a9719c6c54cb6ec37b413c795625d40dcc55098
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 29.6MB
        • SHA256 51809fd293811d9176d3cdc2de1c9ccea7b85dd7c794a0423e48725ff96cc54f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 29.3MB
        • SHA256 e3755d067074739d960cfceb46ac68a2eb68b99fda313bfef4fa8406f5c5e5ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 29.3MB
        • SHA256 4078f8c7247b4b803d08a233842c0c796cc5abc767ed36e60ffc72a6a252ec5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 29.4MB
        • SHA256 663f7fb897709b5bcb22015c1f327f3d9ce4ee7649362dd26c9885f261a7e21f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 29.3MB
        • SHA256 932cec793aa839e012093069fa1e7a33402fe4a7635c3f12c594f63484549aec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 29.3MB
        • SHA256 7c539a4445ccf7a1d4017742b3faf628d7d6f7314a2120358dace60819446226
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 29.4MB
        • SHA256 b4300f1ec0f0f09256946d232e264c15cea065520ba17a3e0ac3f3f6c62270cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 29.6MB
        • SHA256 7c9968e05b88a8de6a4d165fb953d0602c2503780d060a4c3960e5c800c64747
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 29.7MB
        • SHA256 293945c81d3a8cfc5c2a260a858db3a14a2f445a645a2ea75d4dbce8e40577c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 29.3MB
        • SHA256 75b9230324690a1272fdec063cc1285790f9c3f8e2301586e1357596b41cd240
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 29.3MB
        • SHA256 2db8254e4dcc2bd716e9d4ac9e10e88942876ad57b254074407ea90ab50919c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 29.3MB
        • SHA256 a7452025a9baab43c925b2d2e1801f0bbba8796e70a576b5e46d7560ba1a6d48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 29.3MB
        • SHA256 73edcddbed2f6ad679a3081009bf0cac8c926ae2844a16b09c0543f36cef01c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 29.3MB
        • SHA256 37db7823ab4d0e03419e723140a8b7ba0f87ed36ce7ac2620fdce455e975ed45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 29.3MB
        • SHA256 403194afef2b4a1c83b3319b139ddad34417af031308c532e4de3d911b41c94c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 29.3MB
        • SHA256 b471ae02e3fb261c87c076b5faeb4ffb2677b8309efe434d611d67146b767608
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 29.3MB
        • SHA256 6d7f146f310fbac5969489e861fffd77667ec3f538de696b5b68e189dbaca4cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 29.3MB
        • SHA256 171b537f8b59c1da3818c0300fb96a30ff92ecd26acbf34aa12097449a28a97d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 29.3MB
        • SHA256 21bb97ee3b8539e2818170ead5d771ffb4d82928b9b008bc2d7e0eb035d3cb32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 29.3MB
        • SHA256 c91f108906341e0d251b66671c407f62460bb9042d802be8a08ce392e5e8b45f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 29.3MB
        • SHA256 c0f36f9523f74e295356c0d77996ae0d80bd06dd99781004ab2c15c902f81083
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 29.3MB
        • SHA256 bfbd15079b99a6d29ce71db3867de873e63d75c9687e2853b9dca1f5d7ccdf82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 29.3MB
        • SHA256 32993d1cbf7c07942948dd67f73e30fff2a2cc65add9d7b47e60a1209b716701
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 29.3MB
        • SHA256 23a8e1c5a3196d982b8e01139ebf5292545525ddda7d2eb567733751ccde9131
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 29.3MB
        • SHA256 5e5eca27804bdf1a4bdd4d0e01dd83549b0a7b0a7222978ed6a37cb79b48cd63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 29.3MB
        • SHA256 a24d804bb0433429a2da830cb261b56c41a7341bcf0cd7f075ab380f48eee6da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 29.3MB
        • SHA256 043d8817305a3b2556029b9b335334e5423ed9f5a551e05edcba1796b9b5a015
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 29.3MB
        • SHA256 2100d36a0c25427478febcb402b4eee3e9f617baf2ab83b7d64fae02ddc33556
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 29.3MB
        • SHA256 06136f1a393d4fdab4a844297191081acb32d379c11232f9b26acf72c7662c08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 29.3MB
        • SHA256 bd6a5ee71d12bc03e6456f6540ce7e51934596b5316ecab8943440b0175f711b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 29.3MB
        • SHA256 a1c3e29bd3fdc134375d6b026e6045bb9d8ca062fd4328ea5883c0e2f2a6ad89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 29.3MB
        • SHA256 282f0dadb4dc03116220428a0ca8c9b0c4148b9bbb630a2f02b2dc94757fd1ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 29.3MB
        • SHA256 4e2d47f2336ea87770ccc75bb9f71240f4b434a834d25e7b289e4663fa36daf7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 29.4MB
        • SHA256 3229a874600e7ddb5ab04573e0193556f2204ce3e8a1e03644a41a2fa76939a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 29.3MB
        • SHA256 4694e002c5a63031e2e40e19ce536695566b62edea22501b1f9682ed7131ae6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 29.3MB
        • SHA256 6af98835115850430f5d593ee16b40bd78af4f2cab842159d49408205c406b6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 29.3MB
        • SHA256 ef452d12c293635a901cf92319fac2be11b93095082a2e779318013151951e8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3324-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4376-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4376-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download