Overview

overview

8

Static

static

3

2026-08-20...r_.exe

windows10-2004-x64

8

2026-08-20...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    135s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/08/2026, 03:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-20_0a618a46d11a623fd0d1d900ea55233f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 21.5MB
  • Sample260820-dr2mmsbb75
  • SHA256 f31a092c28bf64566efc6da0f5f03003f8e2b1730be4354726ea07f76cb52c31
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_0a618a46d11a623fd0d1d900ea55233f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_0a618a46d11a623fd0d1d900ea55233f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5836
  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_0a618a46d11a623fd0d1d900ea55233f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-20_0a618a46d11a623fd0d1d900ea55233f_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3688

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 21.8MB
        • SHA256 ea82a105b6d4807283687686635d88188a95d762f21c7e72b8e95c31a1c0919f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 21.5MB
        • SHA256 f827f086f0b0df405cd4dabe7e48428fb4cff57d3aec0c5fa43d32cd410a96d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 25.6MB
        • SHA256 dc765b5a353dd2b35aa97f2227ea42b9b04154ce0f15d49447d3a64197c2a064
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 21.8MB
        • SHA256 96b0c281f41e71670b16e2af2f2c0858ccb74d42b01ce274abf52299dd2f3eb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 45.0MB
        • SHA256 c609170a847100d40fb2200e6e769572110b3aa47cb2fd0cf40c983048df2e10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 23.6MB
        • SHA256 1241dd9dc70c086c9c7078f5c30fe1397dd21ae00a29cde21f1dfeaac239b5a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 43.1MB
        • SHA256 291e1e3b8ad7149a4d6269a52e270f52980ec3c95a1223cf8aea6ebd3f93dc20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 49.0MB
        • SHA256 5df46ad39ef4291db9b3914cb25306a30f7bf592b3ba34401993127eea7dde8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 44.7MB
        • SHA256 1cc2c5c2005be5afcf38276e6495b27b5d762aae9ed25979950bf7c56bb81bc9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 46.4MB
        • SHA256 5321e17285cac7e08f01ab0cd2aec30048ae1f19dd3d04d5ea417b085ebd47fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 44.8MB
        • SHA256 b7204c519a419542e684bcce0c04a837b8dec77faf77e7cd3df779f5e4093c45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 44.4MB
        • SHA256 54d983fd18899be9d083ff434e0ac8697cbb59dde2ba8009e2ff538c02cb4ce6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 43.0MB
        • SHA256 e5f401a531bb906ca51b8594ef450c9797f704df1a7042400a9563bc0f6a88ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 43.0MB
        • SHA256 502201f05827b12b58ff459d22f318975bb0214813d62fc9aa72477cecb7a38f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 43.0MB
        • SHA256 06825d157f16b36e3c94fbdf86e7adc638d0945fdfff485e649039130a6783bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 43.1MB
        • SHA256 f2e8aa7635707e9e118afeb80c3786eb97e536f7b08744bc75b000d6b51305be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 43.0MB
        • SHA256 1a400d1b4804f60dcb70f85bbdbb98705cea3fcc3cf9ea0b1c72bbfb96d6854f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 43.0MB
        • SHA256 915828740afb510090bfc6c9d2c3cbc1c0bb7818702bbe15d8a715796f9b7390
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 43.0MB
        • SHA256 8ad8838463c68fada51ac0b31fba294f8d441d13155004c404a68defde194896
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 43.0MB
        • SHA256 d4cc94f2a6bc490e60642d6bd34b62447244d01a3300ca340a9bfe7789f9786a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 43.0MB
        • SHA256 af0ce3c646328bf86ec505434cfbe67d1313f59e4e62701a8040b789211ee397
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 43.0MB
        • SHA256 a4319b63f074d6de536e1e56b29d46eb02395b185449a6042ce788a04f104572
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 43.0MB
        • SHA256 381a946817605ac27c4f09fc8a8783a9d243a449b9a585d207cbe11a9e6c0495
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 43.0MB
        • SHA256 26c3e1b51d0022629d5ace068f69f823c44ea3f8205b399ce21ef7ae3158bf4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 43.0MB
        • SHA256 6f6eed44a49043c8446124ed1e87c7055c89bda8164e7431d99374409b932a66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 43.0MB
        • SHA256 0e7f8da1e062e43e5c6c36a9c9cf4d0992e99112fe19af8b980006cccf9eea91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 43.0MB
        • SHA256 4dd0523e7be4b80e23de912ae660711f68bdf5a0665ddc03f4dfd4d6cf5b1d56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 43.0MB
        • SHA256 5d682919e7961b94ae61fb52e8feedea31c4336a3dd5650d256f56dfbff79660
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 43.0MB
        • SHA256 75523ba0ebdd4bff707e80ed544c8c817011efea449a04715e4bef239ad20085
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 43.0MB
        • SHA256 62b56d0806f46bd436393bbe5818b8e517db8beb5b1aa3e2971cf0bb039f7f3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 43.0MB
        • SHA256 5874ce4cf02e51b232402aa680325011e4495d779300e3a61468ca810ffbc4b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 43.0MB
        • SHA256 3478b98ed1a615db4cc6e25193af98c793a450750db51be658794f3fc3645ebc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 43.0MB
        • SHA256 50ce75a4dc2250054148958d32340796fa009cbd837f79bf7aa0d3b9f990d582
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 43.0MB
        • SHA256 4b523535779cac07f7b9815b2683fe7cecc6a837a1506b72a69e48d0dcdc77ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 43.0MB
        • SHA256 6cdb460869eda0ac94d0058057faa9186d4f8a2c1e930641979cec01de54e455
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 43.0MB
        • SHA256 09706bae1bf481fdbc7b64ea9a7783da116b8d10347438585f80ae485f8944c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 43.0MB
        • SHA256 f5a73c5839d63885365456e18a17008f9ccb498ba0f033bc338ed2cf0058d45a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 43.0MB
        • SHA256 96eea51d3768ff48cd6050a1e7f00be4750bee0c35602531c94a9299dcc37413
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 43.0MB
        • SHA256 024dfea741f53212e512b868c461b224ff16cdac894df9a78d2d2f07bb3195be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 43.0MB
        • SHA256 a7440e671ebfc2aa36772e93e93882a026cc8628edda10a46ef0414a14181045
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 43.0MB
        • SHA256 c591c4630795f666655ea7bcb8773aff34588be56d932c4e0d24a321e4b315b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 43.0MB
        • SHA256 03b2aeeddde74b27a05dc560887d657ccbee414a4c913c883b0e84935367cc7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 43.1MB
        • SHA256 393a0f9ef1936aa4acc586a4c7ecb48da0bfed31f074ee405a76f62503ff1532
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 21.5MB
        • SHA256 c3876d3d86f166e8c02960751bac62f22f6f03a7099e7a7cc8981aabbe7e5eaa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 43.0MB
        • SHA256 88e65ce55df97ce5ad32f16af938fba153bd2a3637b06e4f5768eeac4a187575
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 21.5MB
        • SHA256 f31a092c28bf64566efc6da0f5f03003f8e2b1730be4354726ea07f76cb52c31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download