Overview

overview

8

Static

static

3

2026-08-24...r_.exe

windows10-2004-x64

8

2026-08-24...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/08/2026, 22:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-24_dc409fd02693626170bc6aad2d298329_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 15.3MB
  • Sample260824-2tr3zsfc97
  • SHA256 426a57078d776db9c93555da21271b7209894a46796b65d2f0f69c9d9923db0a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-24_dc409fd02693626170bc6aad2d298329_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-24_dc409fd02693626170bc6aad2d298329_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1128
  • C:\Users\Admin\AppData\Local\Temp\2026-08-24_dc409fd02693626170bc6aad2d298329_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-24_dc409fd02693626170bc6aad2d298329_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2164

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 30.6MB
        • SHA256 3049eec9efd8461460db3554dbc03f75e0896c38c71ed34d0b829dbc7ce4e007
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 15.3MB
        • SHA256 426a57078d776db9c93555da21271b7209894a46796b65d2f0f69c9d9923db0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 15.6MB
        • SHA256 214f0f90067c6f927d86649e542f97c2708e4611119a2c0370e12c7e07d28651
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 54.0MB
        • SHA256 f889d9a9b689cde6e7c406e1397575acb591803bcec4d70dd534c213af0e8ced
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 17.4MB
        • SHA256 ad2d10dc057fe325cb5f5d8a4a7be8825a69d0c7777fac4f8baac2e112063ab6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 36.6MB
        • SHA256 4fa64ce6b9744f152c8e222590423cd26dceb735c8ce1e27927950b4bca3615c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 32.2MB
        • SHA256 a426f2f84755c73bf737b1de19c5efcada17fa78c350cc1acfca460d9e51d7c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 34.0MB
        • SHA256 755bddfd75164000625980080426b75fc0cb8180fe22abbd7d1e61bb2be0f90d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 32.8MB
        • SHA256 ad4a20927e6db42959ba236f5b7feaef34cc34a92eed6a9176895f6116fe643a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 32.2MB
        • SHA256 3421938a8063deb0d27ae08188d17c0053c2d7987df6f01aad62c2ca00163332
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 32.4MB
        • SHA256 d679889533c87c8f302854a2d5424eb1a466d0789fcf856b0279a0cdd44094cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 33.6MB
        • SHA256 b9d7e3c51304689bd54f45bfa60eb0485b34ca068cb2a409fbb3b98b43d17ff6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 32.0MB
        • SHA256 8c2e77462cdf4bf80d863d6b712d579d4336a0ab0738462f7e6285da37593421
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 30.6MB
        • SHA256 3ab479c97233a9e9d835423407b1fd28543e6fa6845e2e71ea7a93ba60b31d4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 30.6MB
        • SHA256 1da9e48e8571e3e51b02b65afc22e40a73de2ad3e44089c97634bf52cf1fa6d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 30.6MB
        • SHA256 cf2c3a31b74a0b159c60ae67bbec7d73c11e9092982761f9e330ba8a89f0a752
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 30.6MB
        • SHA256 458814734571fad3dcc0c478a992161bae0c11fbde3eca0abacb32b106d8ed80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 30.6MB
        • SHA256 fbe3a329c898d06a2767de57930f9e82ef3a77b4e6d712e90916e764cbeff47d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 30.6MB
        • SHA256 4bb62ff0e429a556bb79876cf68be5d520fe72ab35cf4b065653dcf51038a2cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 30.6MB
        • SHA256 dcbfbaa956daeaf6d7e91cbb40fff4808bb649fad3fce5eefb1888a2c3a7e9a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 30.8MB
        • SHA256 874717260c7cab7a22b9533a87fb86d6ad4f7ad79fcf172276439008f026b8f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 30.6MB
        • SHA256 6ed9ce060fc3d8efa54571a0b4bad8d8378697a4650a11233c2e6e66818b2061
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 30.6MB
        • SHA256 0763fb073af1e2a6c6a544c064eae276bd46716e223bc7fed4d04c6c15aa4fd2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 30.7MB
        • SHA256 3f18a5a7e71bf1666d997c1246f2edbd65dc12e34cdad9157533967c88602dbe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 30.6MB
        • SHA256 4d233b54b4008d2b736f571b198ed17654fdd6cd3a15dad5616f42ea625f38d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 30.6MB
        • SHA256 0d7a543aa631bbcddcf5a16d2ba58a9238739a5ff7894a2ce3bd2ef249e29a2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 15.4MB
        • SHA256 b49e7d6ba86a4dc8fa40d84090d1cac11b55c63d429db8e527201af5deb9d336
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 31.0MB
        • SHA256 f630ae1ec6040c1e5e134fa2ca1e85c94a2c08feb72612cb3c4e2c83c6587c1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 30.6MB
        • SHA256 d712b654c61d7bcb72216702d24100f4c34bc8137c99578b55b50651961bc505
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 30.6MB
        • SHA256 8769e7d61445663fbaacef793a5c676cb262487c704dc3e1ab48338821e355bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 30.6MB
        • SHA256 6d7e695213fb5c2c50cd2a5b937a22e496752a2ed17b74ee3f7e6ff23415c667
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 30.6MB
        • SHA256 7dd4893cb8ce1f69cb8e0f5fc454a7a675a973c711372ba9bc8d1c22793667cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 30.6MB
        • SHA256 ce17f8784793fe3876d9caf26edce896e629fb87cb321ef1e08aa437bf946f9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 30.6MB
        • SHA256 45b584a51dd62fec6d96a301387032f30ea75dd1aec9373e203cd79a250bc5b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 30.6MB
        • SHA256 87f7ff80c01b76894daf01c8a6b176a5f8353ce82e1dcc246eea2fbea1fe9269
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 30.6MB
        • SHA256 3cdaaea0c98a92be074515fe66de98ad2d5a1a4aea90a43206b0b14ea5bd1eb8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 30.6MB
        • SHA256 9892594f95cbcf2638f6590f9dd2ae858e35429b890fdc06630ea563d84f7edd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 30.6MB
        • SHA256 1597b1b2eaa246ad6715d7b66a91eeeb1647a3442201f210d6640be0f6d73c02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 30.6MB
        • SHA256 19e1e5efdd75e99ae5649b78459a0b75092e199986876c3f120a8fa322ac428f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 30.6MB
        • SHA256 5916aafeb4f5d42c4299ba0c0b78f13797cbf793c6b91f85566acfec2419200b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 30.6MB
        • SHA256 b004b6140b651444ebf0aaac6a1667434c5a0c98453b09723d97e961a6ce7b50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 30.6MB
        • SHA256 2bb8ee65409d4088061584212abbccaccc4fe9d8c30bf147bc0fbbfea4eb0756
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 30.6MB
        • SHA256 69f0da379d228c013aa80e8a583b820d88a0892740214289530c85e48a657010
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 30.6MB
        • SHA256 fad0d36ca731048f23332eb1c22540c70eb8432b16202845c0f79ec7d65185b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 30.6MB
        • SHA256 fbf2f74f17885d1089a512b64963a9ed641bfbe2c7deee6343f1315e4eafe407
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 30.6MB
        • SHA256 ff5f2f6925a558af40a0b78ad6f54175ad5ce4789278604de7a7be4619f6fa99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 30.6MB
        • SHA256 82c02ecdd1281b07b772e30213c93792dfebb7525e575d9291204bb6d716cd54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 30.6MB
        • SHA256 4b34633decdecb926ea2aa27c12e877bc6c2c3adb8340e936692ef1465efe959
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 30.6MB
        • SHA256 e89e20f46465105f99a7c0f5c62e5c2bf79ef5e6728013f41f377eb4e3bd4840
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 30.6MB
        • SHA256 05b4d4b038394a8e112b6e5f1bb3e615507c89ce7a614d75c2502f5a29abac01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 30.6MB
        • SHA256 031b58370f5075c6f962d8a5e4332930cddb7d45f764d861b48d7eb7ccbdcd71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 30.6MB
        • SHA256 3ad340b1885217bb7c5cff8014a274b30e58e97e88edabb94d156d3b7aa53b45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 30.7MB
        • SHA256 933299db8ace0d3c13b182e3908f7625552b9707c576f1f0624bdd059fbcefc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 30.7MB
        • SHA256 937c8a3bc8559fe19a91dca7fe9d63f5dea9d2f4ae7f3362129624fe44d166c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 30.6MB
        • SHA256 7f7b4e1ba64facee55f3997dfd532bf07fa3d215c71e963420a49bafb661d119
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 30.6MB
        • SHA256 5c8f75d30d6589d0e64a9676c1180df8661bb84a309ed773d02577d878b4d9ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download