Overview

overview

8

Static

static

3

2026-08-24...r_.exe

windows10-2004-x64

8

2026-08-24...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    114s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/08/2026, 03:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-24_b8018031780b447af2d17c157b649b1b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 14.5MB
  • Sample260825-dk3w5astat
  • SHA256 166a5eca6dfce5f7503b05f833f0407611ed91ae9e3a351e73d9069ab19b2d08
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-24_b8018031780b447af2d17c157b649b1b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-24_b8018031780b447af2d17c157b649b1b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1352
  • C:\Users\Admin\AppData\Local\Temp\2026-08-24_b8018031780b447af2d17c157b649b1b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-24_b8018031780b447af2d17c157b649b1b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4644

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 14.8MB
        • SHA256 9a07fb598026c9b1869651eb3c0d2db31cdfa35801303dbd66c939a98e491cf4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 29.0MB
        • SHA256 3bd837363cb4346157cd48984bea73aa8cf96a55b1d265ee3909fcd52b6dfb95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 33.1MB
        • SHA256 c8e7c2b30c840585eb97df05099fa7674084d2827fa3e422f3ec822c9f98bf63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 29.3MB
        • SHA256 1e2988b787ac1d8c606179f4bb176e481f0f3362decdd6b9f027fc03d8e889ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 52.5MB
        • SHA256 41231a6349b9021e9230e519e9ad40a3572830d7a8e18450cae344ac0c63cc7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 16.6MB
        • SHA256 d6b20006bc85b0775b46ff07f48f54402d725b3ef9bd5f7998bb612a6f6b4b84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 29.1MB
        • SHA256 439e92edd839aa20ff9758dffc4c1e86c8522c5db362d85574b4dc68c2aa7421
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 35.1MB
        • SHA256 af87370ae8a54c66ae0812c4582607cf85e5b09482e01df9bd9278ebfad1a90e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 30.7MB
        • SHA256 d5a88ab16d185dedcf22df61f69f50625caa36e9b01b8cdf62f75a9459e34826
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 31.3MB
        • SHA256 1876c9c4068235217fc6ca34a30ae1a767d1745a558a0db2997fb6a1e38e96c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 30.8MB
        • SHA256 fd45ecf65d2c629ec2cac0fc0e0889dcf5c1d76e9de7141106806242201364d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 32.1MB
        • SHA256 650e1d816904e99f4e4a44b6a82846efbac3883bd02152b214abeb112d363289
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 30.4MB
        • SHA256 b02d6cd0a0192004b08250a4eb52c7502bbfd1f998e773ef4098f82d1fd661e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 29.0MB
        • SHA256 f5bdf792889d531445ddfee57110a4cc1acabf9d26bd6624d5e575d41604e065
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 29.0MB
        • SHA256 4e6be97d4cba43c54393ebb3b6ce44d26f39cb4d7539513acfcf168bd7af6467
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 29.0MB
        • SHA256 78ea0df9e95d1a64415ad0999351f19c2394d4bafeea4c92b36e5641d8a03039
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 29.0MB
        • SHA256 eb418fd29a5f7b8134b5c256eab582a62a289a581c1f6c37b468d393ec6abb89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 29.0MB
        • SHA256 5cfe3c437f2cad90ee275456ca3b3a6ffe8687cb33667c128b853d2fb6b037d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 29.0MB
        • SHA256 1771ee76708be52a47c249341e2d30a9cb813b5d5079ad42eaa20419307ce7c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 29.0MB
        • SHA256 42fcaa97679359796fe988c84a61ce7e650cb8718ab7167719b7d35671d13868
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 29.3MB
        • SHA256 09b40939ffa5b47f6daeb2f8a4bb8569ac727ffecc3ae5e7a48e49bc2566ef6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 29.0MB
        • SHA256 8d941e851f132a4249dce7709e43cc8ccbce6d5acec5bea8c5937d53a4323c70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 29.0MB
        • SHA256 e190201d29a41ff72e3438a7b004c0ad5f7d692e88e888ffdef3dd2d79cb153c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 29.0MB
        • SHA256 f15f901bd7a3ab94f6865bc1d99c81048fe74063342fb7a953480465ffe44bbe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 29.0MB
        • SHA256 3d9ddc770af3946bb8b9ca8e83b122667f78e8445a8628ed7534c9d364d1f2cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 29.0MB
        • SHA256 40c3a6a74389afd861ec26e1f02b0a7bbfe8dbb7f87aa316970f9a39f0cd2f9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 29.0MB
        • SHA256 3d1731aeacb755f3b91b32c4a9291c4e6c5861dbe3fb51e30cb4a151358686cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 29.0MB
        • SHA256 67b353458b79f2faa1a0bae4b68a3ba292589a91e723578fc7dd1440d8823cf8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 29.0MB
        • SHA256 7804ca2dbc7357da6ada5cff8cba8f9db42e8dff875eb68e3fcd21377795d26d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 29.0MB
        • SHA256 4ebcb23ef6e94989ef7153c8eb17e288d33c7001bb10ac8021265022096f3ec4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 29.0MB
        • SHA256 af8efa58d944abdc8b475c2f9ba8091bb119fd5a069f7209880180e8ea2d76f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 29.0MB
        • SHA256 15e3dd70da1c57cdb111176fe5552c05d12b2c918b601955497e3dbdbed2c3ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 29.0MB
        • SHA256 b3a6a452ec8a9565385e64f134f61dda6426d475396b9152c1d6ee77e2af389e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 29.0MB
        • SHA256 5897e59c202d150e1ec4644c24ae0cf2fbbc51f298cb12ed4a7d9fd0ee10dce9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 29.0MB
        • SHA256 1e0e079a88aeff869ae68162a9a6ecfa33f0adebcb4537e664c8b23b1e6cd6d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 29.0MB
        • SHA256 1abf7a98deb25a502e3f888cf533dcd56e9b9386c2f4d44d530bcbd1c224ba8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 29.0MB
        • SHA256 558bbef926f34982f4118d1251392a8d26bd15ab678c1a7affa334f0e9df37c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 29.0MB
        • SHA256 5a40643ee475bf33045f1ee759221756443ec474bdcc7f48f9b33f7ca1a39b04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 29.0MB
        • SHA256 c90972a04b7748f35fa185659277048170041349878d35924fdb239963d398af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 29.0MB
        • SHA256 eb64a454bf2372d174391eba8443fde3ef84f0d71691fb5f35e68b50242474b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 29.0MB
        • SHA256 ec4aafca4c068a79df0527d38276c95dc1b0cc1d07d8bdffac9d477da5fddcf8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 29.0MB
        • SHA256 88b85ea298cb034370663468c14ebc6d2d7cb12fd0c960049e68fd83fecd39c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 29.0MB
        • SHA256 0686b3ac850e5d3a83f42fc23b4d06299f39fa3f011c9a3e1b7725bfb8f5f8c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 29.0MB
        • SHA256 1de76822477090cee422a52a00741345fc90aa79772a67b23a8d6dba0490ed22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 29.0MB
        • SHA256 149d286ea605333b5356bac2576b2057648bc15db87de72ccda6f15dcff56b2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 29.0MB
        • SHA256 b1bdfac1605b4855b107d5be07f3981bb9c37bf4735548c4b2be8c71fa047222
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 29.0MB
        • SHA256 a00d89a5300b8e3ca6281aa7a0595b3280724916cf96fb4a4d3af369f4379629
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 29.0MB
        • SHA256 c27fcadc5f601bfdbeba1487b25d9c9cc0e7d226db7d822e0d7ffdbcfb00096d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 29.0MB
        • SHA256 0f7db841595b29a94447952d9930d08e81c399b7af511b38195429c414256e86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 29.0MB
        • SHA256 d9c8f3f11985da6be2cfa09b7ca76b153b2702a24d5dcaaeb5e669d9b6bdae4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 29.0MB
        • SHA256 371554b19c37ebbb6c84e2980944c209e8292d65f4ab4063b7ba63ffc16df952
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 29.1MB
        • SHA256 97dfc3a8240e4b8bcb8fc0ed425dc22fd053cc9258cca922f69677a2a75befa8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download