Overview

overview

8

Static

static

3

2026-08-24...r_.exe

windows10-2004-x64

8

2026-08-24...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    136s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/08/2026, 07:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-24_93adca96093a3446f4c5fccfa624e4c8_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 15.1MB
  • Sample260825-h511gstyhw
  • SHA256 2797d8a1d8405043652311e51456f6e5c92383a571450404245ebae1fad565a4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-24_93adca96093a3446f4c5fccfa624e4c8_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-24_93adca96093a3446f4c5fccfa624e4c8_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5628
  • C:\Users\Admin\AppData\Local\Temp\2026-08-24_93adca96093a3446f4c5fccfa624e4c8_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-24_93adca96093a3446f4c5fccfa624e4c8_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1184

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 15.1MB
        • SHA256 e7e81461e08fae060058108deb48419e9865625cae3013a13182df7b1154b6a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 30.5MB
        • SHA256 954672b26c7e4c2a1278f31793f0cbc10f8dc9e69c5d47a98ae510e5d74974f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 30.3MB
        • SHA256 f7d0c8bef7b35a870da6fbf1162c73e26362850f8f7dec621632687ec6993213
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 34.4MB
        • SHA256 f83a9ae2f94f43525305d7083ba11e4feac9c85eaf8397fb7f347842823904d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 30.6MB
        • SHA256 de9025cecc9799f9dcf63bd2deb03dd15ec613e3043a5ad9709be89003e6dfb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 53.7MB
        • SHA256 ef7c9eaa682b93b3064ea7c468848c22b2d955c1f8f3dbf953364dd207fb7af7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 15.1MB
        • SHA256 2797d8a1d8405043652311e51456f6e5c92383a571450404245ebae1fad565a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 30.4MB
        • SHA256 1eba0da5b82d6d7ec3117c9f420864caba4146bcbdce01ff82e4c93e079ed19e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 36.3MB
        • SHA256 65c0444d2bfe9335c50b7617c6381751cfa91d600465cbd4cb308c654fbe57b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 32.0MB
        • SHA256 a357a9d54d382d021e4e91078cd5c5010e3b2c4566572545e7a7271169da9562
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 33.7MB
        • SHA256 eaa3f8d4becf7d84c711166dc1fd796c97f44aa1a444a890324479235890e70b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 32.5MB
        • SHA256 f9333cbb56a230e11ac0f1073ce226d2847eafa50c2fa466a0513750966c8097
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 31.9MB
        • SHA256 e428241a6bd596e640e4b4200e12d6b15665f5b69e12fc292a780505b1f35adb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 32.1MB
        • SHA256 cdba5c1404d5a6cf8e3c7c16c97e2ff57797b74dc8c6765b280ee2ec55296c8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 33.3MB
        • SHA256 203623908a3d0a494d05c4f296f0e5e6e1398a86e2a18b90ef6544c5bcf8f17c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 31.7MB
        • SHA256 8874f5f51acd691838d50b2b3ec681c25772ec88ba4ede9920e09f22fe1bad4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 30.3MB
        • SHA256 a66e002527ff1b6d0a19a46cd36b8397df924e02411285edebae6acede630a26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 30.3MB
        • SHA256 628862a4dc983592705097650e74cc2bd87b9645ca990928a848ba9af23e101c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 30.3MB
        • SHA256 588092da67f82aa88539dcbbebb7d5a646674f5e6855375165d2f45fe4dc931b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 64KB
        • SHA256 1f265691104a644e9952d37a7849f11130cc6799b7d283a00f2dc16e96560fd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 30.3MB
        • SHA256 726dcae9ef874e051de018f84ac8b6e5d2f614c8bc5b1ff788fc51d891ac8f4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 30.3MB
        • SHA256 8e2b193c71732d8c7e4a5a3e57e40351cbf41f343e1d3e3168480a1a12a5056e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 30.3MB
        • SHA256 49ddd1aeaed1b5d3b00333736080ffae6ea2fdfe5d71dc412197e26dc88e3b79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 30.3MB
        • SHA256 907fc465ca1cbbbe4b4fc365aa74a74e653708866b4b3f4206076316afe6ad96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 30.3MB
        • SHA256 b331b8e679dc9d78586a98da35dfd35ea335686a4edc32ac8fd8cfa67e9c2a89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 30.4MB
        • SHA256 0919aa12cb11de22df25d0426d6b5e4823ce58cbfc0cc2f20d74a586cf6005da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 30.3MB
        • SHA256 97b9d90efb7f39ed151dec9bedf99f5c5c60a443a8f4206b5f7a8fd3c67f6679
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 30.4MB
        • SHA256 a6df28daeb01227857757f51a7ae4e9a15c20b0c27a5b4dde07f131d5e051015
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 30.3MB
        • SHA256 a3fa8f1efc9f84f54d49255a98c51d406e8410f6ac9fdfea18d18cde3dd1f4b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 30.3MB
        • SHA256 f87ae533815a1d31d1e45e96928ee212f8d52d9e1efab4aa98556814e0e68a18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 30.3MB
        • SHA256 87568df543ee34a0e223aeffaa378c34ed6319b4d4344f95c3a59ed7a76ccd81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 30.3MB
        • SHA256 1767e8e8814bd83ff7ac66c18dad7e27cf1c4f8ff73b6922f61fb35b28d22511
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 30.3MB
        • SHA256 6de70114224b8235239f09241b6f24c56e2203eb7a3afd9a3fd6129782548d5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 30.3MB
        • SHA256 38c59afea52a5f4bc00ed6d27aa8ace4c9848276810672a23dd40b033eac6cd8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 30.3MB
        • SHA256 25930547a24ed7b81cea284f3bb058c5d83cd4d7a47244380781758c4a639143
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 30.3MB
        • SHA256 adffdd2265a431b0acf0b841e29fdca07d477533d218fd5f9519bde54cfd9b57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 30.3MB
        • SHA256 58ea6cb78112bfda29b0cbcd96096a6278b6a976af64ba0d90dea13ef8643fd2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 30.3MB
        • SHA256 0a9ba2a9364254d1f43f6eafec8a9f109b846e3e290270e7b49ca2098201bd33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 30.3MB
        • SHA256 67afb319b73a94dc0bca21629ae6e8bad124f64122470175452876d65e5a4d51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 30.3MB
        • SHA256 15b8317484ca5849ae5547f6815313a3d77143e7929d10b79fd6a9c647ce2912
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 30.3MB
        • SHA256 11fe8c3a2fcf54b71e3b9d368ad3b86f8214d32d598e384a057c10d75a5a4e06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 30.3MB
        • SHA256 4f3d25fe8ad0a961a8a7c44e916671f2521f95d5115421147bb470926f80531e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 30.3MB
        • SHA256 4a5769469edbed6e575977e9a1551f2a6d74aab4f2816da0be78feff4e52ddbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 30.3MB
        • SHA256 1e2e4adf26c8ca6440dff865a6ae320f19d83179c0bd7f8f83d755905d9015e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 30.3MB
        • SHA256 110e96a9db92c246f1a69eb7903aa71a094de73619850bcde7f124cc5ffb9e40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 30.3MB
        • SHA256 787b93eaefe35958e88351475bfedc358a5f1359908a05935280f95fd88f928b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 30.3MB
        • SHA256 cb729756e11218144dd684a8ae76e3d3b167505701af0dc4dcfad3cbf7aeacc8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 30.3MB
        • SHA256 9897848e5892bbdf467fe489921b6c625ab67493a2c10cf4da92a59aa094402a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 30.3MB
        • SHA256 3a20e8165feb0d4cd90a255980316bcb2c7ee54a359382bd70de47748bd72969
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 30.3MB
        • SHA256 a3f6f578827554e7da63793662c2fc8b7dbd2bcafa62173d48cd65cb5e13a029
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 30.3MB
        • SHA256 17a8b4349d83f169db7b2573437d8d2728e8938a71b5dd15ace099a554431469
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 30.3MB
        • SHA256 a111392e0bdb0ef7efcffe60a2d841baf307b0e5297c364219497c0a6a35eafe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 30.3MB
        • SHA256 8bacf28955e2e0dbfbf012d8027404ca8abd60def9546aac5bfcd3f9d7d2369d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 30.3MB
        • SHA256 5f009d10cf0934dffcd4bafaec7c0cc451a2acb3e914e8360f65dbbcd60c3b05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 30.3MB
        • SHA256 6d33295897a4fef0860431ba3f851f34b94702086b30d6403587353d764d2526
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 30.4MB
        • SHA256 b6d242756c4eb7245699e043377ad0bd8ef99b7e90147f6f0698247ee0567767
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 30.3MB
        • SHA256 f17193ee20d8fe3e24d2f00ea0ace7d4d191f70db34fe436919707308a4b27cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 30.3MB
        • SHA256 6b3f3aa49f5e4e2e35672fe6cda3fcbc8bacd87d90759ce2216aae71f1959f36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 30.3MB
        • SHA256 a14e7387114206e8d061a72a0e8aa7bc38c06e558dc2299a57fbdb6f9e5a32cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download