Overview

overview

8

Static

static

3

2026-08-24...r_.exe

windows10-2004-x64

8

2026-08-24...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    136s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/08/2026, 20:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-24_04c373a3011305287ac7d9f2735aea18_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 14.2MB
  • Sample260825-ysp1fsvwhy
  • SHA256 58068be829d79a10723f2520912dc2f32dee5055866f2c631399486a4835949e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-24_04c373a3011305287ac7d9f2735aea18_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-24_04c373a3011305287ac7d9f2735aea18_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5548
  • C:\Users\Admin\AppData\Local\Temp\2026-08-24_04c373a3011305287ac7d9f2735aea18_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-24_04c373a3011305287ac7d9f2735aea18_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:6052

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 14.5MB
        • SHA256 521c511f910870a665150a210404145c8b5fa5733b837d714fe510fca57a26e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 28.7MB
        • SHA256 c607fe03be078536b0a412d000f15b69eb01456f79c906698d04b5ca70944fae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 51.8MB
        • SHA256 b0016f0947ca59c1f95fa9283a1bc8c8acf35e7c257e73a70867e9772097682e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 16.3MB
        • SHA256 f2381c1abe18df8e32d3c9913fe4b82678e787858c3d585d0359e98b56224092
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 28.5MB
        • SHA256 9879e3e27be1ebe18283dee0303c803458bc1422fe244660672e234ac0f7918e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 34.4MB
        • SHA256 28e5801ebff4063ae4db6c33db29e1a85c3efd1cecd56915bd47d43b36643f3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 30.1MB
        • SHA256 9fddb179453c0e4cd792159c41aff60f45d3be082da342e1be658a9e7aca91f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 31.8MB
        • SHA256 4f5122dc8e6c065ece6dbee240ad489b6945253ca1be4424f1ecdbe91d382a34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 30.0MB
        • SHA256 d3a58d9873daec3ef25d093d417cc6719d8b724ef10811cfb39c6ee3eca2caec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 30.2MB
        • SHA256 a241845cccf227acefc2b86b3f245d8835101d5553941942315f0dd535010285
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 31.4MB
        • SHA256 1c1ad376c7e9cf7bd29b612d2689cd06ed270f546cb876cd64a64cbce76cc16b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 29.8MB
        • SHA256 69368e69b2c3a1869d57dbe0ca553ed1ce5d6c2aa4d8e12ecbe113147393389a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 28.4MB
        • SHA256 8c74dc277ae240c0baaba21d3d1b306ce57dd4579ff01b55d7843403c51936dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 28.4MB
        • SHA256 dea3d28215549a09f7b92a524ab62181685167b31785b9e185b4ecf0e8defac0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 28.4MB
        • SHA256 20a9c29f22993fd016d68fc3615c70de9a442a23c36873e1183548a2104e8a9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 28.4MB
        • SHA256 9fc9024849d4dda2e66b097c1342507912f065d8be5451d21623565f74002055
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 28.4MB
        • SHA256 f5f4b29e47e9971ea103f5e743390b10280776433f1e887909d41239d2f00322
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 28.4MB
        • SHA256 c620cb3e99609ea13f17e852b95ca8cd68a2793d1e0ebe4d2fa6e899ca4d53fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 28.4MB
        • SHA256 cf647128d6cb946d4c13b3decdcb19ec0cf1ce35006bb4cd15d381e5a46d6b7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 28.6MB
        • SHA256 bda8f7d7a1cb7ba173699a3d36c32ae356cb9800cb2a955b227385baec0234ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 28.4MB
        • SHA256 2d72bcabc67d3ad61f9d6d008f84108c8e227aa93a6f7e7ef8b492811c6a7b43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 28.4MB
        • SHA256 12f59324905c77f8401c6a651b91552c11c8a6f3d4b73e94e1bd4ac3e145af9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 28.5MB
        • SHA256 72317fe75ea884acafaa22897d5a0e86b113ce9dd69c5d7dc87f205450fb7a58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 28.4MB
        • SHA256 f9577d57b85d46201e8fca6c8ce4d5fa2d726cb4243c1c34454f9b9dd86eeb75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 28.4MB
        • SHA256 d57b1bbc9969826bd5a6bf01c08b14911dde7239443a0dbcd5022673b4847422
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 28.5MB
        • SHA256 7ad4c41ee677ff390b5f33f2724491f9597891a2f5847a835918adc355f1dd1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 28.6MB
        • SHA256 0cc4c9bc75c90535ef10d8270d67bdd6c5a349721f2630fa2db0981a988e092f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 28.8MB
        • SHA256 b472b272c54e73082312a6ab7a1f643b05d84c4ff9667c8e1ef44d67e7d38b3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 28.4MB
        • SHA256 7ab9f1a3f49cb2f306efd50595e370f4c3eabfa16cdbc65c81d660f9064b3c01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 28.4MB
        • SHA256 86380d474d9d602b144d38afd84fc354f7bf986d32cd7b2969e9fcd703f00594
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 28.4MB
        • SHA256 bd5f283aa5cdc2410e1341a9fd47adf0adce37792095058e9b29dc6f2c58990e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 28.4MB
        • SHA256 548c98ce1833e34071652cc744c8d7209056e0c6b2c835e5232da58cc66efa5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 28.4MB
        • SHA256 446a7b474b827948bd465cbb6efb298a34c1d9f2665fd9af816f69b1b9ce91ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 28.4MB
        • SHA256 ebbf8bdda27a2b60ee5a012f9839899cb2ad84d3abb4e23641ba0f1096546b56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 28.4MB
        • SHA256 bbf28f9d145d7d35b3d179250008a0f2bc0966fc31f6e349462ea6cf834becf2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 28.4MB
        • SHA256 f4765bf0b0636089883e2cbefd8e6e37c018afa365ceefafd49dd2fa80029fb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 28.4MB
        • SHA256 78f7879bed9fbaf69233c9a857397925eb2916fe41655fef8f3ff155badbd09c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 28.4MB
        • SHA256 f0c9a9d6afa6fe40fff0a1bd00088f7e990ca0c361db8db4e3b501066d64a252
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 28.4MB
        • SHA256 a343d7362626940d23e75f4da9ed09098ef6fb3b41a7479b83cd9fd4e347fe01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 28.4MB
        • SHA256 8dffc1c3bb90d4478cc8f8923efc3a3087def80a24cfba0ccf21e01395f7d476
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 28.4MB
        • SHA256 3f0c11e25ca11eaf6d6b558479762527eeb29784963370f252c3c25200d18109
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 28.4MB
        • SHA256 11e66877b86244a7b784d159c4fd9114744f454cf981e61eb3a5c0fdecb19ec7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 28.4MB
        • SHA256 ae13d9d6600eb9bcddb1a3fb49b2d96c9c8b5782d2491ba72372d5a3da9a4a5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 28.4MB
        • SHA256 1f9e6e1a774da6885f2b3c53e2c964414cbbf5e6e005081ef59d5301001981b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 28.4MB
        • SHA256 e471ed7b52b0ba2e8e248c6e40a60128c6a956e295ea92d963035993e7bc7939
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 28.4MB
        • SHA256 96105d802df2886d031877c1b99dc2488d2e7d7657008d275be04a9cec967608
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 28.4MB
        • SHA256 09933c0fb788279074d25dfdcb9be89f210fdf678cef2a79e1d4dec4f841664f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 28.4MB
        • SHA256 53fc814708377c119469b8cf4dc3041a7463f5492a64ca73e1baea9430129906
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 28.4MB
        • SHA256 f510f4cc116219ca7bec754c555d594e863f47fd23c8d17af178caab4f2f4137
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 28.4MB
        • SHA256 4db02ad1a2ef83004037b7fb3212865919ab2f182c28944735b063abc2fffdf8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 28.4MB
        • SHA256 134ff4e4cf2b975ecc8c6e752946ebbbcc52d3a06af33140dcd30aac97d679cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 28.4MB
        • SHA256 c5644a4f39b1660d809feca25656a4ff1791375ecdc783e5a1a46c345bc32be3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 28.4MB
        • SHA256 a09cab65f902772de66a95b19caadf1dc0ccb4d53facc9e6f7edb56b7558f96c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 28.4MB
        • SHA256 82af7a399b272fcc8a363521011d5cd6ed3e4e0bcd7270ee0b0761e86e9e23e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 28.4MB
        • SHA256 f41f50dd16ab6a599544deeeed87e668343fb2b7031d172ef52f4b6b541f142e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 28.4MB
        • SHA256 b814f396b30bd5a969ebb74a694e5bce22034177ec7d60f029ba426aabd43fc1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 28.4MB
        • SHA256 eb08bf49777cad0b7cc6772df735bfc7000d641074eb7e46d20326942490e88d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 28.6MB
        • SHA256 da811fcdb283d420d4a6f4623d087ea10e23530a4cf8fae479dd73ba8986d901
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 28.4MB
        • SHA256 9b88608dea43b27dc67b325b3bbca5cdd54694fb5c8211d0e4938967e473c8a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 28.5MB
        • SHA256 2f3bfa3e72951fcbd41e211832e03cdf65466c4a461435e09114a0e1fa6d7f29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 28.4MB
        • SHA256 1bbeab0a11c8cf5b229b095802d9cb1a731361012429840bd8871db3ad0b5ec4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 28.4MB
        • SHA256 665000e2b6ca5371973b90cd80c0a0bc21b0a6db87c5f33b3b18c1571623ab18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 28.4MB
        • SHA256 b6f82f9f5d6aadecf4c1f4a5fea231c049d07edfd6462a98d12264a2b85f9b83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download