Overview

overview

8

Static

static

3

2026-10-22...r_.exe

windows10-2004-x64

8

2026-10-22...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    137s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/10/2026, 10:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-22_66038cdd8142b5bc5e168beba941cf24_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 20.3MB
  • Sample261024-mna5ysht31
  • SHA256 dd44ebf5ae51ae284e45eb24782eea502e38de58d8d9319cdef0703aa5ad2649
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-22_66038cdd8142b5bc5e168beba941cf24_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-22_66038cdd8142b5bc5e168beba941cf24_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4284
  • C:\Users\Admin\AppData\Local\Temp\2026-10-22_66038cdd8142b5bc5e168beba941cf24_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-10-22_66038cdd8142b5bc5e168beba941cf24_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2752

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 20.3MB
        • SHA256 518c2790799b8fd848ca80066ba878a2ddb79b95d748e7bc2a3097a6686e5b22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 40.9MB
        • SHA256 411088de6548217a82b3ca542a9bcfe0a0e5dc894f947bff05f684c89fce05ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 40.7MB
        • SHA256 f984e2cac027f4a44c94ba1f333ee9d15575e972f9f41a61b3f486c5c7929e3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 44.7MB
        • SHA256 977cfe38eaae047dd9cd2db557688f7fb0abd1aa450c8992deeca247b76c7ae9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 41.0MB
        • SHA256 f450c517ee39243885253e65f9d610ae7383b3f1f0d4171c8fb6a43575c36078
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 20.3MB
        • SHA256 dd44ebf5ae51ae284e45eb24782eea502e38de58d8d9319cdef0703aa5ad2649
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 22.4MB
        • SHA256 a2600ee16366288bcd22090a2a33e4a80be6655d3c961b94ec97e9244d1bd18a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 46.7MB
        • SHA256 605aab6c6ee9127688e4c229441614e14f487c7803d332a2e1d897188cd98caf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 26.4MB
        • SHA256 cc690e9473e4f428ed4c83a5e566552bc0b02c8ea92a46adc6a38e9ebd2c51bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 42.3MB
        • SHA256 3e2bcd3bc7ca477a472af5a20ed3c0e7a63db90e876354570448785516ed0397
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 42.9MB
        • SHA256 a9a1956351c9043a1b2e32895904ddffed31e6def0ba108f1bd07c00f6fc5983
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 42.2MB
        • SHA256 f062ee23eabf4563522d3aa469d1837df89df7384365247370a343f2c6fd25d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 42.5MB
        • SHA256 0ff610403f37bd7cf27e7d278b1b25077abf8da3811b24b72f8d443da69a0541
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 43.7MB
        • SHA256 70b0ff8d5fc5efdd7f28a955b65e0b20f0c8873369ed179e3879fe9d40274d4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 42.0MB
        • SHA256 ef1174cced3436e01d5c1f3803794f595b8d468cf6eb0f2d67bf24d31115873a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 40.6MB
        • SHA256 8fdab93efb27d51a006a6d4bbdd0b6d138d8292e409a6568ee20aef0bf7bb58e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 40.6MB
        • SHA256 2728f854a055469cb72e8e64a87cb6cf6aca99cccb283500d4701a9af0f45b5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 40.6MB
        • SHA256 5c4f88d7d9068d141781c610f05c732c6efa2fdd1e9f1013fa887a8b9b158936
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 40.7MB
        • SHA256 86c433a76de30e9714235ce5adafb744d3957cd7bad6031599813840c428e665
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 40.6MB
        • SHA256 0b60e84d23ec1b9bdfa830b6b97e97b51f541db255b1101d2f330176bfa59291
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 20.3MB
        • SHA256 088771f4cfe3cf9d5a8cbb607e76f00907e5e3ecc4ce51ab102c01bba6d35127
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 40.9MB
        • SHA256 4906673ec86d6f4d765e54412a568a3eae7b0edf6c701d590644d372dedf3429
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 40.6MB
        • SHA256 41090ac9df3c0fd08922d12757aa1c1458001f6868de414175c5d3844cdd9529
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 20.5MB
        • SHA256 d1a1152c9b942193ec08a532d9983f8759625c7628da850f634dea925dd9d0e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 40.6MB
        • SHA256 5814a59c4e0b7a4a937b912468aa1a601ae709c50db9f713c6f3444c88fc7e31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 40.6MB
        • SHA256 5936e47803c1418d3b17564cd2aa348e64c8e5bbcec5e0f4cecfbca7c59e072c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 40.8MB
        • SHA256 eb604f931ba859035b51eed3378f7f50c6683c581af1293cea148edff2d66376
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 40.9MB
        • SHA256 d5ffd938516edbb72247bc39c625afc447a51f3e76619e9817cd1ff813f2ef9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 41.1MB
        • SHA256 94209670203f509c5200efd16eb6505374b01137ffac53ccec8758ee93bcec94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 40.6MB
        • SHA256 043f880f17e7abeb8b0e446b49a8c91afdd12a322e9852989d799d300f624f3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 40.6MB
        • SHA256 c5259bd876d32d9751cc56511b91fef1dd7bd4225793388b9ffed9d2ebd4c7e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 40.6MB
        • SHA256 4985ac5f9a1138f59dd43f8b44d48fb122fffc979da7f70b0186882c0344db31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 40.6MB
        • SHA256 026973cf8c7ead3db06d74fe2f7bf0df67526f8e9adbda83719f9cd716c6bdef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 40.6MB
        • SHA256 843283a497aed5e71001f317ef1b11de400e31e56a8c02e324cfd2c1e7680e84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 40.6MB
        • SHA256 82634aa13b4ebc1bf14b45e6b8462ab5d9f955a1f4f42ccb3e06d8a02781abb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 40.6MB
        • SHA256 ed4e4fd1d0c7deb508b92b3a18128673cf56f659c43f6981746612669fae5fd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 40.6MB
        • SHA256 45250e2e5786a459b41609e925688afa97d2cf55b760744eea5178436d252933
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 40.6MB
        • SHA256 bdccff8c9d59ec1cf04423ddd71c075d61f94421df50cdd7918cfc77bc081b54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 40.6MB
        • SHA256 b64019ac090e927c1991f0320bd6eb0f9e9b9cca43671dbf52183c78eb6cfc62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 40.6MB
        • SHA256 ee9cd8b9ad17a54f1ac3fe3c813510dfe0a8a1ca9e36055c4ca422208b66dd0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 40.6MB
        • SHA256 abe595d42a4c83f43b7212f9d375fc1038760891c68446c8ab54511b108a2def
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 40.6MB
        • SHA256 bfa2e2b74767f62df7152ee9171d14ed9d8cf0210969a645eb500b952e79f7fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 40.6MB
        • SHA256 79a0d423e7bb3ad78ff7f03599878c75f21620b8ec936dedfdd5d7402941636c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 40.6MB
        • SHA256 c6fd89378b44108a76791f5ac5b74d3c173def7a7561ab2efac15ebf66c6b370
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 40.6MB
        • SHA256 1c4643a263c437910b150358bbd82c4760cab063f6ad19a1efe1205105939ad2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 40.6MB
        • SHA256 1ac5748ae212b028146565e1d5df9bac8a0d6f1b2edba4d7dcbe1f20ae745843
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 40.6MB
        • SHA256 e4eb4280d82f89cf24a68abfc2f8711f69e52907a06ef829688b5175864cc7dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 40.6MB
        • SHA256 0c36a81514dc14e5b50dc685d202aa34dbd7716a71a872025b23ed081721c8f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 40.6MB
        • SHA256 c6f3c94f900943c9010417c12b20556a030d1e4727f1bad5d71a376dcaaa25fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 40.6MB
        • SHA256 4309b784e022c5c81538d9943abfa41fbb4af7718341061010ad441807ea4e1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 40.6MB
        • SHA256 6e91daf0a61ed89f6443bb433f3969ad530ede45ba0a93c6bdb2ca5f8e9ed7b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 40.6MB
        • SHA256 7c61c1b351fa5371130965a4019ac8aed871c2db6c73eafd21d5ceb5ef8aa6f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 40.6MB
        • SHA256 544e148af3683fa5001aad1a69c50a360f659743a78b8c4909068ae7c870b891
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 40.6MB
        • SHA256 f7d16ff56955e2444f21c7e4f6d79279c81b8e85c75bce384751be4786a38292
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 40.6MB
        • SHA256 31c385536906b66972bc896b917b2248f14c95f1e72703a630378931c75a39ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 40.6MB
        • SHA256 98f604b3cde02e5b213cdd240975fba0d501d9080dbf01ac4f794aa4dc31308d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 40.6MB
        • SHA256 eedfcf569a82b48d8ea493ab6d9a4aa78814edacaebfd0b2f34004c80588834e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 40.6MB
        • SHA256 34256bff011f982b8efb3d9f0dc3d6901075fa82eb12ead3d90c7b5249f8eded
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 40.7MB
        • SHA256 0e7929bfae3434de3ef51fbe11f4441577541af49c9f7413f9e64fbf99fe337f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download