Overview

overview

8

Static

static

3

2026-05-04...wo.exe

windows10-2004-x64

8

2026-05-04...wo.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    139s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/05/2026, 18:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-04_a7d2618dc2d85070465de7eb7709a589_akira_amadey_cobalt-strike_coinminer_elex_emotet_glasswo.exe
  • Size 41.2MB
  • Sample260504-xae7vsez2j
  • SHA256 839a11ed227a033d34146139e32dc56dff8c650fa16ba1890b9b442b8631f78b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-04_a7d2618dc2d85070465de7eb7709a589_akira_amadey_cobalt-strike_coinminer_elex_emotet_glasswo.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-04_a7d2618dc2d85070465de7eb7709a589_akira_amadey_cobalt-strike_coinminer_elex_emotet_glasswo.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4860
  • C:\Users\Admin\AppData\Local\Temp\2026-05-04_a7d2618dc2d85070465de7eb7709a589_akira_amadey_cobalt-strike_coinminer_elex_emotet_glasswo.exe
    C:\Users\Admin\AppData\Local\Temp/2026-05-04_a7d2618dc2d85070465de7eb7709a589_akira_amadey_cobalt-strike_coinminer_elex_emotet_glasswo.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:920

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 41.9MB
        • SHA256 29ef140454b4e8551e9cec743c5651693bb7a0ba80b69812bfbad1d5f333ee36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 88.6MB
        • SHA256 aa4553201d5db99f31185f3d910e21d9d5af5140407e4e9f72731d38babfd1f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 84.8MB
        • SHA256 798b93604ba69d7e260ed57778aedb3d5e1e7d9bd19a8ae60f4891722d718f83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 84.1MB
        • SHA256 02de708cf0ad9dcda27a3442d7b9e827d0affc333455961517ce05010c433216
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 84.3MB
        • SHA256 16512f5488d783ef5ecc47883500a53877455dd68eaeeecbd0c12e148746b407
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 85.6MB
        • SHA256 81ec5def716bcb7eaa08cedc864b3b7db02902d64fd2e54dbc87eaa87bc5e773
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 83.9MB
        • SHA256 db17a20d139710d78fd3e6eac4aa8cc753b835c8a1dc1926b9cdb4d6a9e0648e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 82.5MB
        • SHA256 c5c7481727a2233d2b7114d62dedb99a60cef7480bd5838a657ce45c35796938
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 82.5MB
        • SHA256 9b5640bedceaf5d7b2ce3ca75faff914d4973cf09a09109dbb3b196e997367de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 82.5MB
        • SHA256 0c4d257dacc3523ac1b02d8c9cd77e68eb446b38eae14642fd2c425ef00a0f58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 82.5MB
        • SHA256 2a05389858850fc93912d5e7c33a38a55724d54fcad319ac14f86a0b6a4ca902
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 82.5MB
        • SHA256 0623ace38ef81d5c3e68f9e4e80cb4011c7b26e33fadad2a0f9b248e57372f95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 82.5MB
        • SHA256 cfcf2887c36bd38603e1e6fa84445ecbae4a18680315fafe160b97eaa1e17bb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 82.5MB
        • SHA256 14f48eca2ba85081a8335c64e1f6664e66631eb59b5edbed4824824a12020761
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 82.5MB
        • SHA256 8739513ea1a38449acac06c9dfc680356409093872d1877d4787302ff24af75d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 82.5MB
        • SHA256 8fb33aed8ba08603f42846465a6e236a040d8acd5a74a0d2378ba6564c069e51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 82.5MB
        • SHA256 5478f155ba542ff3c9bec6f4ddebc9764572aebcd404e72c945b004ca93bdaf3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 82.5MB
        • SHA256 586c0793a5d7122cb103db3552761532739488ba277555cd8102df2e6f26d9fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 22.3MB
        • SHA256 d35a73397f8469dd8cb76fb6d9f92a1aae99b517de0c1f26d1839c91f78dd291
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 23.2MB
        • SHA256 32b99a7da374c771c8d681540d1c543783773a5afa0f27092a9c76a94933d413
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 17.2MB
        • SHA256 0a4309fed096a00950079a51a2741236fd0c27cea2f4e9311e11a6c508a77af8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 11.6MB
        • SHA256 e8ea5d314d7f577488269a968f988de91e63932eac5eb257b76f921de93c4ecd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 10.6MB
        • SHA256 4c65064d59452f935096d54508d75d0b3149e875582637d6ad707be096f726b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 5.4MB
        • SHA256 46c9c6923f1d6997c0174e8f2c9d69d92960d830ffb269d03a7863a8d588e1c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 1.2MB
        • SHA256 b1962da8d33f6617288a010b54e3384a4e4135ccb7ef6b3c61558c2c14148d23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 41.2MB
        • SHA256 839a11ed227a033d34146139e32dc56dff8c650fa16ba1890b9b442b8631f78b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download