Overview

overview

8

Static

static

3

2026-05-04...wo.exe

windows10-2004-x64

8

2026-05-04...wo.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    13s
  • max time network
    109s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    04/05/2026, 18:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-04_a7d2618dc2d85070465de7eb7709a589_akira_amadey_cobalt-strike_coinminer_elex_emotet_glasswo.exe
  • Size 41.2MB
  • Sample260504-xae7vsez2j
  • SHA256 839a11ed227a033d34146139e32dc56dff8c650fa16ba1890b9b442b8631f78b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 39 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-04_a7d2618dc2d85070465de7eb7709a589_akira_amadey_cobalt-strike_coinminer_elex_emotet_glasswo.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-04_a7d2618dc2d85070465de7eb7709a589_akira_amadey_cobalt-strike_coinminer_elex_emotet_glasswo.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3840
  • C:\Users\Admin\AppData\Local\Temp\2026-05-04_a7d2618dc2d85070465de7eb7709a589_akira_amadey_cobalt-strike_coinminer_elex_emotet_glasswo.exe
    C:\Users\Admin\AppData\Local\Temp/2026-05-04_a7d2618dc2d85070465de7eb7709a589_akira_amadey_cobalt-strike_coinminer_elex_emotet_glasswo.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1080

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 38.5MB
        • SHA256 744de874c4b375571078d777a621e9ec3af97e6be8cb3c8f79ff26a470b743e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 23.8MB
        • SHA256 86dda0d1882917d559850675510fb396628dfa96e1b71f5bf64b7365f61788e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 21.9MB
        • SHA256 3f7160bcdddd7f9f94306cf8a0d45db1ff4838fdc034f47171c64c15d8274cb9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 23.4MB
        • SHA256 a9d435350b7b305fb993ec5462a5057e9edc9c2192db38c0003470950ad26208
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 23.1MB
        • SHA256 bcfd6886d330606e563158f141ed02dcbb4eab52442c11922d3fe8667d18c64d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 22.9MB
        • SHA256 7e9603c93c137de609a33598a37e15880d90bede6300376e1c535f4f74da9ce2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 22.1MB
        • SHA256 c8d73b33a60bb955f60545c21453d3da76feaaa0020a44094913a56ecec125c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 22.4MB
        • SHA256 d2d3f2e5405bc27b8c17c55e6914a8217b07d2ed3e7044cc3e6bbaf0f0d6f83f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 40.2MB
        • SHA256 44d802fd32552d88a6ce24837623d2524d47e3bcc74f22fa8731884bb22393fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 37.7MB
        • SHA256 d8e512683b71706f88ede5e5d8b2d65acfaf42b717e03b2e7e53bcd6665a5e54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 39.2MB
        • SHA256 52a6b6d008b1d6f4c59c51d640831bae9d332bb7dba0e6066812a5bf8e8af992
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 512KB
        • SHA256 c6c833db4caa76429e5cfe0a143c2cec4974ff8d848a0b31a0a64ad997496b08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 22.4MB
        • SHA256 a0c183d4051ed946cb5c84beae06dd54f7e142ec3884de475b344984e8e50db0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 20.1MB
        • SHA256 02495971cda9880f661cc669605bfedfe75c6823233d74b883d98d1311893192
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 21.1MB
        • SHA256 fd4d90d5ed555bbdb4b9673fdb9aa1b4fb6eafb289f8278dfe91a7e622b6e2e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 19.9MB
        • SHA256 2f3998bf151f6fbf289d214909ab1ff561d0860a89242eda87fb744b6631b80a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 20.0MB
        • SHA256 a2e7df1f55128410bc8d60233d4207e828f7422e293af59f911c619a41d662ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 38.2MB
        • SHA256 63d567c17abe2b0fe522567ea7488f1fab3c26cbe97e510b051eddf671c368f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 37.2MB
        • SHA256 4d079065bbe1766fbd6781e97d9a6a1b23af434007975090526fefa269949ffe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 20.6MB
        • SHA256 a82945466c81e794cc62de7fbc723e74c2aa179927bf3ed2066058edeb766aed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 19.4MB
        • SHA256 8a69199f08b9a9a639f7ab21a8f5160038b339c059758d3290105cc28527f27e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 19.4MB
        • SHA256 3a3c16840001b27d04440e193102402746b3358e0895527bb6021bd633c582fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 18.8MB
        • SHA256 b75c552de9c7ee1ab1eabb8dc31575fa0a3a29a72d0bfe38303062a2a516e9eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 36.4MB
        • SHA256 c492994c37f01ce8d79fa00955abe91659dd40f56011197bbf32f255acc8881b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 18.4MB
        • SHA256 3e263dae6b835725af9481f885b6b2ec00d205b4ee29d4e969353a8b565b850d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 18.6MB
        • SHA256 c9fb247e6bb57aa0162c96d5491c571926d725f34d762e098adf99e5a7cc8200
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 34.8MB
        • SHA256 00c00f01039b6d670ac62bc33f7b090a5b566bd9f4ef45a94fe597fa0488a279
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 37.5MB
        • SHA256 3eb4517d61dec4d3014f50ea251248d555201f6b94233360aba9b2d7e0e814cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 37.8MB
        • SHA256 8fc6ba09f2e2a03c94eb8dea81e76f8e02d5cd81498e673902777ab3582a4e29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 18.5MB
        • SHA256 9c5d9e8f906c27d15bb0cf405f4fadcc0f5dfa3436b772d516f44db0753b0e4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 35.6MB
        • SHA256 c2a67e62d6ce5449c7c8104012373a7b1e97b7692c01722d96432bab4e49e8c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 34.7MB
        • SHA256 b57851da476e43e09d01b3e5cf0ebe51bfbee8a5c8f7db81a5c7b6c6fe617aa5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 16.8MB
        • SHA256 a5c7408acc6745dfbf5b23bfb8ae6d96e81b31f4b82edde63e23b9ad0424fd10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 17.5MB
        • SHA256 234696d6f6d8067a9c18a4637e434c9dd3383a65115fe8e93d3a5ed43ea23350
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 18.9MB
        • SHA256 739a0cedf698f1adf137b6a9448a928500b82172b5ac854b0d0766190166edee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 17.1MB
        • SHA256 e1dcf610ce6bd5ba586e9bbee568db9f6675ed292dc0753a4aea1dec7937f8b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 17.4MB
        • SHA256 ee7159e928e05195ebc64f34961e99e71ada063d059d980508461a4a3cb2bf43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 36.1MB
        • SHA256 2122ff93213ef23b59bbbc3f2d5b66d5b57b8dbcd359e280290e0a5131c7909c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 36.2MB
        • SHA256 268331cda23bc56e097bef8eb067ef9382b72932fd9cf663b0f83af1f6f2008b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 17.6MB
        • SHA256 713b142a8d9d2e3730f754eafa674e5468d46900e5cc1b7a0bc87d24b91ae199
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 35.0MB
        • SHA256 9eb37126004d07df9208e2714883837264d5d2593c0142a3d8895e8b78d58385
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 35.3MB
        • SHA256 151f9cdb5fbce76269f2e37019a0e0e71c28d05e853004685a90a5088cdb941e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 16.4MB
        • SHA256 7280c2ab43f8da96c7ec4e13dabaa3c3868dea56908264c8cbb22fde47c7403c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 34.1MB
        • SHA256 e60365dfd4be3915e0d233717d4bd87d8d7b5e6de07a552e38da408fd6c7821f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 16.4MB
        • SHA256 51d6ed55311316ad0106cdead48cedb0a88736a2f7357b7c688cbb95f006a75f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 16.9MB
        • SHA256 42b7311457173860c8e06e34afd4307e1751f9a208e7cc9ae70d2cb9ad9ba3b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 33.6MB
        • SHA256 2328690178b43731f0cd47ecca9e869a7e27738f75340292c2196c7bb857fe86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 36.1MB
        • SHA256 4feb9fb80e16ab20e31d1fd3248d9b1c31e17ad2a60d958df88bb87f152c6945
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 35.4MB
        • SHA256 48b4c9039a1b9619b823f3d7fff51277ce1754c371a9ab917ef20df0ff12c9df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 128KB
        • SHA256 c845e57c2a12493146dd94d766bd3f762d2a164e99d493cdbd76d3b229f5789e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 32.8MB
        • SHA256 6d111973cd38e8813dadd7222e5272a14b7e0bb1904edcc8e8c6ff08c488c304
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 33.9MB
        • SHA256 d9ec48584aa73d011189f88742cc6e0f615805890e4cee2a46845a8f54207638
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 33.8MB
        • SHA256 db361e15038c7fa774d56b0184adaa3357179640fc9be10a2f2dcd413d695342
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 32.2MB
        • SHA256 fb23aaf4c2e1e2ac49b7efb69b1ca430549214d05e4390049926b39a3de70508
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 34.4MB
        • SHA256 9b1dc75996a9b4acab96759498801ed8a61e11e9bb7d4b12b65ec2e2c631293c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 22.6MB
        • SHA256 ac1937173d53e90cfc0409572a8b4f7c6e8f27cfb175199c75fa3cd3dadca115
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 22.1MB
        • SHA256 5e28d657e5002d4b4ce15dc9b14ddb613852f8790842c3e06e3700d3c7340805
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 23.6MB
        • SHA256 5b3d5f3656eadf45b1ef5b36778b144d704ca5c9c9a09daf2e965a7dd682ee3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download