Overview

overview

8

Static

static

3

2026-06-03...kl.exe

windows10-2004-x64

8

2026-06-03...kl.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    03/06/2026, 12:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-03_80ab9613f2d9d70e9e4fee896b238861_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
  • Size 16.3MB
  • Sample260603-p8dspafv2v
  • SHA256 e63e4a3de68151a60e46c1035e175b38202e248c61d90678c1f31316c62e789e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-03_80ab9613f2d9d70e9e4fee896b238861_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-03_80ab9613f2d9d70e9e4fee896b238861_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4508
  • C:\Users\Admin\AppData\Local\Temp\2026-06-03_80ab9613f2d9d70e9e4fee896b238861_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-03_80ab9613f2d9d70e9e4fee896b238861_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4192

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 17.0MB
        • SHA256 a5a2aa7de4b6fc3c36d141e865cd9071d65f44e7b56f9be9e6ecb5948115a609
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 16.4MB
        • SHA256 89f423b832b3d22b222b2cf31f69d2ebd63b26b3ee157299c24b0f7f78a5866d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 38.7MB
        • SHA256 f46793e9b8bcfbfa749612148ae75cb45d851bea21e3fdfc7b71870d00108c7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 34.3MB
        • SHA256 849df51a0c029605516d10d1982591ce65cfa8fc772dc28a1bec803626cc3e94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 36.1MB
        • SHA256 f11c0039a670568bcd50d04320c12d2d41be7de8c6927e0c6ac0c996f7c5fd43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 34.3MB
        • SHA256 ca701800194391995fb5615b79e9c326eaf66fa73884532f583c460891179159
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 34.5MB
        • SHA256 e72a685d3f227f1b31b14afd72789d3559e96bd79d8052e276abe94632dc2522
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 35.7MB
        • SHA256 64d8aa942765ba49b725cd6038582e14d0c0790d7e209b5c1b61df3a040f160d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 34.1MB
        • SHA256 c22f9de0eb98df10e6b9c46d8e0e3517750db6d7a83a7b042e7161f24921579e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 32.7MB
        • SHA256 eea700668f453aeabd26ce985d035046a40b00c75a6839135c8e0ac3fdea7500
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 32.7MB
        • SHA256 2941b54b8f796038d5100a462c07460a391f284d6e6a825c0d64777b873fb22a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 32.7MB
        • SHA256 58e6e4585e341cb81b9f0eb59e10b75fffb6feb2fda7247e71019b9857819abb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 32.7MB
        • SHA256 854e8a86984bf49155c5992ff57d6171fc08c5eef41699b29fe0012bce395f99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 32.7MB
        • SHA256 c5c46dfcd03e70dddceb8b65daa1ccfac572d3f7765d18c3b9ce27b1aa36e88e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 32.7MB
        • SHA256 0c67c573977ad0612f74d5f11fc2e5ac97ee2479b29bf5d28b7474a6ce74560d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 32.9MB
        • SHA256 629f6a3ba432dcdf9a0d2d9ecb645a3b4ff18194872faf0c53ee3bdf5c35a623
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 32.7MB
        • SHA256 b96c1f814ad1d42f68dc1e2bb9ce70b0566029ae3beb312040d8fe7730e7d8c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 32.7MB
        • SHA256 302b4972cfc7e7c8bd38d0f56e61a67e37337aaf90a8144cbe0461d2d96e16b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 32.7MB
        • SHA256 3dedaffb00d50cad43fd3f1a99141312e85a424dc4ba1fc5c18e46bdfdcfe5ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 32.7MB
        • SHA256 7a3eb041a65d35a54c65ee8c7313175b01132b68d3c5ebb78ed9b424c0c1f50d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 32.8MB
        • SHA256 d05af0e6d84684e12362b56d601f58f5efe84a8a6c3e57f681c4781a37164495
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 32.9MB
        • SHA256 b0011c966b03f251c70f3d7e6cb8d2004f136aa617c6d025e97116b29a5bd933
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 33.1MB
        • SHA256 9d084021a5979bea574bf02c95f8823e6e0e773355d9e87373182997bfe06e9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 32.7MB
        • SHA256 1e3cbc07237947c6b5ddd5cc54b84e989224ea6ddffda900a70e37aeb29f9bfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 32.7MB
        • SHA256 c3f1ab9659fda2167a0211b49ec54959b2510360aaae6c32bbae9213770c90d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 32.7MB
        • SHA256 0e92089a983d9bab246d0363b24397a9251b00f69bb6c1c3aa75cdee0372da1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 128KB
        • SHA256 43487443e34438846ba103b7924eff4a32e10c362356ffe679e3f7f007a74316
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 32.7MB
        • SHA256 10aac51e9e1fe429f0d6e203f2a7378c887349228187896b93bfff808359447a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 32.7MB
        • SHA256 fedacd6a2abfcb6598b8d4d78f6a5737644808663353741b3c9ee5441d99630c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 32.7MB
        • SHA256 cd1e8192cd1d9551c4af9b60695ef8a571db2dfcca65d5ea6706cf2c547a0af1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 32.7MB
        • SHA256 8d68362d484860632a071f9299520b6f16df1778dd6aaf7adb2c50685b6212cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 32.7MB
        • SHA256 33233c28b0453402d69061f1bed466a1226b1016ee29a0d2509387b327eff8ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 32.7MB
        • SHA256 fba3c55a1a3496ab0fd5a8f20a20f84f57f500145db08a5e0ec1f6c6d573ec18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 32.7MB
        • SHA256 3ce6a42acb96364fc67d84c7b57960c16edad2ce71f54fdacfb605b372ba1453
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 32.7MB
        • SHA256 6338cbc53954d705ae7a0bc56dd9e68cad2cb17cfda589c259c3bd8403426ed3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 32.7MB
        • SHA256 666e0df2b1ec51171f11397854481a90b874d4118b8f422e53e5b9e5028c0dd9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 32.7MB
        • SHA256 42ea340f581cbc51bdd21a64e3905cee4f80ad66e7d5f70c0bd8255f9e584d08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 32.7MB
        • SHA256 b1a484b7e28049d1fb89358ef657c0ada44fbc556790cdbdbae166a2326bf1d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 32.7MB
        • SHA256 f13a639676f9fc632acd947e1a55e7d61d3aa5b6518e6a12b93b1bcba406d78d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 32.7MB
        • SHA256 45612afbe4900993b329bac6d5c5d3ce49d3502689da49ec398f764637eaa480
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 32.7MB
        • SHA256 a55096383828c4549a731b81bf1f8d7e74d6fbc9ba50c93260eae9f4118953a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 32.7MB
        • SHA256 bfa8241ea5aa0573618d25706d535878086d8924a6e54b5325053f4fd8ae9ce2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 32.7MB
        • SHA256 c65df5489dfbe826a2799e9bb9c0d2427a341cc7e444300767129d151fb83a70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 32.7MB
        • SHA256 64612ac0957770281f8a3c401aece192756c477f49d7d57e9e1911267bb2b30e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 32.7MB
        • SHA256 888f4577bf0b8bb9051b6470559d863e6ef4aaaa6af33c6254784df0fc910e30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 32.7MB
        • SHA256 5b6bd7c60abd8afbe5e72621a88136084563f4b706ebe0cc286e8376bf0fb50a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 32.7MB
        • SHA256 ccc0d95b6e8f92b3260ef0aca7806e0b8eb9b42534457275e84e732130759f70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 32.7MB
        • SHA256 76f3b8fb66afb751944647e4fee58d9fa624275fe1bd4fa36545724e4a9dad51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 32.7MB
        • SHA256 06144e78e983ef2713f5ddaeb2d2b2f618dd76c1b0d3cdda5c145c1a3c36b40f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 32.7MB
        • SHA256 bf6f7f90db2320fe6fcaa706b203cde3ad7d643cfac6be704bc6770928631bff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 32.7MB
        • SHA256 c36873d3953533eb994ac14c6ec8f8d0c9b0a6c33c451577823b56eee987e2b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 32.8MB
        • SHA256 b6b05276af121446db6d8b079e6193aa943a174e2eb5b85ab7bf07ed67ebd31d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 32.7MB
        • SHA256 3e6ef7cf32dd08b7d3ea497d275d5c5fd096686e6447b7997f9903110ef42636
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 32.7MB
        • SHA256 673bb3cfa05cbeb970479b156bf30ebe2ea72c4e7b17c9a5bcbaa99118e6e9bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 32.7MB
        • SHA256 01ca9024c7e6a82d2115c2949f06d0baf8b891a28dbf09c0ac4d01bea44e61b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 32.7MB
        • SHA256 9e99cf6a8621ede71a6b1b3da59b3a50f6cd009aaa79cdfac573550658cd1509
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 32.8MB
        • SHA256 54c7931f973529d993de1b9132724ac6cb22915700dae5257f9e1bf21ccf75ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 32.7MB
        • SHA256 1da28ae3789f14556db393d66f07f2648606affa60ede0bead561deda86edd36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 16.3MB
        • SHA256 e63e4a3de68151a60e46c1035e175b38202e248c61d90678c1f31316c62e789e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download