Overview

overview

8

Static

static

3

2026-07-03...kl.exe

windows10-2004-x64

8

2026-07-03...kl.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    37s
  • max time network
    124s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/07/2026, 02:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-03_9987251e15c32e31271f6fd5bbff63cb_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
  • Size 30.7MB
  • Sample260703-c8r9vsft5k
  • SHA256 8df0d8f2cdb0ed75fda45aaa6b4ab0c70010ca5c60f599dd6c353b866a240530
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-03_9987251e15c32e31271f6fd5bbff63cb_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-03_9987251e15c32e31271f6fd5bbff63cb_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4672
  • C:\Users\Admin\AppData\Local\Temp\2026-07-03_9987251e15c32e31271f6fd5bbff63cb_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-03_9987251e15c32e31271f6fd5bbff63cb_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1240

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 30.7MB
        • SHA256 8df0d8f2cdb0ed75fda45aaa6b4ab0c70010ca5c60f599dd6c353b866a240530
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 31.1MB
        • SHA256 db1c81119f724bb0d7e2b83f2575f69dc62c8ce6b00dbb2b1f8a5e20293854c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 32.9MB
        • SHA256 e23dbff5a8ce146698a7bed44c9653e326eba4466ce0cbe60b6591d8f61d84eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 61.6MB
        • SHA256 77fbe5ab6f995b4b01b19499c79d5ee6145f8dadc7de18f120e14d7bfa6e7edc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 67.5MB
        • SHA256 69ca7cb5daba4814ca6e668ebaefcd15eff61166585dc9857c884668564fe5c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 63.2MB
        • SHA256 df62905ae667fa291e12776c466511fb198d11bb7ef7b1d31c22d6927f2d04e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 64.9MB
        • SHA256 a0357d914a431c43b423a2cbb4a269456c2f4cc0bc6005f7280f26a744e4100c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 63.7MB
        • SHA256 327b93cd82f7704862ef198a0ec6d7e6db34accae4362ac9ab0b882b78d26a8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 63.3MB
        • SHA256 1e26712e9b126f49bc7ac8409d86c6cc207b56eb7107f2139e535d986d4d41c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 64.5MB
        • SHA256 ea01a7b035359d9eca223c6db44e23ea4fe1cbecce9dd1dae6252d1624f56ccb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 61.5MB
        • SHA256 cb1fa55200c2ea5307b7106f3623d351344db2682dfe73f7d4f4269f3c8c0f10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 61.5MB
        • SHA256 caedfdf9d5e0d43d45944020ed2da1f4ac377d4e07e3f15c8db7a4da9493a356
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 61.5MB
        • SHA256 9d6c973db8019808732e06f476365b300b3de400d47011f53d9e52d5ec985fb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 60.8MB
        • SHA256 fa579b402edfde915cb35e8f94133b00d4af1e7d18867a270b4fd578d610d988
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 61.2MB
        • SHA256 c6ac7ee414e9b0e760cf3a190772302af0b9de0a6a580f3bcce39aa1afc9b080
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 60.4MB
        • SHA256 4a6086840b4eefbd2f88708cbdede85d53ec732096d57fd88d8120707e68d71a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 59.9MB
        • SHA256 b7c1dccc28145d51149fe1737813a690f4beb1f5a84590f10a9fc53c6703a638
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 59.0MB
        • SHA256 e58676782f695df7d974a77b0d6e94339e928d5e421422c5ff7083ae684f55b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 57.9MB
        • SHA256 8393ed4cecf8b08a574f8ec228d924cc3aaf2052cf8def59a655f3ed7565f0c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 57.8MB
        • SHA256 28ae8e0ce5d8965a6a5a1cc97a373d4222d6ed717543375a4684cf0dc1acc089
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 56.9MB
        • SHA256 c034ffd11763e9b9d61b0e72a2778a48013582551bd7b3bf3cd9409255512a07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 55.8MB
        • SHA256 83f36a66f9645e6786065c1c016b85462fc8a6c9defb74c81712120b2acdabe7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 55.9MB
        • SHA256 c74f7eadcdb63e3baad8062cb9799f440ea538fb12eb3429f5b2767d50004671
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 55.1MB
        • SHA256 0b5be504eaec22073a0b202848baddf26c4c49f8f949d95e894e7e99ffa8342b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 53.7MB
        • SHA256 77f1b012c1d71bc5c7b6553e8808435ad5343692fb04cf58d34f0c7b971d8e9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 52.4MB
        • SHA256 0998c12d4ffd1e5f735105fde56db341adc3d3f725a44b85cbc5f4e0bcd745b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 52.2MB
        • SHA256 f6cc11eef073e0d339c7ebb4fa2b19299a9327d3a5c9ccb2803ac8cbee878b56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 52.1MB
        • SHA256 411086c938f05925ad0606b92b4e568d49e8ed07a1a5b3228636ff1de7066034
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 52.0MB
        • SHA256 1a73c166cebf21e1167b1cbedcdc36ffd50992c5c774d2f9c88145ce37cb5379
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 50.9MB
        • SHA256 b11e4e08f87ea0119cf847c061b3cde3de0383ed8aa7e5781585b31b226d3edf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 51.6MB
        • SHA256 73422c272e4165661d4b3a050c7d2b9a32a566dac1584cddbb794ef5706c47e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 51.8MB
        • SHA256 a4e597799d2db6a6b6b4535e569e77b9d1b03538da5abb2cefdc1ae6f6c9e603
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 51.8MB
        • SHA256 fb899ee05d1b6df1df93c7aeefbbb5cdd97c03b3131ea7aa164abbc18fafea76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 51.0MB
        • SHA256 7e17adf4160e3c659e97396a1f69f4bb296cffff8fff0be739f7f43b53e1be31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 51.6MB
        • SHA256 cb8279bd653e1d2f920e7fa3920cf1cd631d10d26a28690b2bbb1703cc6f7241
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 51.5MB
        • SHA256 286a2eedda55b063e26b3a7674bf7a5ee2be830f8be483026a64a5adb5890146
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 61.5MB
        • SHA256 342d3a1f4d7b4a820e8a9f131e4454e3e89f7f09259e82e4e7c926099fee7e75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 61.5MB
        • SHA256 dfc1e63838d18b1471ddfd40e338a4411f77cd5dd1f495ad243b1cc6aaf3575b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download