Overview

overview

8

Static

static

3

2026-07-08...or.exe

windows10-2004-x64

8

2026-07-08...or.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    49s
  • max time network
    133s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/07/2026, 15:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-08_18825c99fbec59e37cc0d69a921c6fbe_akira_amadey_cobalt-strike_darkgate_elex_emotet_glasswor.exe
  • Size 27.5MB
  • Sample260708-sqya6ahs8x
  • SHA256 9ac371784946fb0ffba515efd7b1ca850982d1b117775968cb1ce5d87747bdb6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-08_18825c99fbec59e37cc0d69a921c6fbe_akira_amadey_cobalt-strike_darkgate_elex_emotet_glasswor.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-08_18825c99fbec59e37cc0d69a921c6fbe_akira_amadey_cobalt-strike_darkgate_elex_emotet_glasswor.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2696
  • C:\Users\Admin\AppData\Local\Temp\2026-07-08_18825c99fbec59e37cc0d69a921c6fbe_akira_amadey_cobalt-strike_darkgate_elex_emotet_glasswor.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-08_18825c99fbec59e37cc0d69a921c6fbe_akira_amadey_cobalt-strike_darkgate_elex_emotet_glasswor.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2720

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 27.8MB
        • SHA256 32bdadbd87a6c58d054bad0e9486869c5cfbf4c3bba331ec459f9ae1a44a45d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 55.0MB
        • SHA256 3ef609f80ce32b0ccbc527d8826d34d090b49b9f4f6ae77d47b97c7c96634bf6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 59.1MB
        • SHA256 be41b48bc9911b6e73d38c99a145394e2188b842de2ef35a718ce5284391dfee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 55.3MB
        • SHA256 f21026bcd1fc980add755860f7c38c133c5e8c1f3ba97dd7f8bafd45d80356f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 51.0MB
        • SHA256 1040d12fb26d8033809c1ee47da2d3c7673b3bc3a87ca1895e0b4fc5d3ede79d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 29.6MB
        • SHA256 45be53e871c1594e8f3032320d286b752c699710bc7d7d4dcbb35ed7cf15c9af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 55.1MB
        • SHA256 b033a15408e91c967341a03fef7af2cf435195d2c952aeb5c08fc870aed06494
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 43.8MB
        • SHA256 2e5885643aa9523a37e41a1eddf52648fcfd7a1f99b2748f896b269b50271d24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 48.9MB
        • SHA256 5fb79d7d73a2e7da12ba4d128f36c690e3b2a13229617c6b1bc6850bf7f04e52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 46.6MB
        • SHA256 057c050ce4286386ed8638fdc0e912f139aa833e881d7d358d7a5cc93598114e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 45.6MB
        • SHA256 bce67105bd3dd28497fbf648e8ee65de504a504f3e6ac3c0373ad8549363ce69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 42.5MB
        • SHA256 e274336950930b82092f35dd5a990d61f87a67d97518d5d27bb8cb70d4d805ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 41.8MB
        • SHA256 42fb661693a727c355a7650a02282c3170365c73876100f6c89d31035e4503c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 41.6MB
        • SHA256 ae8438c00412799af99379fa249306559eb633d32260d57bd08010fb48a9573e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 40.7MB
        • SHA256 ab3b4ff51143311259031cf4134c0b91ae73bae178018f9161e8cd9545e20112
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 39.9MB
        • SHA256 4a191441404713327888d6f54920c89b08b62a6372ffa32b75d7c33b5cca6d2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 38.7MB
        • SHA256 5a9f0ba979eb8935cb0cf1b9073cb77a081a1322f366c58ab2caa766c8b5e2a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 38.6MB
        • SHA256 615df48c35db57fa53268f35422dd052719daa02db217c78c3d61ab764122f49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 37.6MB
        • SHA256 8b8d9dbfd955eb96c10c9554b95eaa45249f262bf4dfa793699dfd40a3206087
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 36.9MB
        • SHA256 2a98e4bd9cca6912e2c294991323a11bcead5bef3905bb6f86cc0d4ab8ffb22f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 35.9MB
        • SHA256 ee5879fa6e784d00993bc5cbc865792daf900ca9abafbded2653c4197cfa18ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 35.7MB
        • SHA256 797b464df7e1adf94a6cfb4a3d061d6dcbca3f1254b0e7f401539386cc6785f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 35.5MB
        • SHA256 8499a512282da554bbde509b7a76b75fddb1d66d41cdc2e153e74ef977de0ea9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 32.4MB
        • SHA256 70d5d6b1c28f8cab33a1f9afef1e91c87377049a96784c34738da74e978cfaa7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 35.4MB
        • SHA256 27a0e97544faba6dc9da2dcdb2e4c3d2da0bd3baf2886a56ad3ce1b51dfe5e7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 34.7MB
        • SHA256 bcac94939cf7e179517e8b110a03e5a0bf7f9ef9333871514e8f495386ac6a4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 35.1MB
        • SHA256 12c24f8a0acf10ea48b071bc57d64f676872394e26ee98f57e5cefe6c98a58bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 35.0MB
        • SHA256 f5c1c9715c76b83e30692b94ebbf840371c0780ba8816112590a3ea0071bfa95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 34.9MB
        • SHA256 2a2d443383c8fdb0fb0c44921ca45c2b1fca272bcf005ccf3798b4c1544906dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 35.1MB
        • SHA256 b21c1b04a539129081246e63922ca5a48cdc97e09eb2a8f099b29304b4e89a44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 34.5MB
        • SHA256 ec82771207dd01f4e100948d419535f27538d2fa46c2039af7ea6a720851da18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 34.4MB
        • SHA256 29ba1f1794850f58818b689f66495b56a5949bd7c1dccb248b0e478998a0821d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 34.3MB
        • SHA256 5da4d3f8d6f471b4659f5ddbe86b138971452a51922cd412091e0d03a5d76746
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 34.8MB
        • SHA256 0767cef63a0b208e825f3f795008c44afa5559f62799b85ebb82e22fa6b611f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 34.0MB
        • SHA256 01de2b634c4ba8cc07726e451824e921c94efe182a90a32a1407f54d034609ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 33.9MB
        • SHA256 2a2a9bc06bacfbd453bcc16bcbff0e11118603813797a4b7d1cc481d558a297a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 33.2MB
        • SHA256 cf4cd66119ebcabfa8eb507c51e45ed965072e9c7ae4fb6a870b66d3b718dde8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 33.7MB
        • SHA256 6f6b6a02c899ff73f015004fd265268c5b16b95dd9e6cd39f9b0cf65abec3bcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 33.0MB
        • SHA256 c3cb6dc38bf2bc3a3c75ebcbf92cc9d246c1d89dcc9574fb97c45fedc4102839
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 33.3MB
        • SHA256 2d09c91737e75ab46fde3128df174cbd8eddbc2afbd300b959aa8d0d28716c25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 33.1MB
        • SHA256 60de9acd753c149ae9ee2312c528de8558b557227206619a104c5613f0db55b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 32.9MB
        • SHA256 db328c1c613ff6542ed0234f22be845876fa91fef879d8de1e23340b423c6d29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 32.8MB
        • SHA256 ff0cdb02cdbda3dce43c8c93bc89a62b4f5a330f29918a0f2a05cf33ed49c108
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 32.9MB
        • SHA256 5097a584c2006538038fce381072f15254c9d7d9e60ee48119dd85df3da17061
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 32.1MB
        • SHA256 b158528f76262f59518ea6638671a0f3731453500c8e24a3611a63b430377db9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 55.1MB
        • SHA256 64d78f200a04d5148896e889228035299236852e03f89b7096f975b734d001b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 55.0MB
        • SHA256 c6f2169ee2d74d41225e98b8194368bade896e8b962160c9e7cdeec225768da3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 55.1MB
        • SHA256 0d0c52d19c383a869cce55e6d26c9511e42c3b49cf3432290dc38c2424eae977
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 55.1MB
        • SHA256 f322469af4e15367092fd920190ab5da0ae5ecfea64e36486a8c07de9d477e24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download