Analysis

  • max time kernel
    149s
  • max time network
    116s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    15/07/2026, 04:05

General

  • Target
    2026-07-15_f23f2067c39c560eec53307c7fa906c3_akira_amadey_cobalt-strike_darkgate_elex_emotet_glasswor.exe
  • Size 8.0MB
  • Sample260715-enqlmsbs4m
  • SHA256 1dd20a4e789d9b659349d545bd6fe241688a1634158a54b687566fc82faa81c2
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Control Panel 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-15_f23f2067c39c560eec53307c7fa906c3_akira_amadey_cobalt-strike_darkgate_elex_emotet_glasswor.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-15_f23f2067c39c560eec53307c7fa906c3_akira_amadey_cobalt-strike_darkgate_elex_emotet_glasswor.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5500
  • C:\Users\Admin\AppData\Local\Temp\2026-07-15_f23f2067c39c560eec53307c7fa906c3_akira_amadey_cobalt-strike_darkgate_elex_emotet_glasswor.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-15_f23f2067c39c560eec53307c7fa906c3_akira_amadey_cobalt-strike_darkgate_elex_emotet_glasswor.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2684

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 8.3MB
        • SHA256 64a8c6fbe1091a60bbe7a066b59ff34d4cc5d4314e02d82dc00207878d1d610b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InspectorOfficeGadget.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 8.0MB
        • SHA256 d82a3ce0f081a6cfc00ec6af64c28bd200c9a26dbf21ded1a7f4f93606347d10
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IntegratedOffice.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 20.1MB
        • SHA256 f32eacba37efbedeb5af199c490be00c4ba7279b402387b9c326026b986e8754
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MavInject32.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 16.3MB
        • SHA256 b9f7b977269b67c3e79d11e3fc36dc12ce245be08c4f86c645bd769e2972e081
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OfficeC2RClient.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 39.5MB
        • SHA256 3486bf256762706bb68f690d02af264a858843de3777052d15f90a81dc815c0b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appvcleaner.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 10.1MB
        • SHA256 6b14a81ad5035bb47773ab97ffc4231b5f5efa0fc94cc984687fbdfa887606a9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VSTOInstaller.exe

        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 16.1MB
        • SHA256 e35238aee836496b70d8599d39e3455ee253c087e4ae6bb3df5ba1de8f880b2a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrmstp.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 22.0MB
        • SHA256 f2445a231380a12040b5c2d625f32d927efd9837efd43d6d24a8b77bd27c8ebd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_pwa_launcher.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 17.7MB
        • SHA256 e1798b4d48c56600e8b0c86cf21eaceeec477da0c2b40903bb00b7e382ce7a4d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevated_tracing_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 19.4MB
        • SHA256 d7ee119337084d2e6d3f8ce1af5a99c06f72fed215e6d69f847a108a579552c9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevation_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 18.2MB
        • SHA256 c1fa8e6eaec3df84029a87b140df240273bbebcb6eabf2e2290ec740325e8e13
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notification_helper.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 17.6MB
        • SHA256 ca48b804b6c51d849d3d53205b791b12a58cab8df29203465a7a5f84732e59bc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        os_update_handler.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 17.8MB
        • SHA256 b798b615926fe88506a45cb92f5947d9c5f500e8bf4734be132d28a5faf886cc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 19.1MB
        • SHA256 9ca5275ccf463dd274db01bade40833c4e4e0c3f1741afa266812f2bfd3e2f64
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_proxy.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 17.4MB
        • SHA256 c171f3ffc9e5ba7694c4851a627c30a7ef962608866025f1541b2a8c393ef298
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appletviewer.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 16.0MB
        • SHA256 13854e5f37e4b73f23437583286b75e669ee45258de3b2e2ae083a9a9ffe2123
        • MD5 SHA1 SHA512 SSDEEP TLSH

        extcheck.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 16.0MB
        • SHA256 0383e275b72c30735f46b59b7a5484a91bc356d15add2132f3766d4567b62334
        • MD5 SHA1 SHA512 SSDEEP TLSH

        idlj.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 16.0MB
        • SHA256 2c244087df6f24ff279a842d8d3c0f671ff9226e7b4f331fbfa540b8f1ad04b3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jabswitch.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 16.0MB
        • SHA256 1d59ba71425cb602ace03c873a6a93d472a45af6720845b2b3fdd99e21bdae10
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jar.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 16.0MB
        • SHA256 2f66758f5f08bb11af7922ed2acd0395b0213983eb0818e13d4a95d9e27e3c49
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jarsigner.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 16.0MB
        • SHA256 94851c61417352deda2bf6e263ea9c8aa96b382a0d10c745455e5d0f0ac7f712
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java-rmi.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 16.0MB
        • SHA256 4a96de4189d0a0c2290a8b3dde564c927ccc296aab73124c7173046820ab84de
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 16.3MB
        • SHA256 5671036b5b8e79a693340c0feb9912dc4f18e0618756c7d5329ee38ea2596d82
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javac.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 16.0MB
        • SHA256 1cdd696fada1d72155eeb83b397edebdbb03fe353393a2ef7e0c44ecc7d1ca2c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javadoc.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 16.0MB
        • SHA256 6e79024191000245736221ea461b2d65184652b325fd89e33cc1e1a170b5f16c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javafxpackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 16.1MB
        • SHA256 8c939d2239208a487ad56f01577b58d80cd930ce1cf508646e608c016d3ad64e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javah.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 16.0MB
        • SHA256 864e8dcc18bb62cebb3316e21efb097b8fccf67e6dfa1e53493c98515a7c21f9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 16.0MB
        • SHA256 117aa2e4a25b554c7fbc9849f036daeb3abd913426020b9e51d3635a80d63f98
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javapackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 16.1MB
        • SHA256 9eb1d09caddb59cd56c7ae87fba257f055adecc402c4cfa3f64ac11a79c47871
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaw.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 16.3MB
        • SHA256 0e7badb44678bf4134eec540c3d9673dcd8d162cd8039fd4efd1bfbad65f27c2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaws.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 16.4MB
        • SHA256 067be3ba59ec12b0676e32eb77460adbe247ed79bd7eb2f6a296678214880fdb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jcmd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 16.0MB
        • SHA256 7c1da76c6d07e20cde852a3ecdc4182a2e342a549b8fa65d1c1a06f81da015d9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jconsole.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 16.0MB
        • SHA256 1928cb0c418064055f7969bba1e33ee763eebbe80ed45c8421db44b99ce87a80
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdb.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 16.0MB
        • SHA256 e2f328e12c86645bbe1e358c02b23026a18b3eac36a130d2c5d421f1f1e860b7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdeps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 16.0MB
        • SHA256 1cfcf4288d4edcf10d82a4714e482e685850542b3af9d035eab0d903b0d1f9f7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jhat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 16.0MB
        • SHA256 69bd8a9a964098563db322fe461840f0e323b345ad6a66db8799af05a78942bb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jinfo.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 16.0MB
        • SHA256 d88eb559bff8b3d7264afefc3906d51709f9d2325249daf36bdc14d440ae0114
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jjs.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 16.0MB
        • SHA256 c1047154facfb0c3160018d78bcca701262f529fcbbd52b9a1adce3fa1d14531
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jmap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 16.0MB
        • SHA256 b39293abb8ddad456b21decf294cb28a706561572f9d99013c330336c5fb8ca4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 16.0MB
        • SHA256 832d61ad49ad3610de8fb723e8ba2dda2322d03437bd82e90cb0594e1fb33b88
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jrunscript.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 16.0MB
        • SHA256 5ea30aefa5529878e709dc2924841f68236d7c583947c435eb11aafd4032661a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jsadebugd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 16.0MB
        • SHA256 e4ebcee84e8b189fed8de5445353cdafbfeb628cbb72d44f6dcbc6b6e89d6685
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstack.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 16.0MB
        • SHA256 b8523860b66e04dde7097271bd71cf06087f42e917365012bfc05d049374cae6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 16.0MB
        • SHA256 b1f9f5ccfd509d461feb15ced874c5b21a8e079fae3d668dbbe3d210559cfada
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstatd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 16.0MB
        • SHA256 00f96eed90f1b30f6cade2cbd1c38e28cc176ccfd5ac2ec7b87b0762163b2e3a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 16.0MB
        • SHA256 a67d697a8f4e71fb456998a6d427037fc8e1b8ce717384c15aafb2f7d71d273a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kinit.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 16.0MB
        • SHA256 6113436f5eac3ad4d8f6f2120b1a4dd313838a3664a2dc3776d57d623534c451
        • MD5 SHA1 SHA512 SSDEEP TLSH

        klist.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 16.0MB
        • SHA256 c6f254b7b11d36d02931867e2f06a65df4fa8688abb6cd2c9dde60d452c10149
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ktab.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 16.0MB
        • SHA256 e05ea70abe3f8bfdb420e1fccf97f781fbbc15aeb5860380572ee8a1732a4673
        • MD5 SHA1 SHA512 SSDEEP TLSH

        native2ascii.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 16.0MB
        • SHA256 8c597424b7090e38825130ec48ae211991014da89102304e9d78c6a9c9a4a2d7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        orbd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 16.0MB
        • SHA256 2c1c8652c012a809dff3608c145f7662907dfe1db39f1d97c4e2c38cee46227f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pack200.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 16.0MB
        • SHA256 13244e115e18707dd5b8c9146aae3ae5c138518ea584bcc71c58a90bc986a522
        • MD5 SHA1 SHA512 SSDEEP TLSH

        policytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 16.0MB
        • SHA256 f4127da889fcb4330ae5d8a73bc8d40eda3001d64a746777d79bca6eb9859ae8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmic.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 16.0MB
        • SHA256 ea4d136f4b5587af34b7887fb757933ef3d810eec46f412870b58802a577ea0a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmid.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 16.0MB
        • SHA256 98c2595f557cfadc23f94ab3dd6804fb06efaadbefbc8b8b79d24209946a4ed3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmiregistry.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 16.0MB
        • SHA256 aba2d50719503deac8eb8a709b23c24d5324ae4909cdaf2cdaf463bb2984a0ec
        • MD5 SHA1 SHA512 SSDEEP TLSH

        schemagen.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 16.0MB
        • SHA256 84e0f76776974a6a01644a6b99e2322ae3c9bd0e3eab890f31f86053ea5feaec
        • MD5 SHA1 SHA512 SSDEEP TLSH

        serialver.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 16.0MB
        • SHA256 8ffadfe30ae0111284c4e9979352b2802c15d10260a35b796ec4ef466bf61f19
        • MD5 SHA1 SHA512 SSDEEP TLSH

        servertool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 16.0MB
        • SHA256 11c150976b5135720fb398d600d8fe66e900c109d51bbbc22f71731b92e103b6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tnameserv.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 16.0MB
        • SHA256 a35b560c438e3faf421a5525665b24021457771bb20160fd1c8ef68e3fd7c93e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dotnet.exe

        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 16.1MB
        • SHA256 5c7755c4d31f79a67968bc2b95cd8e341ccdaf63b2ab65a345f06d134c9d6598
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 16.0MB
        • SHA256 d5e577b7182af8063f437ca054acbe5c8ab929d03529da23444b91b421573def
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 16.0MB
        • SHA256 abadb5c938c3e015ba7544a0d3de7ea5879d62a561dbf43626e995fb0573cd23
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 16.0MB
        • SHA256 7aa09cda757ab35d1b16ee6037ea47b56de180e445f6b419fba5a65378be08cb
        • MD5 SHA1 SHA512 SSDEEP TLSH