Overview

overview

8

Static

static

3

2026-07-22...kl.exe

windows10-2004-x64

8

2026-07-22...kl.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    48s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/07/2026, 16:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-22_f0d1c0e68247554e4a85e6bd9ff7f992_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
  • Size 46.4MB
  • Sample260722-vaej8aygma
  • SHA256 7584ea6a225b19024cb0df09f41da46c0c18bcd82f5d7cffaa3ae1f583ee23cf
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-22_f0d1c0e68247554e4a85e6bd9ff7f992_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-22_f0d1c0e68247554e4a85e6bd9ff7f992_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1228
  • C:\Users\Admin\AppData\Local\Temp\2026-07-22_f0d1c0e68247554e4a85e6bd9ff7f992_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-22_f0d1c0e68247554e4a85e6bd9ff7f992_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5176

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 46.5MB
        • SHA256 e1ad38aa6b5667f9416be81a12b1c2a75f4c03cc676157e4fbf1af0a005ef49a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 46.8MB
        • SHA256 f6a5b8383f2aed521067585e0a8b5eb8e48dab4c5baa5b76d16002ed0b9b7a01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 48.5MB
        • SHA256 69e74927d405fd2224d7df023c6e9d7ef15867b2e1e950c145c8b98b6883c7e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 67.5MB
        • SHA256 3126ea42d2d817ecbba9efffa532427e07b8dd679f923cabdda73840b08449e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 55.1MB
        • SHA256 5ce9515fd033688582c5e2333c8cd6cc3fe787c9ab2ac97d5490a9a68c8b8c46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 56.1MB
        • SHA256 ecc7dfcb6eb7a0c5a3b38ba82e56f962aa7669c1719793629cc1a3c2ea859a14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 55.4MB
        • SHA256 42c79662ecb53812b947141e534db2baab6a5127af401faabd04276c17f541b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 50.0MB
        • SHA256 47d73f05e9b6c09ed383ff01c77591c9dd67ed1159ad4fb06dfcae45d1554caa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 50.2MB
        • SHA256 a05c3333b38b265b6979821074c3682ed5cee9a3f99b8e06d8aa8ffd0dfa5ee1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 48.2MB
        • SHA256 8c1929d9f9ae20cb1b079e9c076e582a853fe833088ceaca9e8d266402c5d253
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 48.1MB
        • SHA256 8c911d19af0a6ac51b3e5e138c5f3fe6aef778ccd44e0024ba13b5d208e741f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 46.2MB
        • SHA256 321086d4704166372aa708d68ce262aba1abba9b4e5ddd8042b9cb5794a03242
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 45.5MB
        • SHA256 9748370bf0cfd02ac626289ddcd795ac29a76a2a4bc737b63c3270c7e5de1000
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 44.9MB
        • SHA256 a21b5d3cbfc3df45d0e1a3675afb6353a5f7c4e7de1ecf9fd80bc62688932f42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 44.8MB
        • SHA256 99d9863d08fecda216e2dcd234352a14a1d2bdc9513bb0070a3909a56c72c47b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 44.4MB
        • SHA256 0c75c0c69193e9e9bf6ba3cc1a6db5787772db0a0f5c078cce836c88e0ab4abd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 42.3MB
        • SHA256 814a4ac633accded3a3b34db3d089516f93e74fd42eff93919c556fbfdb69a55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 41.9MB
        • SHA256 886196a40766880ef090420eeb465b7303f86ada573b305a5ac7c3194260052a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 39.1MB
        • SHA256 7391bc5c8813094bc708a054d1848072bf47c5fcd905d35931a0e10e60458221
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 37.6MB
        • SHA256 ac240876e2ce74986de12a2fa7bec5041f4fea6d356f06d54d26cb4d0cbca2ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 36.2MB
        • SHA256 cb89b0ea3b5fa9d65258ee917c0d311e83979f92790ab431ea8102cb7bfbf3d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 35.9MB
        • SHA256 ce1447445f42f7597032f8714c3060965376b810a2ba12c85af30fcb7169efd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 43.4MB
        • SHA256 e1e32ebeb8a616c449fb1e7aae8340c26dd05fbaa60eb76a96f152aaccfb80c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 43.3MB
        • SHA256 e0d923012087f2c3dae0b435355778e905adb0a37fbdb6c8ce05a01846c8b3b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 43.9MB
        • SHA256 c4ce6268d97182cd0229214eec47ee71f6756bee9dc28f09a494561f96438565
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 43.1MB
        • SHA256 4e26bde5fd18f450093bd951c725735139acc05a15a468b66e1f1074c5258980
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 40.4MB
        • SHA256 b7b1fc4bda9bc97fad85e9c3c3bbb0dab82aa4462dd6567d6b31ce847e9da7ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 27.4MB
        • SHA256 2137967d03c1a41401c210b8fa87f345202ec65cd53e6bdb7ac41b9c9f1df24d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 26.6MB
        • SHA256 70e0aa775dbfbd688ba214d0e55f4072e38aca211c160259ad91a71829792ac3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 25.8MB
        • SHA256 25385806a61b4324a20a01b38d200b543303714c28fdb547ad4d4cb6cc35c017
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 24.5MB
        • SHA256 01ab50050f55571183f5fca50176299cdeda4289efa3c969159f7f661d010817
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 22.6MB
        • SHA256 bd0b7956d9de6995218a6ce296be4f3fa45723f8073c800575209eea7e48b46c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 21.9MB
        • SHA256 c0539df47f171f7d20a06d4d620562159c9139ee69328ce60acede3570ac5e5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 20.9MB
        • SHA256 eff346d887cd4c3d466c1f835509e0a49bfd7dc90216290e73cc3dfbb7e11165
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 20.3MB
        • SHA256 f91868c7b6a718641fb3a41ecd931ef8d296e5d97cfa0630a44f055a07eac464
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 19.8MB
        • SHA256 31bc58945554382720a4119b0871a156668bf181864de0c234fde6aba8ec367b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 19.1MB
        • SHA256 1a6e5a5f2f172caae30b9afe419d3b7cf169647e98d60a599c88cef0605f82a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 18.8MB
        • SHA256 649b0d7941d4169f544200a2176c314f66233869670b2b7101af79a32d40fdfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 62.8MB
        • SHA256 6811d8b9a5956d5410eebc332a5828bea9e8246854db0f2323b89df5dcb92b59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 61.7MB
        • SHA256 f3600bcfa123f0032d35169532f6c68da863ae6e7ccf28ad38439634d2871ee2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 59.3MB
        • SHA256 7390ca496768f1de9ad9b24d0e3c061b10e891d7bb3b361ca5bc5d2037c48c8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 58.4MB
        • SHA256 43aedfc1e1cd9cb59e31486bba4151abbe46d339c13214c1473e69ef5d42ba24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download