Overview

overview

8

Static

static

3

2026-07-29...kl.exe

windows10-2004-x64

8

2026-07-29...kl.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    52s
  • max time network
    114s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/07/2026, 05:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-29_cd97cc42ecc0f6d63bb3199aa344e186_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
  • Size 16.9MB
  • Sample260729-ftft3aeb84
  • SHA256 367c11ad6214c6c6efcbaa9ebcfca80c6ba9169867c8f69712e61cdbe1a80a8b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-29_cd97cc42ecc0f6d63bb3199aa344e186_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-29_cd97cc42ecc0f6d63bb3199aa344e186_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4400
  • C:\Users\Admin\AppData\Local\Temp\2026-07-29_cd97cc42ecc0f6d63bb3199aa344e186_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-29_cd97cc42ecc0f6d63bb3199aa344e186_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4020

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 17.4MB
        • SHA256 4625e8a268421e65b65f0e890bb2ca85f7ba45a0e8f1fc758dec816e1e11e0c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 16.9MB
        • SHA256 9f3f4c7ec256b6ca6127e5ad203b55defaa5692e889a7190a6a956f323266b02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 34.0MB
        • SHA256 805b180948fad3b00fd95799add709d722aeeadf9bc3b3ef7e5478bdc1e078cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 33.8MB
        • SHA256 fdc2315f871b83c806780abc7c1ea21a825447fff825ec5ae75f6be89a628944
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 37.9MB
        • SHA256 52adca78dbf8ec86baa6bf6afd95b1fdf7f4311fe6015cbfb9716fec91fb1be9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 34.1MB
        • SHA256 bd281d3f958505c834089c9d2742faadbeb890427e9bf73dd9b705fc045fe71b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 44.8MB
        • SHA256 dcfc671187a8b3b8b37c79ca467281eb5fc08eb66aca4aa16cf6e2a36c9792ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 38.4MB
        • SHA256 aef288090017e064308cbed7df426f54d7bd62fc8a590dafc234156f823cd3ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 35.5MB
        • SHA256 8a2e3b2dc06164e464b6a37473fc6a3768835ede28bfdfac3cd707036636f859
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 37.2MB
        • SHA256 b653ad4000d509f868bed1d790c013c3eab4863b7b99c0f44f1aeb79388f1087
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 30.9MB
        • SHA256 7779c2103ff391ffecda6c1227f58e1188d2450510622d673ec75b94525398f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 36.1MB
        • SHA256 8c5a4185c1f0295967b1290f7a560bb1666eabba792726f4b809aca08294014a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 33.8MB
        • SHA256 0383c7996e1949b6499788fcce14411c0cbbfc718da81f0a0a6576348109bd80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 33.8MB
        • SHA256 efd0ad8f1837f9c7b41cd9939cbbed361f87b63cc9047f0a133a9d149d8d7d7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 33.8MB
        • SHA256 6bc1f44db064e26b0fefe48dd5aa2c6dede4134fa3d3fcba0039c0069e62b9a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 33.8MB
        • SHA256 ca077392538087dc5c41649b122e39c480328633a9536dd852f5687b83b79952
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 33.8MB
        • SHA256 b1e420882bc575386f3e3a838498eca8c711c54ec1c4c9319eb0ba1a0dde1565
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 33.8MB
        • SHA256 0956140c84c5ff762120ee127dd6be271639d5506a74d6abdc240aa4b77d14a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 33.7MB
        • SHA256 d1d3ab938cd05ff96a13b8c6024093bdc6089a6452a41e31d8ad8672cc881043
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 33.6MB
        • SHA256 61906aceda27743fac717f461fdac31c46f678483a7f02e7b350d696bca43fe0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 33.4MB
        • SHA256 0227043cb9c9c8560f42caa6cce2142818f0449db651a1e02849e807eb99902f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 33.9MB
        • SHA256 08b64a4e6fc8556f98c1b9f192f2a62bf4f1d33784d9e015696b7eb1cb4ff70e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 32.8MB
        • SHA256 df761120239cfda4eabe0569a91daa477a1e25071e99c9f753a8e86e96228ef4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 31.4MB
        • SHA256 e81110bdafb1147c51b88cae25f67730bb47a197b2bac22321abd4f4d1241c89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 32.1MB
        • SHA256 915736a83ee728b11af8e029a39056c80b811a16c34092e80c6e2940731b2572
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 33.0MB
        • SHA256 1d199fd55435f309b42c1d581bbbb7fb30a10f35d75a5ea667fbc0b0c74c9596
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 33.5MB
        • SHA256 1bf385b4d53a052e07245140263708fd88302b1b8b370a1df857dbe492532617
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 30.8MB
        • SHA256 07e8536c608eff1ff9b1f971fe1e3e415d0cbc79040bc3538320a315687b8832
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 31.8MB
        • SHA256 219a5d77c805a1bf8fa00f06a76b9b45df22ac64835f4a3e02629cfd4071326d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 32.1MB
        • SHA256 e44c513ecfe07d97a18098c8dc970b966081b5bfbfcf3c52e4d21a3d137e816c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 30.8MB
        • SHA256 3690a75f6de1f5f06e52daa01c97ce3e1237a482a10f45386fa136f2d2da2c0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 32.0MB
        • SHA256 8e034777a81d2fca500c47b5a07a212fd0f0af0c1dc7d536fff402c28390c460
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 32.9MB
        • SHA256 4923fbd450b67c0c5804cacdfecf2778ad6d76b91e4c1039eaa0b5dfd576b242
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 31.5MB
        • SHA256 d19a14864302bb6c29e41765bc76cd81092f0c7d452b30ffaeb1c3c3ca8c728c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 30.2MB
        • SHA256 d63c49c5d238f80c8d9be0e5ed8c0f551ee0f1b54a73cd1b82d8f0d1f3c7b49e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 31.1MB
        • SHA256 ae38488ecfbcc0c7fe0f9aa1405912c3b08cfda30888e19d920ad75fa35e07ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 32.5MB
        • SHA256 004d0e046ffd7199e29735c6a78a73b58a7ad60d989b2703f5b97c4884d1718b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 30.6MB
        • SHA256 68a46c86d9460c307c325956c94c3faf70e13133c6fe8030230714415dd86611
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 32.2MB
        • SHA256 408a9c195b53a7b151bd81ad35b9ff5bdb7e7d534b92f50d047af1a916259165
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 30.5MB
        • SHA256 c2328df540b142053d595f8784698a48770c2512f916a0946353fc65c78f9b37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 29.8MB
        • SHA256 00d753d37cc6a35ee5b45cc1bc230a78e5f682b18d615c5335c99ce9ed67db3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 31.4MB
        • SHA256 324fc55045fc99944f13165a169b216a812af3537a1022ea048d679211186ad8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 30.6MB
        • SHA256 a37b271202a94529ea963cf897e58cd5139bf3406cb4ea5c04d4ed9ea057bbbc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 29.6MB
        • SHA256 01be237ddcee807a70609d3434f28eed42ae5669b81d472e50815d22ed69bf3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 30.4MB
        • SHA256 126a41837ed31c6bb6ba3e075cd9faedfadb96f117e575310f01e75805acee5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 30.2MB
        • SHA256 0d005ff33a285d7b00d7111e06f24ec083e077dc6c13c0b694fe795d1cc5536e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 33.9MB
        • SHA256 4bfc0932adbd8d288dc2a196c3c9ee2576b50ab5289ed0472da3f8e08252bd4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 33.8MB
        • SHA256 51ed743639dd20f7a6148fd7136e38b770757632e42994680d7b1e8a87891343
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 33.8MB
        • SHA256 897e16b9a1b8220b6bbf95946e909fba2de53a5f8ecd6ac7d77b1e65eb7d90be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download