Overview

overview

8

Static

static

3

2026-07-30...kl.exe

windows10-2004-x64

8

2026-07-30...kl.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    9s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/07/2026, 01:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-30_8eaf208e089b31c83dd4e43a8bc83213_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
  • Size 32.5MB
  • Sample260730-brscvsar9w
  • SHA256 b312ce818c515d62b54dfe742fccd1c9a7e604a377276f18d3216e931690a190
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_8eaf208e089b31c83dd4e43a8bc83213_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-30_8eaf208e089b31c83dd4e43a8bc83213_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5388
  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_8eaf208e089b31c83dd4e43a8bc83213_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-30_8eaf208e089b31c83dd4e43a8bc83213_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5676

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ApproveExpand.asp
        • Path C:\Program Files\ApproveExpand.asp
        • Size 29.7MB
        • SHA256 f7f775c1e78d8121412215790f9257f44b913b69e9d6571b157734ef14f1cc58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 28.5MB
        • SHA256 ccf50def62b3f119d2f1cb7dee2d941a215d2f17dc2b82a8ff7b555fff0a2ff4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 24.8MB
        • SHA256 5df15e429fecf9ce2989db5ed02a6b6f0bd9ab266a09fac8fd92c35d1b6bbdd2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 28.6MB
        • SHA256 abac366b89b6a39547b518485cd13e266fd2a298b71dcd45a55b4d69165b499e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 24.5MB
        • SHA256 ba100d975babe6e0e3d9aa2763b9dc438f4cbc57ce186445957a500d18bdf154
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 9.7MB
        • SHA256 3bff79dbafd156dac626b54015d8947f109e117b6ed0ef993ce007efdc70054f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 23.4MB
        • SHA256 b7d361c0b776e2e615b814a5195c119cf07b8443028dd0309cdf37ead823970d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 27.0MB
        • SHA256 a6d7d813c2d1677c8a5c856bce64b212b104a401e401121465a822bc645ce362
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 24.1MB
        • SHA256 811ee98f4613faf96fb86b5f27a593989921032e1912671abfb2f2e366922e61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 27.4MB
        • SHA256 7a97f25fa8dedf237bb3d5a1b0abee6eb719efc270ac5c1f71930c3c88f87aa6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
        • Size 27.4MB
        • SHA256 40588eab3db38e5ece9b1f70edf0c5b425ed92712b59139e3c3661e55aa4543d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe
        • Size 26.9MB
        • SHA256 9a79713457bdd536ff7df8b715d22c9614735eff4c78500845389fa8bff78db4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssvagent.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
        • Size 22.8MB
        • SHA256 dd51de0e657fc190a71b2da37c19587577b1e97910fa7282e38f814b1c4f18c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe
        • Size 26.4MB
        • SHA256 bce4928daa60c626803b5470887c8d477f2c8960c8d2544df89c603f2ebf5be2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe
        • Size 23.9MB
        • SHA256 277680024640d67108ccecde350ca910e399c93a59dafb564912507b0232487e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fontconfig.properties.src
        • Path C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src
        • Size 22.9MB
        • SHA256 68db84dc8288dc5d68cba61aef440f086b6f335df826a396574cb182e2df15ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jabswitch.exe
        • Size 27.1MB
        • SHA256 eacf3b0468fb4a92e7ef2560f0a372c26c8fea22107ef8e4b24299a0ddd81ef3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jre-1.8\bin\java-rmi.exe
        • Size 23.3MB
        • SHA256 da639f772696efbc4405520add408774de02b559aacc36f3f26c09b04a9ff6b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jre-1.8\bin\java.exe
        • Size 22.6MB
        • SHA256 3209e195714990159edc3052c1a6b7ec494147b772d9b3655dc01a8cf4f62c56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javacpl.exe
        • Size 22.7MB
        • SHA256 727ef0cf3778e1772b9ea9cd700e4407445d034a761cad6643693c2a0f8d8794
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javaw.exe
        • Size 26.5MB
        • SHA256 1652ab1ee2ebee7d01a56b094115fd5a5030cf0a4fb323b4b9e268f0023528ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javaws.exe
        • Size 26.6MB
        • SHA256 bbc6edd696281b892df5e20fef2297f7251176de5a9ff9d3fda6b44dd1d209d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jjs.exe
        • Size 26.8MB
        • SHA256 bbe62c9d978209ba727885b67501adb686dff7e74a9c21ca3956e9ab8ad30efa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jre-1.8\bin\keytool.exe
        • Size 23.1MB
        • SHA256 9783ca9e5d5e610933736d0d1a4cb038555a5f0b027c997793c8334acebc9c54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jre-1.8\bin\klist.exe
        • Size 26.2MB
        • SHA256 2157d20036656bc795cb62f081795d368a2a87300ea06760a920aa579bb10afc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jre-1.8\bin\orbd.exe
        • Size 26.7MB
        • SHA256 0023ee72032f2d73430eaa66b0eddb836e2e99817341ca9f6e32c73495017c82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jre-1.8\bin\pack200.exe
        • Size 25.9MB
        • SHA256 2f55067f5d3329ac0e87d2ef53f6f1af5adb226100d023cf55097fa1a0058f26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe
        • Size 22.8MB
        • SHA256 2b0d1468b570098726e0b18490d7b0b7c357d9934e1b62cfee34eb2e029cdbfc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jre-1.8\bin\tnameserv.exe
        • Size 25.8MB
        • SHA256 d6f62d5471cce8294bbd4b485e544fc4c6fb999e452860df0c55397b563e1e6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jre-1.8\bin\unpack200.exe
        • Size 26.5MB
        • SHA256 8076f99940f188a0f74bda8889cde1c6ec7a9c59a5603d5df97d0f2c76955a6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVDllSurrogate32.exe
        • Path C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe
        • Size 22.4MB
        • SHA256 a13bc54c0df5a195e826617eb32fef089195808d123898713385cffe019cc6e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVLP.exe
        • Path C:\Program Files\Microsoft Office\root\Client\AppVLP.exe
        • Size 22.2MB
        • SHA256 507ecc0d1ea44c0da736de6252d5a7ddd70fa0ded22c72c678725fdd05cee279
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Integrator.exe
        • Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe
        • Size 26.8MB
        • SHA256 2a492178c789b57d17f73dc765349e0ad6041349907dde351dbd05986df6d7ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Mashup.Container.NetFX40.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe
        • Size 25.9MB
        • SHA256 818ec59a625ba0d49949df1e923e99633cdccf6b481a490e9c464c890731fff9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IEContentService.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe
        • Size 26.2MB
        • SHA256 b4642d38f13234e3a69d7bccad140be5da7a3e66f93bba6f84b293bcbc469dad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SDXHelperBgt.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe
        • Size 25.7MB
        • SHA256 f35b01c766d435f94e86828b2801f1f0d9890bcb55f6722917d670cf3af9d4ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Wordconv.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe
        • Size 21.7MB
        • SHA256 c7248f1929ee9ae62ca79d9f33e89cf621208fb782243739336a1918143a436c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoasb.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\msoasb.exe
        • Size 26.9MB
        • SHA256 1871e0c2b76c7e1497944b286a3ff56a229cee0cb274325e6aa682d768a7a986
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msoia.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\msoia.exe
        • Size 27.2MB
        • SHA256 83542fa34162115a7d8a3759ef3eba7eaef76116071069ec5a9f81a3d15dc101
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msotd.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\msotd.exe
        • Size 22.1MB
        • SHA256 5e381b534bd4ff9694c0c5adb836dd7b63e5efa31bb0955cdb6c5ae9f05c12ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        protocolhandler.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe
        • Size 22.6MB
        • SHA256 0bd09e4c045dcac1e299cac2b1e7a37af60d5455b1ac92237e0c9ef46abcbf2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SmartTagInstall.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe
        • Size 26.1MB
        • SHA256 e52609599b2932d848d7abac2af3aef185066bd0263209dfb8eadc20ce38ed93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SQLDumper.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe
        • Size 26.3MB
        • SHA256 0065feddef12bd6a2e8d7a831cd7c8aebb4066de03863c9b133a8c3ad00903a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download