Overview

overview

8

Static

static

3

2026-07-30...kl.exe

windows10-2004-x64

8

2026-07-30...kl.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    137s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/07/2026, 03:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-30_9a874430168e4a1c9cfc94e786f1e9fb_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
  • Size 36.4MB
  • Sample260730-dnphxayaph
  • SHA256 ba047bd09fe2f1fd02e312988cf5a1ba83e02a193f9404a8ecba222d9d177ede
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_9a874430168e4a1c9cfc94e786f1e9fb_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-30_9a874430168e4a1c9cfc94e786f1e9fb_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1096
  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_9a874430168e4a1c9cfc94e786f1e9fb_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-30_9a874430168e4a1c9cfc94e786f1e9fb_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4660

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 37.1MB
        • SHA256 458d643809aa78a07ed33dde53a44541cabfc44a2c50c49802df707487ffa375
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 78.9MB
        • SHA256 61110df93bef27ef12c0075daefb61b870d1961e31e9f60d6246d1bfd1772808
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 1.9MB
        • SHA256 b6cd5e5be50d61d095f4175485c7752cd317f6cda2ede12602d92f8ec1ad1946
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 76.3MB
        • SHA256 b9439427862ec756ad3c302bab157c084a52846b022eb799889f88b13ad3f0a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 75.1MB
        • SHA256 63e522a7b61e3fef8ceada8f3ea4fb6b79bb379215698953a117f039fae1657e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 74.5MB
        • SHA256 b740a40abca6e8d3b483643499ebbd596df3bba5984b29e8c6b5a9807c29c179
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 74.7MB
        • SHA256 30787eb38cab61118df8914c8a47b8b6fb68f642bd12338496e49f3dfe95dedc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 75.9MB
        • SHA256 9416b0fac8af0a2245848e61ba99f4a01ea277385795a3657473f9198a169420
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 74.3MB
        • SHA256 1ae154268087ed1f142d4277639055937688d4af0e47d343794e5ea32ae708a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 72.9MB
        • SHA256 26b14b2a5eedc8a5ae28b7b770448c3066f08594b5f51e699225acd561822eab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 72.9MB
        • SHA256 7a5ef8afad089e40d58736899ec383ce37b3094f945afa2f9147043d7c334831
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 72.9MB
        • SHA256 27d07112e024658d3195dc4741151e25f11873133f2352977aeb7dbb2c0efa96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 72.9MB
        • SHA256 ba637c80eedd4a8ffca4691c92e855872c19040e9d9f50fae25a1eb40940bcda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 72.9MB
        • SHA256 c0358efd6d71ed761454ecd05648dff6b01a9cbaed5067a786f30e0f6be5096d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 73.1MB
        • SHA256 e9b14b9f435aca3124cba25122190dec4a3c2a1515c51d86e1f7819fad8977e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 72.9MB
        • SHA256 eb87826d210a2f94f3968dc69f1f4a6a9303009b13bc31e3690703f928a173d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 36.7MB
        • SHA256 66ea9961c96aa187fd52af252f833d6ef52c657015b05b4194d8bae89b291e78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 66.0MB
        • SHA256 f850b026ae023339c9ddd461d89755ae801a2f5bf01b6736b167b0d073a49330
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 67.4MB
        • SHA256 4dbd2fd3374af3bbffad451185c6b566f47c315227d0013e0173cc40a3674bc9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 56.3MB
        • SHA256 46163294b5a79e2361b95cabcefa9387ac50dd65bbf64181b8b6c707efd944dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 60.7MB
        • SHA256 f0af0b95e978c1692fb73c612b69cd58202bda56456e4544829b367357baebc1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 52.6MB
        • SHA256 8ece9b1cd54aae1427f4474409484fc73612760ba53fb9c50877b64ded8ef480
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 48.4MB
        • SHA256 74c7056f960a28b9fafbaffa46c9ed307a35d97939cdc933efb029e0f84d83b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 30.1MB
        • SHA256 6d71172bd7de4c8f79e437f7ea91c6a8aca73067cd933b8037ff7eea5d1bc33a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 23.1MB
        • SHA256 b4a7ecb96f1e1dc3f78f514d1ad78ecc265e548867ef7ed58b8f9e9532de4cc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 36.5MB
        • SHA256 2254b8ccf11955f393e614a002ae9110ffffe3f44fb9603d169ff4c813400655
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 36.5MB
        • SHA256 414ff98194fd11348af0170d7e4aa484431b659dcbe3e8ccaec416bd593ec902
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 72.9MB
        • SHA256 e512a58e304780c0bd553da23ac4cf6c28f78a194358502ff8b891fe1db7f199
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 36.4MB
        • SHA256 ba047bd09fe2f1fd02e312988cf5a1ba83e02a193f9404a8ecba222d9d177ede
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download