Overview

overview

8

Static

static

3

2026-07-30...kl.exe

windows10-2004-x64

8

2026-07-30...kl.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    36s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/07/2026, 03:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-30_9a874430168e4a1c9cfc94e786f1e9fb_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
  • Size 36.4MB
  • Sample260730-dnphxayaph
  • SHA256 ba047bd09fe2f1fd02e312988cf5a1ba83e02a193f9404a8ecba222d9d177ede
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_9a874430168e4a1c9cfc94e786f1e9fb_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-30_9a874430168e4a1c9cfc94e786f1e9fb_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4104
  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_9a874430168e4a1c9cfc94e786f1e9fb_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-30_9a874430168e4a1c9cfc94e786f1e9fb_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1460

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 36.4MB
        • SHA256 ba047bd09fe2f1fd02e312988cf5a1ba83e02a193f9404a8ecba222d9d177ede
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 72.9MB
        • SHA256 34267baac6026ddc21b8b4fc9e3cba7ccc1ab9166b12f95e48460b513b372ef0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 73.6MB
        • SHA256 56a75858ab05d2fde9f714804d5505946562b36e9ba7bc92b88bd7fcafab6fcb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 72.1MB
        • SHA256 d80486f9f2eb3504ae1e8ff696297b50e7fb1aa2b483ecffac5680ed60021141
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 38.5MB
        • SHA256 8acd8a1b42b57247132c24b77bf4436469cf217816bbca465c9471c869a0eb87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 64.6MB
        • SHA256 bf9165e83c845e0b8222b23d761baef86533fcd183dfd0cbb12ac688802bc042
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 56.1MB
        • SHA256 3e4047c0da7c9e212f5d7840b31105ec5238ba41fff64c4ebaf5da9ab7098243
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 56.0MB
        • SHA256 a026eb42023908ce120c07153dcbc45d2d82909df5d8474966bdbfa6d0ebefca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 59.0MB
        • SHA256 6ddf5ec9f3aa17c69966859a1423eef61d3c3526ecd5301c9b2d81c0b24a9645
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 57.8MB
        • SHA256 d8bfa1f9d49df3807cb82d6b588ded6b96cc9c2c8365f08aa90abf95da5f794a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 57.4MB
        • SHA256 15609195bed585da1e53a4f9c32867e7230471cac6078ec5f8a9138caf2c57e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 55.0MB
        • SHA256 e6d41a45d3e6028891426260d0302cf526d917fb3d58134fc9572d728adfe963
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 55.1MB
        • SHA256 630b8c87b6350ce26c260c19bf17c5a1a4eaa0a415781d1cb6347f9b3dce4d8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 52.2MB
        • SHA256 035576d6396829c1fae335220c0bf39b020a011bcd1a290d61e2d5305a5d20ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 51.8MB
        • SHA256 f316c34ed17c83231b46657bfa36a8e8112311696ae626e051d74dc5edded4c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 51.6MB
        • SHA256 5ad65a0697eda4a7f458c2d4deffccb61fbedf3baa978ea4829835b6f3f2a57a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 50.0MB
        • SHA256 cdce52e1b542f1d065d1bea3a474431a2c385f98d6798ef1c32c71171bfaed9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 50.3MB
        • SHA256 0973da5b0eeb1bf3d7eb79f146928c086977127c126b991a0dc40850e0d70f42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 50.1MB
        • SHA256 7e4e8fe21c13dff5f8abb2cc1c247b5f36a2f37f67a0948d0dafb6faee46ae43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 49.7MB
        • SHA256 422c77b30a764fd6e8dafa07b8ef620fa9c75129b821b1b4401bb57de5666d1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 49.5MB
        • SHA256 b9bbd8365c735290052b3b1e70eaac211ccf7b689255599ae26209b374e53c4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 49.1MB
        • SHA256 c11d28ac6dd35be54e71aaa22ad12072bf9bb14930e166c7a1d7133038ab4b74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 48.8MB
        • SHA256 756e30607fce8eb004f11677a52b310cb1bd59075796e8ae674f56e5d23434d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 48.7MB
        • SHA256 11ab96e3be6470c44eb02b0fc41e2022217abd723bf96f2fd4224754bb1f9341
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 48.6MB
        • SHA256 0f224714bf4dcffcacaa0e28bd41d99dbb02e40e2dea0952faf7c310b2c4b0b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 48.3MB
        • SHA256 a4a364e14ac838f45d47eb038699269e8163e78f1254ac100d9297d3dd7f03ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 48.2MB
        • SHA256 9100da0b744b63ca3a931c39ab1f199932105564274d7a6417387c226eca5173
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 47.1MB
        • SHA256 4597ca791bd9e67d022412ee401f2511d84a4e9bf41f63268b24b0d0f306b0de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 46.8MB
        • SHA256 8916fada49572a5e4f982ee2e95cd5a7956a74b12b7d02d98aa96b3e1e2c53e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 43.9MB
        • SHA256 84d2361bf6b1d90570bc8c0fdc4b41e782ead94c63730938da7c205b60c50867
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 43.5MB
        • SHA256 6eb4db3072169ca4e950729b7fb9bf16c541e986a54bd0c790e0dee7fa39b549
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 42.1MB
        • SHA256 0b132c1c8a699329a9cf3b0a49ddaca55e5b4b95a85613a1b64aa0f01495ab08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 41.9MB
        • SHA256 a63bcec062d939c563b3e1ab999b5751afc0fa3beb33efeda9323d2e4acc876b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 41.6MB
        • SHA256 c1f13047ca156b51b0e54f0201beb3e3abfafc1dd8e3480011277bb8d240eea2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 41.4MB
        • SHA256 c0128293deeb185419aeb28a554ab38c729a0b8aa87b8fd3d0b89c121c87f258
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 41.1MB
        • SHA256 5bb3e50cdd399d3b77b9eda2e340e3db6287fa1727f3ad07fac0b6ef7cc52e03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 40.1MB
        • SHA256 973e065ee2900623e888ab4d88037a8b6e99eceb07133ed6fedcf6d86c079528
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 39.3MB
        • SHA256 26f7b4c40d8a6b61ab756a575b3d4bdacc6d8fc920526b4c2fe59b357a73cfa4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 39.0MB
        • SHA256 f8fb1eb98921c0a5bbc8f0b0be2b8d2c438fbe04ed5e648c497c3e1035f2a51d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 39.1MB
        • SHA256 d2547f108f010e095976ff249d996ebfcaa24864551c0ee901015280d3e6c60b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 64.3MB
        • SHA256 3333716e01b819fd75f9bd31c1e72bd3683665852cfb6d1147d34c661e6b5df0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 62.4MB
        • SHA256 2f466d7134235c312fee175f18648a2c757be71875d705de8cad0ab7bc3cd220
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 62.1MB
        • SHA256 52ea0c8154005d33163f18f310586d79519b141baf4b11c8c616b470b4699ff0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 60.8MB
        • SHA256 992b3192a1c405ef028a359ad9d1e1ce460e3d85a14fa90a7c833f3ef1045b4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download