Overview

overview

8

Static

static

3

2026-08-03...kl.exe

windows10-2004-x64

8

2026-08-03...kl.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    131s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/08/2026, 16:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_dff039756eba41057db9ac4ea006fe7a_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
  • Size 15.5MB
  • Sample260803-t7capafl9w
  • SHA256 e0a4a1e98a7df8c52c23b51586fedaede2a9430ce0f5da01330c40832500210f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_dff039756eba41057db9ac4ea006fe7a_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_dff039756eba41057db9ac4ea006fe7a_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4608
  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_dff039756eba41057db9ac4ea006fe7a_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-03_dff039756eba41057db9ac4ea006fe7a_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4552

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 15.8MB
        • SHA256 9632eef7cfbcf043fffed5a4b8e541d1dcf1910b679075cbd9ab106c8646d6ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 31.1MB
        • SHA256 d856a3fed1db34a196885eb7c855d3ecdfe5ca5ec9e1893c800e772b471b5583
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 35.1MB
        • SHA256 2e013e78a7b6b4193d60f93e451ede34f09b061840995360015096313ae9a15b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 31.4MB
        • SHA256 6313499dc87ba41bb83add76f840a023668373b254c70d7104c0280a8b41530d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 54.5MB
        • SHA256 c8b08b57ae32cc960a23dfd8490862b61d895bedd22f8c34777018e21183a215
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 17.6MB
        • SHA256 faa312d3ef3cfcb02496130c7a28d7ac38aac5dfe60a36c4e7382ee34d3835e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 34.5MB
        • SHA256 1e2d43bdf9d92d9c25d189017443dd9ef8d74ba5ae6af29b80f32437c4b4c1dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 32.6MB
        • SHA256 19ec3b99d4ecd87b6c7ad0ec69d38778b97ef018b392f9a70c6f175cb7b9cc30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 34.1MB
        • SHA256 d1d7cb9ebb789ec543afd543da7c22aee73ffd34715d34236baa72c368a0e251
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 32.4MB
        • SHA256 ed511bb2586b5977fb9252e932bf4cc4e95babf3549ea554eab24fc95eda3199
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 31.0MB
        • SHA256 36cb6fefeb072a14b8fa2334ef82949ef883916aa27fba52cf7e03f3a175d3aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 31.0MB
        • SHA256 b204c62ae492c0006b811226a72544c63383d74aeaef6270604baf15d8e6206f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 31.0MB
        • SHA256 3212f985393b06f2378d3fabcadc7288bc83d4eb74d24f7853bbf81c8d375bc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 31.1MB
        • SHA256 194d96caa7d89bd175f7480924c971b1ebbfee7436c6f438c439facc358879b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 31.0MB
        • SHA256 c8ae9de042c0ecd25ee96bc4fa1d5d5379c30ee7b254eddbad0b7916385c7bf9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 31.0MB
        • SHA256 23cecceb64406344d5d6f09e6ce8396ed635206ed3e8e2b80d7a5fb57c7c04da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 31.0MB
        • SHA256 8c9c0daf12444d48c6a802928487c719bf1023e57e749c48bdd0526963855475
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 31.3MB
        • SHA256 7fec021ab74f89ec2afa591aababaaa5a558bf95f18348d34ff33c611f129b5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 31.0MB
        • SHA256 0348bb52ca9598d97be2389fde6d0163c3cacc3ea90371e499c65c95462a2b7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 31.0MB
        • SHA256 28f07d2c6bda8f3e347e59ee1d60d8ab1a652c3782282772d47fda21e2d2c31c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 31.2MB
        • SHA256 cc2abcef570f139fa9a5bfe7946c006c8c7f14aad865804214e15305b3b854fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 31.0MB
        • SHA256 5e74a33c15c14a693b53285368bf334d36d1cdfea9939ba619c86cac3d4f2d10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 31.0MB
        • SHA256 22f61f7172accebdd0cb7d0adee386a3324f960a54b21a841701697a0b38ef20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 31.2MB
        • SHA256 e1c0f56180ef6e6419a4dfb65b377cdea8d037a6efb135b14b5ed85491d28268
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 31.3MB
        • SHA256 1643f1cafc372f27ce1918b5cac7cd1524ca663262e6846e1f70c6505e9bb562
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 31.5MB
        • SHA256 58c310e8ce2bcc1f7336b4faf404c86183f9d0ab9f1124f046dbe9f023acd7e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 31.0MB
        • SHA256 2d3a269a7d8029fb1a81cf61b74af6d327478bc199a0fd2afcc2dc28447c688e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 31.0MB
        • SHA256 1b114d2c0014df15bf9f7579d05860f6bd99926e6ac25010f68795e501da3a6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 31.0MB
        • SHA256 7a5726ed937656f5747c400acf91af69da1d1fac6e423e229771b08a392cebe4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 31.0MB
        • SHA256 a846fe50f0a4ef5c42a0c536d35b3bcacccfa86729cf887de25d1cc71a0917d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 31.0MB
        • SHA256 3b9d62facf25456bce6d39bc9081c79660b256c4a1baac873eecd9a30f6bce31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 31.0MB
        • SHA256 3a16d371b756961ebe88cc98d44b35b182f1b53476b6b9be38daa0912f7b6d2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 31.0MB
        • SHA256 8163fae30419e79b41ec447685b66e74b2daa33ecfa17e9c986a0b710d4034f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 31.0MB
        • SHA256 1e5613043248832a8917c0671effb137bbc8139af51ed1cf3e07297d075255d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 31.0MB
        • SHA256 272b89ac8378165fdbd44e793b705189d08a5dd1ed34918c52bd60e6c36c4a6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 31.0MB
        • SHA256 d5c75cacbe0e1a469392aa427e4d96c6c038d563c033d444488d3f998495f543
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 31.0MB
        • SHA256 75fdc8f7feeb2ca3376abd45fb184e0c381d55d5523972806afea39402840241
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 31.0MB
        • SHA256 e52208bc48a76cc71a7f69221524807c23b31f4d49cd05919a5c327aab21de0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 31.0MB
        • SHA256 c939178ec1c9e3a70aaf71560374bd86833f4cf052db86d752fbcae15ec8aaa8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 31.0MB
        • SHA256 ab3854dc491255c04bdc0f09cc00b16631d9347ef4165a5539f5457b937525bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 31.0MB
        • SHA256 73d7457ca846bc7aed8bf4782d274e754826054957cfb669e0bfdfa513d7f7f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 31.0MB
        • SHA256 ea6bb18d1d6ea348994c066588b162424e844eca505739d23cdecbee55c71b94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 31.0MB
        • SHA256 801c74c371bf14082fcd893933877ec49ed44b41042d5e1bef3765349551b4bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 31.0MB
        • SHA256 55f132645f3ae534d3cd4e82ee0ea513071f55022000e1cbfbe58a1e6a4ac5a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 31.0MB
        • SHA256 146fd09bd9a533961d7b5bfbc53eccd8414e686dd83ac52fa4b5d3d34650f985
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 31.0MB
        • SHA256 5a96e201c56e7f5033f23192026a5c09a6a23d85523c49e3a6d2bc84f1f134f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 31.0MB
        • SHA256 8a1213079a5c2fc85ad919b39be4099f4b2d49a9574c1855ed84a7da2ac0dc2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 31.0MB
        • SHA256 439f38c0c9c91b539f6da164bd1e5c8a5a08ff0c834601d5d554bd33e6b4f1d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 31.0MB
        • SHA256 67a2029cfe73916258b0c1a93fceb0da99d9f8d022394eab9850a8bbaca1368a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 31.0MB
        • SHA256 031d7bb6f20f256474823dbe0626c84045694314d3a88a3d3e908757a01bb2e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 31.0MB
        • SHA256 e3f4f84f80f97402534ebaafa4a91c69458953b26d05c8275c1ce899fbd83de3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 31.0MB
        • SHA256 c2d876f68d05c85b9a26ab9d4c3638d8e994b7d789f6f4fe0e0b739a27c15a2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 31.0MB
        • SHA256 4c5e122190a077e22b66233b04fe1d184b174a2d651a2c62bb5b1048c8105643
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 31.0MB
        • SHA256 29e1d433f7e873770ccb4f40c41593ddd626ac4fbdab6edc47c71ec731d14dd7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 31.0MB
        • SHA256 3f3112eed11ca8c2da985b5bd18166e68c9ed45ffe374c197f12b4ed9412be87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 31.2MB
        • SHA256 c66bdc6954ae21b1adce3570ec9c44b46c63171837adc1b202057ff1e18a1dd7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 31.1MB
        • SHA256 139d2a10586cf8ff2a39bfea8b59134b93cecf993cdf76171a542eaaef4a3e3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 31.1MB
        • SHA256 29797115388b81e16b86c15b7cdc5c9162e1b5b5be172d92b64259e17f6a704b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download