Overview

overview

8

Static

static

3

2026-08-04...kl.exe

windows10-2004-x64

8

2026-08-04...kl.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    30s
  • max time network
    135s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 23:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_4784dc7a7f0f0e18461ea7498eea4fef_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
  • Size 16.7MB
  • Sample260804-22atnszybw
  • SHA256 f574b4553e8ddeeb0f224ec238d172e9d78d8d1835396f0912b0231d17cff79d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_4784dc7a7f0f0e18461ea7498eea4fef_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_4784dc7a7f0f0e18461ea7498eea4fef_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4864
  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_4784dc7a7f0f0e18461ea7498eea4fef_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-04_4784dc7a7f0f0e18461ea7498eea4fef_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3076

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 17.0MB
        • SHA256 0630e67a4e3dff6f7d69586774e52d1a6effaeeff2a9ba4fbd0bdc719b172be4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 33.5MB
        • SHA256 06ef7423d6c1d4da38ecf13bdf36e09486d9b4228ed60c77522880b5e8039a16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 37.6MB
        • SHA256 4ae8166ebf43c4a9d273af5a138a11b85eabf7eb444e8b0b0130a164a7df8010
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 33.8MB
        • SHA256 f2315bb46c9ec6c89f690bad063e5639261bba14e6d323827d8c1f98bded11f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 38.5MB
        • SHA256 a91bad7adef66b6118084f6aece17802691408dea69d7160643ec59acda74b0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 18.9MB
        • SHA256 0890472992880f970ce7b1f4bfd6b0fb76f0a2c064d9d255d3ea18f339521118
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 33.6MB
        • SHA256 50600d38477de9fc56172f2c3a35381abd523889511678b804d6be40b6cc7fbe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 32.1MB
        • SHA256 b3fa4829c58aa38528e11d2a8712fa74836440932a5f008fa57f14e2160a4df2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 192KB
        • SHA256 56d5b720b4307ef448fb38ef6495ea0a6fb25e8bfa8f9c140729b820c8e0cc1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 31.3MB
        • SHA256 371f1eca08068a7feed56065c3828f692aae1c817872b28c6f178bf82a3155ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 128KB
        • SHA256 e52488a8a3c5c15a2f928eb2127c84d20ca0143b2598bd3c627a271a6a7a3d72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 31.2MB
        • SHA256 1d675dc550aac1380ab520093361a82f27a8e0d20353470828af7bdf85567f78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 30.7MB
        • SHA256 e847462bd09232bd5d303d619dace495435eb6649ff349119b19f8667adf148b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 31.0MB
        • SHA256 781d7a408836ed8f5668e7a441e24d879d59193c96e1059601972a0a4b27a708
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 28.1MB
        • SHA256 186bea966695b58a5678b99aca682c4378fde24a14b8d5adee777b94cc97bbdc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 31.6MB
        • SHA256 5fdf945d820f028108cf6b5cd8c198c2693fdf78948437f284e6a043b7b66fb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 28.1MB
        • SHA256 0fbd6568aeb0e573367aa644b42b5d6f5d2b67ab7b0b223c57b2e9ad016170bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 28.3MB
        • SHA256 c5334913ca749ea60cd5add3b1adaa1a533c8dea1acd6733c1e29372b73701f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 30.5MB
        • SHA256 959174b899ecb342d8b2e51ab67af113ec4e820f5f7c479514b74d1c719f954a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 26.5MB
        • SHA256 701fb7b7963b1bebd80f21a0fe2a9a8292f771462855ba0dffaa9d7b262b9329
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 29.9MB
        • SHA256 bc222c2549cc8ed73a6c25def4606998f419bd504460534ad6546da92605be74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 26.8MB
        • SHA256 06720d811485c40f2874550a59cf06453820f7a222d1038645c960180a2af515
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 29.1MB
        • SHA256 4245e04ebbf4fe83a6ea9dd40ab954fb229b1f943b20d43a6ee556b0fe0e25ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 26.9MB
        • SHA256 6a2e9005699ec9f89a7cd99386cebfe970e0d8c118c1b6dc723585eca5738280
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 28.8MB
        • SHA256 cc3f5b327c0fd8686a5d9a775d93d923a558062a2c4caf3490d1e3e8bee2dff6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 26.6MB
        • SHA256 d2524ce48de8fca19b8b7508106a61f8fb19608221472a16589ddd7cb2825bfc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 28.9MB
        • SHA256 d5219f3d1b8599e4e51737d1c196304b7ac270a9d1ec7d528fbd517834069396
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 28.4MB
        • SHA256 c574f69f14da409e2d226676cc5a7e302a11bf0fa7af90173867fecf7c0344af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 28.5MB
        • SHA256 798c0ca61d9f7f6d0e215d58e43d38a9bcad0ddf791c6782cf775c549ee530a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 26.2MB
        • SHA256 0a347d7cec49758716fac6500441cf48d5847db39d6e32607579df9b6f54a849
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 25.9MB
        • SHA256 f059b9412ce6b40be999031a004aad6cc34f6661d2e668cebf92ebfe7b9de8cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 29.3MB
        • SHA256 12f5ce006b3618a9bb420cafb94fb3567ae98753985dda15eed7332949b6298a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 28.9MB
        • SHA256 73856afa8937a6650381ce2fef51741dff5d707af0cd67d39cfe120d005b4f31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 25.5MB
        • SHA256 2f655e91de542ade1ccd7f108d8321ffbd2f68fcb2fe209c5d68be825f282315
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 25.1MB
        • SHA256 f24b9e0493d177b7d4bfdd9d6143b7e2980fdb5681372b0955d6cfd0d2c7daf7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 24.8MB
        • SHA256 360acfbef88fa17150baf32013d8f18aebdaa56b23754efcb1df6dcf3e5077df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 25.2MB
        • SHA256 0a4fb8e9388e0e98d3297dc3ce34ff00e88964f5c66e1c0dd2d72949104f2b3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 28.8MB
        • SHA256 a447cef7ef7e2ed4c6648c5100987a37c829a48bf5eee68ee0d05d4a151eb8f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 29.0MB
        • SHA256 37ad165e6944b97ded412c07be0052302c09e4beef3bdbea6fff7cbfea427970
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 24.0MB
        • SHA256 75555f57537bf5ce6349cf3206e084fffc1fcdad9fafd3194189934cd231d519
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 27.5MB
        • SHA256 24764161cd24abc1237fdaf48e0564c4ad1bb9e786256c93921484696c5b6c80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 27.6MB
        • SHA256 b789d43b3e02ef016bd9140fa9bb5c4865a0566e7a5036e9065915b6756572e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 28.0MB
        • SHA256 fdfa6cec4b5287e9116c42152b41343551a6edd09d88a795c44a52b0d95a1368
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 26.9MB
        • SHA256 a5262ab58f48d84c88c5402560d06bde4e5ab79781af4689d3c14a57d15d1e7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 27.1MB
        • SHA256 c67868929525b5e3a729bb49e4fe91f040a9d64559a7bedd08cc0b974e6fca83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 24.7MB
        • SHA256 0ee2d7cb010f5554b637c88ce170284f5dabab3404ec66cc436f5ae2601b142f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 26.3MB
        • SHA256 c591cd5f7a104d3472bb3900cc6d422a3db6718b17d1483674cba90865df6473
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 27.3MB
        • SHA256 75d36ae912c5b064008a5e77ec8771d9ee5de6e7d8ff7dbc0c0eb3c460039a24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 26.0MB
        • SHA256 f0c35adf883b64a7bbbe9091e4b41366fb24f14da5c47b7b29435f9df88df891
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 26.8MB
        • SHA256 933d4b253799eba3d6e6d1e2686e64c4e2d3da2a670db6e5ecb8d43fd2b5d999
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 26.2MB
        • SHA256 91bc081d478df8949e89846e6a7802553af171723e81f454c47628b9adc03412
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 33.6MB
        • SHA256 f7d018099a727cfcaf29446e8fa9dac293ae88d2adb2c506de23e64d952c5ba1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 33.0MB
        • SHA256 701df63c36e27b8c17fdd9715afef1827b906d52fc36987a9222e6082ce90ea6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 32.7MB
        • SHA256 1315ed82b0e260331a59745d4c07e1c2ee5bfc3b3d36d65e333e3b23ecdcf89f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 33.5MB
        • SHA256 bac3d42c0539b07afc5e71a0f23de1b372dfe55d63b127534beda17ae1bf9719
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download