Overview

overview

8

Static

static

3

2026-08-07...wo.exe

windows10-2004-x64

8

2026-08-07...wo.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    34s
  • max time network
    158s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 01:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-07_85903d7de7ac0922bbefde41385db9b0_akira_amadey_cobalt-strike_coinminer_elex_emotet_glasswo.exe
  • Size 23.0MB
  • Sample260808-bdtnrsxala
  • SHA256 520c0134ed506f146caea4177e30bda58b677d6865aa6eac402a60863f3af16f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_85903d7de7ac0922bbefde41385db9b0_akira_amadey_cobalt-strike_coinminer_elex_emotet_glasswo.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-07_85903d7de7ac0922bbefde41385db9b0_akira_amadey_cobalt-strike_coinminer_elex_emotet_glasswo.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3248
  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_85903d7de7ac0922bbefde41385db9b0_akira_amadey_cobalt-strike_coinminer_elex_emotet_glasswo.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-07_85903d7de7ac0922bbefde41385db9b0_akira_amadey_cobalt-strike_coinminer_elex_emotet_glasswo.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1368

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        CloseDismount.asp
        • Path C:\Program Files\CloseDismount.asp
        • Size 23.8MB
        • SHA256 eccd6f802078b16761c7de547aa2aa456cf7ce72bff4a9f5fa5764dbda846d78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 23.0MB
        • SHA256 520c0134ed506f146caea4177e30bda58b677d6865aa6eac402a60863f3af16f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 23.0MB
        • SHA256 54574a19e1008d9868552350c249a04cf50f74aef8e18b6cd83e93a9ac761d5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 27.1MB
        • SHA256 f4c2d399c7f5d456dd13f9b589e2aca54069a27567b59caf857c6f5a9f2a4a98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 46.4MB
        • SHA256 29891a6b0bc6394d5133e2fda6fb616eda3e6bec7b6b3cca189de1b1cb37b8f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 25.1MB
        • SHA256 80c70a59452cb943351cff46349509fe48f145826a9409cfcc0ebd92c6d57e1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 46.0MB
        • SHA256 7b8ef3215a805b2744c4f5711e864ce52bdb7e3e08949250c374a1b3f22fc969
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 44.8MB
        • SHA256 8e8fffb36c2474b7b1926a214c7d46a5c0992e9c3bfc3ee2f5b95622fd10486f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 47.6MB
        • SHA256 c1d6346eda9a7b11d694a841b392918d23491f72ba243c59ba8673c2553268e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 49.2MB
        • SHA256 559c0f65aeb89b1c5015cd069af080b750d245991c75e4edf4d4f57b92082010
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 48.2MB
        • SHA256 9d474ba71b23002e263b6297371bd92ea7c45e47626a0d30419e206e9d85e78b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 46.6MB
        • SHA256 2ee752823bc16879a241864fd56c893f83ac58fa6e13845c86163672e1bde77a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 43.6MB
        • SHA256 d4818402a417b61974995a2bbe7a360ed32457a0a29a0b85fd6be98d88c81820
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 46.8MB
        • SHA256 5280418a0ebc4048197ee6d7b22bbfbd3c96b03181494c6393a9bc4bd2de3700
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 45.0MB
        • SHA256 0d613532b37a0fd93b373f7f6489d44280080a54e304a34aba34fd8119cae1b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 44.4MB
        • SHA256 5ef8a064e1c15f0c5f861569bdd786d23336dbc3a0ce5057f6d5650a20cbc83d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 42.2MB
        • SHA256 eeebeab53a1500f319cca4b4e960e8682dc0cf35852dc615c79b93a8a04a9a40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 41.3MB
        • SHA256 58a2a27de17da33c546d5bd4a43b68682f4dae27045796beb56ceb1d4d7db3e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 40.1MB
        • SHA256 2fbf7d0ca5347ed5b46924a514c2092df3d508292639e224250daa65213b8aa8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 39.1MB
        • SHA256 4db6d98e5db1d52d8d8fd0cd02d0b124afeebbece570703ad0ae5668937da870
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 38.2MB
        • SHA256 4acecfa7587363ea0c4aaca121a00dbae3d6083a05972660cfa0b632ab8b3843
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 37.6MB
        • SHA256 246fcdffa417dffbc3708a3297dd438440511492f46b2eb79dce9b4140fae952
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 37.4MB
        • SHA256 e0e05ebc6b64e89d96f8c3c980530a2255ba6f47a9a527a950ad17f797283df0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 37.2MB
        • SHA256 02ff71b5b4a5422498c9be563c21ec46f695bba3d84c78b07640af1bc60ebb52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 34.0MB
        • SHA256 4e2c106d24850299c50950d141630a376e42cb4bd8ee5748466552a6bed5943e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 37.0MB
        • SHA256 d02028714f6a30325af93086627f5b7cadf7b442fd05b552c55505718857ffed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 36.9MB
        • SHA256 737f7c8da350b60f99f2b194ab3e2d5f2887abf000c03387835d841de9c2e660
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 36.8MB
        • SHA256 3c1d549563f7dde90da6da4f45efa7aaa1b00bf6cd60275de2a2e4727c2a6737
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 36.4MB
        • SHA256 3b4f37bcd65bfa21ceaf61816754540379f4dfdd8ab10cc396138b3c9ed6a95a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 36.6MB
        • SHA256 0d689a2bd400b0f2a4ccd2a5cb1d2ab6d3b441a9d8530ba7d26c5d885ef6ad25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 36.6MB
        • SHA256 878cfa860492801af952ee6d336a5a0effd9ecd6f2f25da78af777d2d9d745cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 36.3MB
        • SHA256 a652d7349932e73d418ea58ea3acdbc3745e73bbec477f3427390359c53cab08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 36.2MB
        • SHA256 d0b94762cbeb2c5f61e88f4b557268c814daafea5d2229359568bc4285825a61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 36.2MB
        • SHA256 93f3c4ff4f96758fc441ae20802e45c15c5bc6839e8d47f3a4f8e82ff7fe5267
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 36.1MB
        • SHA256 5e2ad6480b41685474820af35633f11c16dad18d9a1c8e16efa3e413faeccd61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 36.0MB
        • SHA256 d7f08f810ca753b66ac8fc5c8c8a0b07ae87d34313731199caa45d31c772fef8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 35.9MB
        • SHA256 6127f5932353ca6d3ab79978f8d44bf45390ae6327c985a9bfc17d37b13b6763
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 35.7MB
        • SHA256 3d3c14647e1030551dfb563125fe423cf0b040020d80f5edbd1f8a09176f37e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 35.6MB
        • SHA256 3f5501aebbd22cf55c1c453e83eced33c34258cb9848c67b474305123f9474dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 35.5MB
        • SHA256 ff5d34baaaae9441695704d7e4db11eb053ba9c5ecb69cdd95547a3505ec2eee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 32.1MB
        • SHA256 18836e3ea64608ea74e26804879a26abf8c7f0a1118deabab1f708efa93773d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 35.4MB
        • SHA256 8ad37aa5beade23d845808f1355eb48bdc74bb55b6ff497debb1069ccb2404d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 35.3MB
        • SHA256 96ab3e06216370cb898f012889968feafa17f67363860fa14f8fb59aecdda2f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 35.2MB
        • SHA256 9208d4578dd6a6cb95529041958dfb37e8512c8e312e3bf63658355664b4f1de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 35.4MB
        • SHA256 c99a6454a03e82dcc9ad7056757045013e91b4a22840ce0165350fa45d49e296
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 46.0MB
        • SHA256 0a4849e7d0fa81fd68e9f061e2230fa816e8c6b3c2527e9cfaeb8e367d4673a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 46.0MB
        • SHA256 c9dd890f69b9d18ae8f6305228d28660150882bba12a270b39c035291e639042
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 46.0MB
        • SHA256 000272f7d1607b696be1a5ae13c1c9b661e8ad4bab9a29adf86690d081ad1aab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download