Overview

overview

8

Static

static

3

2026-08-13...kl.exe

windows10-2004-x64

8

2026-08-13...kl.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    151s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/08/2026, 09:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-13_7d7e66b7aca62cd4b23eef66fd768f22_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
  • Size 30.2MB
  • Sample260813-k2lshawbph
  • SHA256 b0a21c92846cae6085f151e89b8e58044ad4c5290592e9844e77250b750a6749
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_7d7e66b7aca62cd4b23eef66fd768f22_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_7d7e66b7aca62cd4b23eef66fd768f22_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5996
  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_7d7e66b7aca62cd4b23eef66fd768f22_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-13_7d7e66b7aca62cd4b23eef66fd768f22_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5952

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 30.5MB
        • SHA256 298b018faf11f949186eb3c57fd75f21cd63f15d15c43ba3211e9d376ce15b24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 32.3MB
        • SHA256 c597ff189c3034730bf0e726181c14ad5df53f6a80cce40f2e60f96b26a912fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 60.4MB
        • SHA256 5140a06f5cc696b6bc9db32e51768b8fab728798fa7bccd041b3a8589a602356
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 66.4MB
        • SHA256 82f1d5848d21b21ab57dd2b8c7c230484a10cc281aee6e03cac5cd3c118ae5c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 62.0MB
        • SHA256 cbe140614cdc32becf0ed16e53c2f53f242607760642d4a2831cfa2030b848bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 63.8MB
        • SHA256 b3cf88e4dd1d17606071d029a41dd5de6343f249d139301d259155f44bfb1462
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 62.6MB
        • SHA256 3d844c977fb285f3d819fbd8ea7b67e3a5b27369c3398b8cfa9105afcf2375e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 61.9MB
        • SHA256 f2ab0dda98453d4954aceef59d6f748f3b25de520d08b14689db46ea9efa9164
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 62.2MB
        • SHA256 b64dd7f05c0a9b10afaea0a214c39d0bc00ee7785bc76cd0feff53f31d377a41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 63.4MB
        • SHA256 204953407b2b7b302eba3831e0f5acaa4dd6f155d17eb089572c6760ffc43edd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 61.7MB
        • SHA256 e312a86fe023ef3bb0da9110cdc9dbaa33380e655da9ef3c054d41dc268fd02e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 60.3MB
        • SHA256 37af550d69deff407df841fcb80c6dcc2f262ef17af8b5b8ea3051a967749bf8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 60.3MB
        • SHA256 9165ea730fac5f4c3fe429c067c1bee195d4039e4dc98f79ec11587dbc81273b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 60.3MB
        • SHA256 25e7e2c9d85586b4415bbefe7b9289170255ddadff35c4f6df7a62cbe82bf660
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 60.3MB
        • SHA256 abbf19d846b6909e292235804cd2e82c45345875f88bbaca4531ea7f0693231d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 60.3MB
        • SHA256 f8688a9d321ce6c36c0e5089fbb98e7554a9aaef08d27006216346da1eab14ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 60.3MB
        • SHA256 6a116e01028bd78661cbc2313d26371e3cbf1ddd8f5cb595dd3115f4eb2bba14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 60.3MB
        • SHA256 a93cead278eab8656354d0c38861e374fabe2b303c9e351d0a0450e9f88dff91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 60.3MB
        • SHA256 7682f24bdf43e4dbc7a1dc8a66356a2c419e6d7905a469ad0a93a75a7ac63eff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 60.3MB
        • SHA256 393a19d9e0ad41f5b5cec8a8179b4b32221f4ad3374b63b58c72d38e5fa27832
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 60.3MB
        • SHA256 49b9d0829752082d3ceab83cfc16536f057cfc9f66ffe5ceafee47425415244c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 60.3MB
        • SHA256 63babee24427e336f879f7c5a7fb406d30d71a589eb319ca38bccbcd2204379f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 60.3MB
        • SHA256 197fca3ac6ffba91c8262ca30b627976f1e74bdbac01a974fb657ffed8d1234b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 60.3MB
        • SHA256 bce9df673dd89943b4705d4c39e501e33bd433e43cda46e48d4bfa54a8c19e36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 30.2MB
        • SHA256 21f69e8dc638d84726995e15ba27e2271b577617b519fcb6ee2d88a0c5970704
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 60.3MB
        • SHA256 fe223d6b9a6b52d9530d040344f1221df8dd45ddb331deb786bf108b602470e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 60.3MB
        • SHA256 44ef488de09220999665a9a3449fe21ed082e288664760b0d3351b032d6d4645
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 60.3MB
        • SHA256 5970d8405261d3cde7606f2e21c70d03c51c672cbb93b5928459489b329119ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 60.5MB
        • SHA256 12735c9d40bf9bd77de6a99461e922d6212d8b166a94f5800ff5bea30f5104d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 60.3MB
        • SHA256 9a7955d3ad83758cc42df2aab294acf7d195f52146555d91ef47e0ce80e074a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 60.3MB
        • SHA256 9a2c69c5a41103b3ce765f05ef4930ba611e25a81704769ee635f782a0ac096f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 60.3MB
        • SHA256 fa433f2a57bda1a8dac0d3c0b7bb8c521fde79c85667b4215c81049897d7f9ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 60.4MB
        • SHA256 ca7130275956b3fb17a97e9d615b36c217722f035812547fb70188d96ae41e35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 60.4MB
        • SHA256 e8870b6fb285642ff1250368c932c3940c6e5887b13b0212f0bfa132ba295985
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 60.4MB
        • SHA256 35d19def6b1aa3b6fdcaedeab306a05fb8a01638c85bd26e4cf065ab3e657838
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 60.4MB
        • SHA256 327ceec427482fcf30bf404b96b11ae972271ba59432cb6df7e78ceaa544d894
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download