Overview

overview

8

Static

static

3

2026-08-16...kl.exe

windows10-2004-x64

8

2026-08-16...kl.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/08/2026, 04:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-16_99f3c7b4166ce000095fd79a3529a541_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
  • Size 17.1MB
  • Sample260816-empmysbb38
  • SHA256 37a18eb8b8294f118f8d58fec7f6d18716af88736d323885f9aba5c1a9c26acc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_99f3c7b4166ce000095fd79a3529a541_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-16_99f3c7b4166ce000095fd79a3529a541_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5460
  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_99f3c7b4166ce000095fd79a3529a541_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-16_99f3c7b4166ce000095fd79a3529a541_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2852

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 17.2MB
        • SHA256 0bca59b20039b240efd8ea85429eb4548464d2d1b087afd1d3f8b2aed040a515
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 34.6MB
        • SHA256 89ff8da50aeb55ecc24499dea95546ae38a066479e04cf41daaa7a01b6ebf2b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 57.8MB
        • SHA256 c2c7823f0b64c4f406843b0f4fea9b439f8b359413e2f13faa2682e6a030ab49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 19.3MB
        • SHA256 6bc347dbda125bbbffce70ad6ecf422ab223064b90b1003d3fb91ea184774d11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 34.4MB
        • SHA256 99f78fed54caae568abcd18bd7d8c8433c4bc37bf849f44b64754ab192fbe832
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ConvertToCompare.exe
        • Path C:\Program Files\ConvertToCompare.exe
        • Size 35.1MB
        • SHA256 ce8a9b32728a771e6870d1f61d1af151b2fb761de50be57e86fed797218806fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 40.3MB
        • SHA256 5b3b6ba9cbd243a11672a18b64973b7f1016f792bc0dcda9fe4ba9c880a9c3c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 37.7MB
        • SHA256 3bdf973b12cbb521db761ff2db19af7025201e3e5cdeb9dcc633c7a055244341
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 35.9MB
        • SHA256 57bf575473f54690fe165d323246d53465798542fc84a1e9696d90a624036ac4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 34.3MB
        • SHA256 735feea8da23fa12a65bae193d57f4193ecaac9dd8cf2f3c1e65d331111fe71a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 34.3MB
        • SHA256 fcbb69f2968efc9d0da15138becb136ea03fa16ce1f63b45fdfb72f8169b6720
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 34.3MB
        • SHA256 45c3db6ba6e693c344676cdd49bb8813f8c5b36d5707fbd15250fd64513e5600
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 34.3MB
        • SHA256 6fe7c95c8a4ce067a9af3e0a25fbeb8f8e47110a605e9235f7147435b8d7e314
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 34.4MB
        • SHA256 251535ff8b53e2b997c4bfd54499adbe068bbdd34353d59f31c7fa9af18a741b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 34.3MB
        • SHA256 73f1ad3ab1a68d02e2ac1158302b97242600e0d36e4aad9a25ccfb6194ac3f2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 34.3MB
        • SHA256 454373846d79a4689548e86d639e6492fff98511d88e9eb9da169c6b91128a70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 34.4MB
        • SHA256 85214000be41033495f2f23efcbdeebd88f04a6120b17804820a85d16a741df9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 34.6MB
        • SHA256 9583210aefa0f5068e958c7e8862a5250a16081534f6c3848750ab21396495c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 17.6MB
        • SHA256 7862ec308f78e736e463aa206297082c432b4588b10f1aa5b673374d08a609c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 34.3MB
        • SHA256 d13119f6d8038696f5ac5d8f987c383a77acb9c41a00e80f39023d3cce3021d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 34.3MB
        • SHA256 56529f7ec845d9c42f689e6855222734106b240df12f57a0b4ee5f30528455d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 34.3MB
        • SHA256 32d7456cbf5f2667a18e130e353a623e42e8312c007f0a67a6a7036be421d0ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 34.3MB
        • SHA256 2733a6009763d182d9cac9df11cd3286d9db478fb0d3867f8e69aa75229eb09b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 34.3MB
        • SHA256 83ec9167d2e1ea909f0e326dd70109a3845d6834287a347ba6c86797702ddcb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 34.3MB
        • SHA256 edb058daaa2bb1169021eb4d428776356dda5d4f3cd1a012cfd3bd587b786c3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 34.3MB
        • SHA256 1b929dd080b3e06ed5c6c2e72818f73dc2bb8149af0f59d3540fe10aaf105950
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 34.3MB
        • SHA256 c5f997ce76dada1f379e55861a97e68c85f1183c88adf4783328cf89b4629ccb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 34.3MB
        • SHA256 8acedbfcda8b7085ee7dd921bf3d49b7adca41f49afe1dc7b5b3a265618f65e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 34.3MB
        • SHA256 16f2a3f4314603b07adcf4616d94b0811dce69199af70e478ab24bf0fb5f8e17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 34.3MB
        • SHA256 2e4685923def4ca4e8ea8a7e7d28c1e02cd744446c13bf9597bdea58c95bf7b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 34.3MB
        • SHA256 9c6299d3e6e55e734c615a6f16719c0520e8d70cd986554d2535b2cf9b2838fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 34.3MB
        • SHA256 4f6b2a25d8c08d5115ba9ae3225b2a2bbf92c1738a99a7a2f3c815f299c0bec1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 34.3MB
        • SHA256 14186f85e1a94539dfb0d6fa99fa572286756c7e93983aa3d58a9f8175ac7817
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 34.3MB
        • SHA256 795184622ba32f6df64412ac4c043c06ab916e057727a6c8656112e42bc7c93e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 34.3MB
        • SHA256 30951c53a6360ccee77cb26fee7eb4b7d0fa890a38d0462caba950a95c518b03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 34.3MB
        • SHA256 efdfaff98e1ece6350d205d508ad76a87ebb2bf45953ae950e8f6e47c2f2390f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 34.3MB
        • SHA256 f13ac28ab392ada4c58ae63b77f353dd99452aa9f6bae4569bedb469a2ec67df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 34.3MB
        • SHA256 dfe37d2bbf3f593c482d03387f23433f2feb819bddeeb9b8c1fb047bebed0d58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 34.3MB
        • SHA256 d8157f7aa7223b23ae85b3b715baf476230badd460789001f503cb3eae0a4a8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 34.3MB
        • SHA256 293c9aedacc4e9868812799eb2234c8c23202d5173e375475968026bbe9eb638
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 34.3MB
        • SHA256 a3f128e470007207fa4c2d58de696cb706f8254f7fcf42ec2bcc7d655ae7a579
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 34.3MB
        • SHA256 df13ac237eb8ff96a7ecfd14e2a3ea425548310cdae3fbc61bf7a26db482091a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 34.3MB
        • SHA256 c739e3fa08986e0b72ea3d730d8a1cba642ae21a063d4e38f404c6d790ecb304
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 34.3MB
        • SHA256 4d03116b3f97981a4cfc8a09186b6930e7c191d5c0a58d6daba0d14b6e254093
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 34.3MB
        • SHA256 a7aa30e4c981f86476667a319d59c1ed27af7b6e241699b3cee5aa06bf836e1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 34.3MB
        • SHA256 aaadedce2e6df602c322d267a250939c6eed1d805e355dc7226ff9018f529117
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 34.3MB
        • SHA256 27cb2420594ca6473bd5fe81935b13b5691e573ecef689d1e389dd0d0af4f0ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 34.5MB
        • SHA256 70989fdd25879aa8d77a80f106fe4a3f410bea7c81eeddcde29b03239d229d7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 34.4MB
        • SHA256 8d2682762fb33e1e938ae4aaa5b123b40dd8d68d15e9393e50ad7b058254245a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 34.3MB
        • SHA256 9839578cae1331ee7ead875c11161fba0fd35c011283fadb77656ffd9b3d5db5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 34.4MB
        • SHA256 b29dd0cec92e3306c088b983e597ea4686fec0b9f6ccdf2924b0e2bb6cbbd525
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 34.3MB
        • SHA256 4f8f3f2516102506ea46af6b41a82f5d6a4bd5ee058a8ec4df974ac2b0ee085e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download