Overview

overview

8

Static

static

3

2026-08-19...kl.exe

windows10-2004-x64

8

2026-08-19...kl.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    19/08/2026, 22:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-19_ba5a47fbef56d511699ded9c5ad2b05d_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
  • Size 30.8MB
  • Sample260819-12157avaph
  • SHA256 029d4ce6c15759909c98c97974b74fce71e4efee356889fe90e979f9ed160c40
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-19_ba5a47fbef56d511699ded9c5ad2b05d_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-19_ba5a47fbef56d511699ded9c5ad2b05d_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5032
  • C:\Users\Admin\AppData\Local\Temp\2026-08-19_ba5a47fbef56d511699ded9c5ad2b05d_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-19_ba5a47fbef56d511699ded9c5ad2b05d_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3536

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 31.5MB
        • SHA256 d6b9de879caba085091baf4d1b3a41a10bfc9cf2f260ff2d0f5ee51e54b90ddd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 34.9MB
        • SHA256 1181e2ae873a60c15c59c2c8050f0b3729fdf8ca2bbe6dcd62108067b67389f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 31.1MB
        • SHA256 a407d9f81b550b69c8dfd121d8d80d6565eba5870b8a3b6c859ba93ef0078ef2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 61.7MB
        • SHA256 7a39d57be50858f7df015ec7c2540c6365b787fc71c2abb7ae45f7d25f531402
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 67.6MB
        • SHA256 a7d219a73f4d4b06c75c2d22ebb40ffcd6187ed76a10ddd73b07e16bdaa9861b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 63.3MB
        • SHA256 e0606583b018391a0688e9fd46fec6b4c47579f0b5436e0b5ea9f5f02d4e38f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 65.0MB
        • SHA256 13142f9a3c114ba0dc1ddb8dd8f0cbae9f71b06343f5e867f12d29de0fe48f28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 63.8MB
        • SHA256 31ae1eb165b4253b3b7d09c1c92ac7886b372c0dec26cbaec1d41a126ec20724
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 63.2MB
        • SHA256 f7e2a0047583047e9d7298718615997c98d8343a38f78b8f96596c701827eb8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 63.4MB
        • SHA256 02c385c8cfb92a4ef01b514fa97c676f750e2b6c2e2492f82560ae6f8b021eb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 64.7MB
        • SHA256 8a2e053250827ad432b17559992a5426da90f12e4d82b43e865bfc282a58cdb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 61.6MB
        • SHA256 6614125e96000bffb16fade3a766dd47e238d6c1d6b915b114159707d764e551
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 61.6MB
        • SHA256 f830922bc7e4b619d0ed1c3e8ef88d7f856c8445d384b22acdc24e8cfe4ca8d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 61.6MB
        • SHA256 b3b4473bf258181ec425a437a5015e873ea564a1266c4b72de18f20da8a1e41f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 61.6MB
        • SHA256 0cf6f738fab89321deda5aac0ea2374e131e94c852ecc4a76c610c4547cd76eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 61.6MB
        • SHA256 bbd77fdb4da077bed741e2e8d180bfd5f73921ded1bbbe94c21e61575d99a771
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 61.9MB
        • SHA256 bfd3c42494f79e8222e58360cfaf75f6b51793c5ad2963dcd85109e660119d3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 61.6MB
        • SHA256 57e8040463b52bb0066a339e4e9aea2517935729de46a0d8c4e9626742a2e15f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 61.6MB
        • SHA256 79bc54c80467b03769eebd0728800c1a7d3c6449d89937d59e8c448755ecc596
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 61.7MB
        • SHA256 ba1b9266553dabe037135732a0718cf72fa382c3c0b615bbcc23d1a9b42db3d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 61.7MB
        • SHA256 462da0a614983dac7eda588c185ba43a3fc8b51406012397aadac6c89656f356
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 62.0MB
        • SHA256 014b2f7bd64b7f6ce4b6cc0a994657593a11b45d365031763a66d9d8fdf130c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 56.4MB
        • SHA256 7b79570a5a8868d23c0b978cd5cbf9d0dc1721299c11f23ab7e72cf5edfdf64b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 51.4MB
        • SHA256 a90ea03e995169343dbb9575704dc405a8d5e4b32d51c9319a93915ee2388ab6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 52.2MB
        • SHA256 4907a5929e9b5adb9d782fc18ac20c23fea8ee4e4564164ebfcc4c1eb2be1903
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 42.7MB
        • SHA256 f06ecb654fa3dc8894f79abc777fa4f42860806395474287b71c2facdf8e8970
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 22.8MB
        • SHA256 d0bc617f4bf642320f3b3e91c1248803640448330f1e5bd1f44e84aadb5ef5ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 15.5MB
        • SHA256 7048d51b3e10bad109ef72de2aba404e887df68c135f1bb0ee619137537f3395
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 10.3MB
        • SHA256 ef14cd23206ed2f7f1ea7e9e1b89ff6e29d3b49264bb23e6224db62ec99b0b55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 61.7MB
        • SHA256 f52f09e020f1bf8962a9c897b8c5be7b8f6caf710f991f66dcc2c1f127e86d9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 61.6MB
        • SHA256 011b9d7fa7aee0a5140ca48d6bbf074ead8fea81ec332314334752e299802b63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 61.6MB
        • SHA256 e0905fee89465238cbc56008a1cf6746c867a47941558eee51d1672fdbccaacb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 61.6MB
        • SHA256 759538eecf3c9625784a2712765b4fe7e91e94d902b8d08a4f4fa166421cf6e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 30.8MB
        • SHA256 029d4ce6c15759909c98c97974b74fce71e4efee356889fe90e979f9ed160c40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download