Overview

overview

8

Static

static

3

2026-08-20...kl.exe

windows10-2004-x64

8

2026-08-20...kl.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    129s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/08/2026, 05:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-20_f8ff656d6a2d8bf4658d77db34aa124f_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
  • Size 16.3MB
  • Sample260820-fps9labd93
  • SHA256 8fe061a723b3687c16a0b13a9f04b09e95df4d5a8c45659469a4c82af8328759
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f8ff656d6a2d8bf4658d77db34aa124f_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_f8ff656d6a2d8bf4658d77db34aa124f_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5412
  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_f8ff656d6a2d8bf4658d77db34aa124f_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-20_f8ff656d6a2d8bf4658d77db34aa124f_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4548

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 16.4MB
        • SHA256 d61e0832f113ca46fc064d3f33ad8db949b9daaf05b1b5d7405d4ddcb9213020
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 36.8MB
        • SHA256 8916fe03f6e19911a41516fe0f1be47ee44146b6ea0a988c1afa3dcaad2fcad3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 16.7MB
        • SHA256 7b82ab80d5973dddbfdbd1135e9107d2083fc7828e3e1d8241f146dbeee1908b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 39.8MB
        • SHA256 d0c56d973f0094edd0d6f3c8a4fd3636fcb4bae54010727f2deab9f86a4a5b0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 18.5MB
        • SHA256 9814c3eaa4d2ac6edc8262e52bac470821e26f337041fc5d7c711dd88725eb94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 32.8MB
        • SHA256 b521d6d866c70c45438fa16840e92eb580abe059be02e5a3eb1b68ec3d28b421
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 22.4MB
        • SHA256 ecc3e39d96599372ea2e04a6fd03b9b387343793a2b44f78d39cb43a8696d56a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 34.4MB
        • SHA256 82d9b6e973867ddedcbaf8dbff69fa7f9ceaf505fe54f37a2ab72051089e6aaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 36.1MB
        • SHA256 7c504fdeb29d1b3aba06a74996ba84cc20364ac9b5e3f940acb9801842d43546
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 18.2MB
        • SHA256 fbfaab0ca0a90c45cb45f774bedd8b3a483717f41ed4a9b0b169c5e702b7bf4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 16.3MB
        • SHA256 8fe061a723b3687c16a0b13a9f04b09e95df4d5a8c45659469a4c82af8328759
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 17.8MB
        • SHA256 235cbb160748caad3ea9c690e3c7b6bc68a4296b17f6eec5890f7f8c57b68851
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 32.7MB
        • SHA256 19fbe231dd51bbb8eacb25fdc99325054d96087a86ae93c2ae72edaa24ee41ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 32.7MB
        • SHA256 d04f51f93c2a096471b526af759ca2b5b86becb01d2dda58496585b70fc6c352
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 32.7MB
        • SHA256 9b43a6c735e5e62d6e3bc8958954dae7dbf8d6cd6fadcbd6872de45a237ad99a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 32.7MB
        • SHA256 dd401514e674856595306f92b213a8f02f0b3cca7233fdba89c8f56a23176e32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 32.7MB
        • SHA256 8f26884e8c7249cdc5a16ef968e9001485d4ee0d2fe9bd1aefe131d6911becf2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 32.7MB
        • SHA256 c37a47f80bf0edc4a47d76c5e677e3610f8485bafc6948c76b9a56df44d0a43c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 33.0MB
        • SHA256 0bdce3a04eaa99727ffc243e2ce25cf582ee6999ad8434c550d2b9f4e3af0791
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 32.7MB
        • SHA256 1e020b64f2259f29187dd555593c397179507ace3e2c4dfa3fa67efa81169a2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 32.7MB
        • SHA256 99b35df0aeb17ce9192d3c6d7aa9e84795e4ec7e2f64eab8baa3fcd447cf8c70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 32.8MB
        • SHA256 031f04ec19c9d4a551487f8f4c13e30e1cf718ea06f1598b3757e45d702281fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 32.7MB
        • SHA256 8b993ad2f7cd940826c82955adefeaa2c14995d2491c61e8c3dae192b7fdd962
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 32.7MB
        • SHA256 9361acfda64c26e94afbdaaa89c88299cf979b43ad47931f6e047e0dc7bb9105
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 32.8MB
        • SHA256 107bb0a2d6ee507c1ff1276bbbe539398d4a266617a82ff0d8aecf3a4621213a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 33.0MB
        • SHA256 9d69034da5acd2c372a3e45c443ecfd6e91ed161022d8677c9f26dbc639aee5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 33.1MB
        • SHA256 b990c3a987f600f0fbd57505be1d2458472b904568cc799ac21a43a738a8b3ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 128KB
        • SHA256 018b597827351ef5fba9c0e1d321cfa9b45d887ff0f8d5607452eb75d8626cb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 32.7MB
        • SHA256 f9852403eff3801f3e2505a02ece0761bce2da7e59df9f711f78b8f9461b5cd8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 32.7MB
        • SHA256 f054f14248c4efe6a499826cd3ba5fb9bbcebb2df026402fc9b1ddc6ca88095e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 32.7MB
        • SHA256 6ff77195dee7e15303d706765bef851a67505b0cda3abc6698ab17e379658186
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 32.7MB
        • SHA256 d9151d43d1d5b097cbff671d12d2729a9704c93fca34f1bcc9fd7899fdbd9cda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 32.7MB
        • SHA256 0e797336172edfed5287127f3aacef6acacb686843fa898a98f6e440ffba2043
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 32.7MB
        • SHA256 519071cd79d28e6abc7012a961c7406bdd2ede77648b96e62e4372186b8995ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 32.7MB
        • SHA256 ac09cc069924a4d797ae010db78bdc6db9b0b1fc086936e9f0a9747be75ce04d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 32.7MB
        • SHA256 46c6c4c65dc113aae53f39afa1c0dc9693b91d90158ac01ddae075a5e063a055
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 32.7MB
        • SHA256 5e7be391d7c8c61dcd4c744e9c39f58f549ad804e30a0a41146ed197a2cc0bd6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 32.7MB
        • SHA256 7f58d7cdaa510b0856cb221ee7de6f3839814a0673096070a4e8953c6afd5235
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 32.7MB
        • SHA256 0b5675af133a3adebb9b2af31beb51b7c9089f5ac2a75e187f1416df96d61486
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 32.7MB
        • SHA256 865869a67c94a18e6e031ef66f250e94c356d859fb5a7ab84d6c7b544b554ab4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 32.7MB
        • SHA256 56c8c724f540573353a5f04cd18b9b1df5736059281c49739619c7b3a391b93c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 32.7MB
        • SHA256 e11aa9ce77192d523500243385ba15cf20a95e78b5a927899f822dfdb1d8a5a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 32.7MB
        • SHA256 1aebe21a477b297b5b9e995cd587416fad5b3da1ec94672f161a032e76e5b729
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 32.7MB
        • SHA256 9b2f37ef8e9e496ad79e842d55745591c0bc48098be60730362213af8778dd6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 32.7MB
        • SHA256 7bbaad93e8abf57b651e2768e24b05d350654ca78fdddb5fd97326092f8ffcea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 32.7MB
        • SHA256 a02bc0eb9fff60b0f76ec2fe2666a1d26ce8f8c8e1586352af668b6acbcc1cc8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 32.7MB
        • SHA256 4c45771fb7df3312a137bac565a01711bf25c46ab6086a48941e0ff4e7d1472e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 32.7MB
        • SHA256 735ccd1fb463393b445b8780ee42e42b547b9b13d3e89c39d392dcbf717a0e4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 32.7MB
        • SHA256 5c85bb11c31819954866d24bbbe357dfe3320395019819fc78a18d9f5377bc55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 32.7MB
        • SHA256 388642656fa241d1e94845d120b5c1fe7d5f26e8e2c7c0716e8c2026e53cb5f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 32.7MB
        • SHA256 937453cd3d1a7e83b608916040e7c2f81cdc31c943270e222d052a5c9f13bb89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 32.7MB
        • SHA256 55ce7d758863dedde42e43fa807bb36b65edd94f13ba8a6cf35ff462c69b25f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 32.7MB
        • SHA256 cf2c4167797c9a09933f70bdcd791b39bc8fa53835ce87da2ff77e30da59d98c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 32.7MB
        • SHA256 0554fc15b8f91c7fcb69a2e9723046cf2b8fe7575c38631d09db3eb17578e2cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 32.7MB
        • SHA256 89974bf0a28735886138b291e3b0bb10b1c9d9d793cf1c75e4395cb5113c09bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 32.9MB
        • SHA256 7357c9a1af0ff0e7535db1809474fe81552acbfecb1bd6e8fe52beddc6ab5888
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 32.8MB
        • SHA256 e29a72c45fc4c7aa38d97f367be3398488a53ba50071688c477537c00b1e4007
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 32.7MB
        • SHA256 dbdd7f6fedbd92c5180c046a14b722f4b61b7244170aadd62a1f6c6ece72a950
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4548-10-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5412-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5412-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download