Overview

overview

8

Static

static

3

2026-08-20...kl.exe

windows10-2004-x64

8

2026-08-20...kl.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    135s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/08/2026, 07:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-20_09008b6fa0ac5d8b2ea3d13ef4260cf6_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
  • Size 13.1MB
  • Sample260820-h7gdvssbrd
  • SHA256 5f5fc1ba490ce9f22276452659de8da1dd38892189bf7b6fdaf9310128ff819c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_09008b6fa0ac5d8b2ea3d13ef4260cf6_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_09008b6fa0ac5d8b2ea3d13ef4260cf6_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4444
  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_09008b6fa0ac5d8b2ea3d13ef4260cf6_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-20_09008b6fa0ac5d8b2ea3d13ef4260cf6_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4588

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 13.7MB
        • SHA256 da754d628806a6dfd65cf6eb95e20b13b1bf333996bb2322f5933d63097c5538
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 14.1MB
        • SHA256 32f016eba77c2a181ca75c892bb8f38cd7221ee27fcdbdae9ac1b36d325e5873
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 13.8MB
        • SHA256 84fec7f98fd4ce87e15027e9a51d59cf689c032507f38a335f5dc1322ee5f847
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 26.3MB
        • SHA256 0378f2e60b25255f316f0ce920ab1145787513eb0044e349ea44254d2cbaed77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 26.5MB
        • SHA256 c06305a19fe6eb6911cacc4c70454bf419dce9a4f872f5584c36ae2a9e96f825
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 26.3MB
        • SHA256 129be99493a676bcc9781be5db29f2671f5416356d4246ace88560f5911d0f8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 49.7MB
        • SHA256 d8fe975eb59e37737f7a58dcea0d4778a5b581cb957d29b4f7e61a542f81a7a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 28.4MB
        • SHA256 1a27ca11244f57462ae77b19ced370fd575205ddfc941342842f942f93bd0a4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 26.4MB
        • SHA256 048bf4ba9ab027dae6c78002936331e5f06791bb351a8475d95a13cf2e694078
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 32.3MB
        • SHA256 7ff92460be3223e9d9f15b3f6656d0af2974976ae5a6edae5468e090be3f8936
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 28.0MB
        • SHA256 9a50a7ea4f40c295f344fd1ad07df8c0497d019b3bd077eb169a66f1b2cdd58e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 29.7MB
        • SHA256 6b401740f0f6608ed953b1e73b06741f8ee7f4ddb30c6e8ebbef786f9a2465cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 832KB
        • SHA256 07da77090e278b391144f4f668a395428fa111e9096698f6837b15bf62791b6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 27.9MB
        • SHA256 3783753a388257a63279145d7f53a2685cf9f1c1db72511246a6f9f1dfb9762d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 28.1MB
        • SHA256 1d5c012636f44c8ab113c6afa1e9684399746bafadbfafcf1f8d35bd758b279a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 29.3MB
        • SHA256 1a3a1aedec01e471830bbe7935a08ada7ce16c9cbee8b5c1574ffd3a15e7a2f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 14.5MB
        • SHA256 822434e0f19bda97641437f6bdf1c77610aa6eaa27635dcc3fc4a709a6ddd8fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 26.3MB
        • SHA256 efffc44b1ba267e652f06032c658fa712e9923058ff81304490a83c03f3bace0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 26.3MB
        • SHA256 ec98fcad12bcbebc02780790e582c6142274aa6207eaa6554b1f19ac749030b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 26.3MB
        • SHA256 856afc36623005f84efe90ce7f53f9fda4700d5ab81dbf5961ddfcccc68e86cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 26.3MB
        • SHA256 d7bcde3bc90b580b1809d099759bc05dbdac9151d66a605d31dec42d77445330
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 26.3MB
        • SHA256 373c7a68cbe5f33741cd246811e3516e464a2e14c69fa2cf8559bcc5d6caf3cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 26.3MB
        • SHA256 37c647714fd58e74c17a1e6b7758a80548fa910d52c91af1ba2d8400d78fe8b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 192KB
        • SHA256 cc71df767f30aa32b4d730d3c0244896e3d45eb216f18568c46371d93640cac9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 26.5MB
        • SHA256 034b6fc77f9e74439ffae029668c923b065e6933878dc2c91e3c4f4bcc5ace6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 26.3MB
        • SHA256 c1ff333bc2ab220c7fe79f9f1aad07a64fb65b2441c6e1cf6c5ef651db08adc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 26.4MB
        • SHA256 317480246e829e890024300b7227b7339231cd16a9c0ab552286e8121a51af35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 26.3MB
        • SHA256 968d4d78767cfb288642d126bec2978b6b54593af86e6e93693f76d6d80748e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 26.4MB
        • SHA256 23895daea9a0e2c8f93844f0acca78fb052407f8472a64d6e2089aceee91ddd8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 26.5MB
        • SHA256 b8eee62bdbdc9d7062ec9c879ab452d9972c1aa95acf6521b445bcc979ac6485
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 576KB
        • SHA256 f3bd2dab7382b72175192fb3e9f89598203ba5c57a724633b594102fdf17e510
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 26.3MB
        • SHA256 1db54c3e43460d6ab60b282698a88d3f9a4e7d00b68a7699841ec4ea2f019eb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 26.3MB
        • SHA256 2c56c6cf6a1f7335648fe53b6ac2b2bf192f498d7f5d6f2a410a189f6cfe61ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 26.3MB
        • SHA256 f60e5da0452ac54e91549266e0724306a2c7574f8a3a9b7d37796d339c23d798
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 26.3MB
        • SHA256 417b3f457b34db9637b484a610c56363aa72483a824dcc77937b1ea97a7c7335
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 26.3MB
        • SHA256 d91b929f01bcf6365c5e83d22d72d2780b4e597490fb4c0a351df9fcf3d5474f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 26.3MB
        • SHA256 6e2820b13e82311712d39ea43e5d25eba32d799a8c1e6ec657dbbb12877c6afe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 26.3MB
        • SHA256 60b86d20f0db378d35459746fc76e13269b88304f8cb40c2c22642b5c0a37bc4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 26.3MB
        • SHA256 5b0123a3cb8fd9c0bcfc824b4d7736a827cf469bfa08c4ffc5e391abd62abe7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 26.3MB
        • SHA256 8e24078feb0acb311fc4c3d49910ce01adcf8e10bce6a2e9522ee6328c59abde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 26.3MB
        • SHA256 f1b4e06dac7697ebf9577bd2bb2521aaab9ba0d4c23defab4ab9b00f05e6b582
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 26.3MB
        • SHA256 c5a5be2c15092013c507bc8971048c60befa71c4c936beaecbd42aa3e0a3cb2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 26.3MB
        • SHA256 5b5f50f0c5a62edda5c160eea1b3aa889047006887eccef1ad06fc42f08c88a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 26.3MB
        • SHA256 630e045d92dd41070b42fcebd6803ee2a91e391167cf4dbd3e27b7379885a6ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 26.3MB
        • SHA256 4dbe51193c74004262296af699f1cd297c1c3ad39df1c15d2719cc9dbae5ec6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 26.3MB
        • SHA256 f352f1df03df8d78ad39325c45498a25c893303dd12291065e5694706c44dc86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 26.3MB
        • SHA256 eb94dd62d4be17a693852a268026f5fdcae6d74d0cad86c95972e8101265a9dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 26.3MB
        • SHA256 d9bc5ba46bc26aa203b451cb3448533cea52758b7bc333afb2659a486fd80b82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 26.3MB
        • SHA256 8cd321b8ce2b26170c60461c39d9d61d581ff366ee3505bcf40f083e2d69a0ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 26.3MB
        • SHA256 a52b06ab61cd17765ff6f0fd30bda217b520d31f8b4ed8ac721d790cc51c633c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 26.4MB
        • SHA256 3750091e785add18d4306936a604c57346005c56333475c30e780a526121afd8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 26.3MB
        • SHA256 4e234917ab5122aa81892f92c2aac0c90fc6004d1f971973672366ba08e5a3d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 26.3MB
        • SHA256 a7003389a57699f845094e9623f9284fbb88a01f8318a21bea548198898b2fed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 26.3MB
        • SHA256 d3e746ca97fd42ad660fd00842a7d81b4a4dab96e714f89e29c8c64247739272
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4444-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4444-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4588-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download