Overview

overview

8

Static

static

3

2026-08-20...kl.exe

windows10-2004-x64

8

2026-08-20...kl.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    50s
  • max time network
    136s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/08/2026, 18:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-20_1bc36d6b46bdeeb787d1cab9eb3175b1_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
  • Size 18.8MB
  • Sample260820-wtevrsfa59
  • SHA256 b1651e17c8f6218c62fb7bca7b8bf78f3c727c3178894991e2c2d474db413386
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_1bc36d6b46bdeeb787d1cab9eb3175b1_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_1bc36d6b46bdeeb787d1cab9eb3175b1_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5428
  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_1bc36d6b46bdeeb787d1cab9eb3175b1_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-20_1bc36d6b46bdeeb787d1cab9eb3175b1_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2564

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 37.6MB
        • SHA256 7aa91b708dcb845e70d359edd707a4714c38a94b57141ee56ef56f02c01a71d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 41.7MB
        • SHA256 db53899fc0eaf685bbad108d34a2250e3791ef32723b45149f019f2a83c981b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 37.9MB
        • SHA256 c90672affd71c554b9d05c0a037152e907de6db112271a6e629669203ccd28b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 61.0MB
        • SHA256 59082f083b9f0c517b4d25638610f61f0ccf4902cbe4c50afeeeba4ce572a9f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 20.9MB
        • SHA256 f800c927ee2d23fcd89c9f4922f27d5ea6bf65a6cc07d6dc1fd991e132e76690
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 37.7MB
        • SHA256 ee2f12e6ea24a05b8be947bb8226a64ee6bdb6add3b9ba102f37c67c0a8534c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 43.3MB
        • SHA256 4ddb11e0b6f4c74b402fdd17420f08a09611cacfa3de9132f87c9c7b662ba6eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 40.8MB
        • SHA256 7b384f58e95bfd4bdbfb616d84b1c286c1a1f306603210063c456435aba82834
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 39.3MB
        • SHA256 fa1f35d9adeb4f9c26a114689daabfca0080fc9ef0606d95be9303506bb7190e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 38.2MB
        • SHA256 fa692d145d384672977d47b6b93f7949fb829a2b27e54354a62e962f08efac77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 39.8MB
        • SHA256 365d1d71ae14fb739946ecd659602ae6ad821c41bfcf63c05af532f2a64ab9e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 39.0MB
        • SHA256 48f28f8e9c775f1efac3e5b6e0e5ae4a0c1f00f4848b591395495530698b6d85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 38.6MB
        • SHA256 3b869051128fee41f44c3128e5a2b801fa9c5fa8132a120cfaebcc2fec9a8be0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 34.8MB
        • SHA256 ece7b8c2a3dce947902589aa8fe8b50ed5724bc08061adb432ba5386ec4341e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 38.2MB
        • SHA256 18961882ed9a89fcf9236f248defcc58e74ada5960e82c3a2d660d53e7c89258
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 36.8MB
        • SHA256 fbeb2395e512e890a1214bb0ba9b15f99e5be2f6ff6b14ee2fb398288a382a3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 36.5MB
        • SHA256 b2fd159064a3a1c0e84231d1eae8a9febd6a96b775f35fab4aa4bf92c4a6a1c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 32.6MB
        • SHA256 ced4805ae380d21f0ae9a01bc9763e7ef912e10b40d7778e85b7aea512b13405
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 35.8MB
        • SHA256 d24bf3460108b76b40df25d42c65ab88b1a3244e2d2d23e4021c311563d3521b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 35.9MB
        • SHA256 fb913cc305c8f234ddb15a038a719d67ec862523a9334f69e02e01094fbeac04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 35.1MB
        • SHA256 791576d38db9bed759e28fafe28cfd917609261720d485ac317ad2274870dea0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 34.4MB
        • SHA256 7d0df8d68659d6e8e6646993a84e46f36ac011b4c1de43075184c9e9658d2a7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 34.5MB
        • SHA256 29ac094f2377e3b2550af33b6d7ce7c8f637d079d7ded58224621f6b83a6d8fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 33.9MB
        • SHA256 90cfcce834e57d86636ab314435349f40fcefe9febdc2877e1efc949e42fe241
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 29.7MB
        • SHA256 614ba323cb972a5d7110de5ad475c75153795fa6273f858c0081457c231563bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 32.6MB
        • SHA256 e0d3c39e638a6cde75c372eb5d66ca91234502d5fe24183e848bb8d136074fd6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 32.1MB
        • SHA256 b85dc9b78bc0fa8ecb331741dda41b2412e073128e6f88e0c5dcc92a71b0852b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 31.9MB
        • SHA256 2a4f628c6f054dd5bd96659125dd19ee935eb76032e008d84ff431c7eeddd152
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 31.4MB
        • SHA256 27570893f8f5593dc7524e95e457d2d704e2fe8a4a89b52eb45e9b4318df99a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 30.6MB
        • SHA256 6735e3b246eed9348d05c328a34fd8cefaef717a43d68fabec9ada88e32d611b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 30.2MB
        • SHA256 6ccd69fe11d9f976c3e25977e6ca7e886203a38ed8a788e177c3dab37d87c9ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 30.1MB
        • SHA256 8e6694edd48b201338a1a1524db9732ac9cd1ecfc3fa85b2f124db3ae48ced82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 30.1MB
        • SHA256 8f03f4d4180e16162631604e65d8ef03c2af57e06778d7cd94024cee2173281d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 30.0MB
        • SHA256 4530578c6326269bf2c9cbe80d94341defcc4a71cd6d4ea315e280c29067d0db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 29.9MB
        • SHA256 f39886505fb623ff36c673db45e755587eb21ed324639e3b3a9c67b5821f9f1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 29.8MB
        • SHA256 c38c7b82b294bd270e2b5934e6c7b5d61a6b26aca3017887dcbddddbab59be4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 29.8MB
        • SHA256 4b2f868e5768697e64f58dfd6718b83969037513d6952591685d8a129e98c55e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 29.7MB
        • SHA256 d990ba024bc92262865810c6e37393ad36ca3f41a01f807944577065ced18e36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 29.6MB
        • SHA256 b8c0dee28302d334ef0aceac764e80b1c9a5c42edef1a2fa86120bdaf1df0e6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 29.5MB
        • SHA256 414fb1982ac454cd6203ae714c979a04d685830f4b59d07edf4b2daeafe52f79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 29.4MB
        • SHA256 a6e3ac75ff75f4c5d929ac3bb677aa9e45501ff2ac1f37859fe57c90e5b92239
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 29.4MB
        • SHA256 d7c92525b03b571dce6a674ac4306e0a16aceac648b562d7767de4202f82a295
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 29.3MB
        • SHA256 09298b26e63221a60ca01e5c6741f4953848bbac9707b3421ff0f0c39fc76ada
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 29.2MB
        • SHA256 763bff4d433cd0725b10ab6959f86f838833f2e9f27f9fe535f603edbf149b1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 28.9MB
        • SHA256 f12725d2f2e5350b573d0f108963ec5c0122036e05a8635ba9913f647693de93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 25.1MB
        • SHA256 de9d2d808f171c4346b19f166af73535a42794c8a1b07adca47d14641629343d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 28.6MB
        • SHA256 61cc3adeae6c1355ce789608bc7f66e76e9896753f5dc119aa48c02f04f36ef1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 28.6MB
        • SHA256 3829626ddf57c01a2e678d87fb2991872b093ce8138f9194a599a8cf0be0d07b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 37.7MB
        • SHA256 270e22a647a321145aad9fa1a739a05a7fd2b98e2914d15894248ae8139a06b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 37.6MB
        • SHA256 ff72c8a2769c4ec8b40f4f59cd11226cdd0416df3c70ab7b8a7c7837aeb7c3d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 37.6MB
        • SHA256 03b9d607a3dc771397b95ce266fa9c7e6a97301b7695e4a1c0b91667c8dd5609
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 37.6MB
        • SHA256 e31e6c0e06c147a72253f6590b7b747a14a95b091a1cb2424dc1eacdd02dedf8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download