Overview

overview

8

Static

static

3

2026-08-20...kl.exe

windows10-2004-x64

8

2026-08-20...kl.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    21/08/2026, 02:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-20_fc3fb7bd45a662eb2da9a1b3c4c2beb6_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
  • Size 8.9MB
  • Sample260821-ckad5seq4y
  • SHA256 15aafad388dab56325a62eab55182dc6768fb291292cce3840773d5c49fea3a4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_fc3fb7bd45a662eb2da9a1b3c4c2beb6_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_fc3fb7bd45a662eb2da9a1b3c4c2beb6_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1296
  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_fc3fb7bd45a662eb2da9a1b3c4c2beb6_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-20_fc3fb7bd45a662eb2da9a1b3c4c2beb6_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5888

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 9.6MB
        • SHA256 2cf0753324f7d4787f476f228ecf8b04196d1fb12c8cee313d9c657e80a5c429
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 8.9MB
        • SHA256 08d53f981e9e692c62076975c038b5e4a0373abfe162f7361ef1ea243ce7c7e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 18.0MB
        • SHA256 a824da4f7fa0d8a8b660371492f0afd597d18a23f3f7cc1096ef282e598b3dc1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 17.8MB
        • SHA256 74b067d55d65f1b1e51b314131c2da75bc08f2cd15df0fcde9d5b3e252b4b3f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 18.1MB
        • SHA256 eaf4115b4bf94b5086c05210d75b4053da58c914eac0f42f93e0146773a2466f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 41.2MB
        • SHA256 941abecb0dbdcf4e0d5746736f197faabe25a8b2f4083b8db91467db54ea39b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 19.9MB
        • SHA256 32569cec6a986a6e22d4dc1887a83d28dbca2110030b8e10b8200213e54f4823
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 17.8MB
        • SHA256 41230d68eaf403ef5d4a85bc9582fec2352801f31927868e72daafb7ac1d9a09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 23.8MB
        • SHA256 b36983601fb5cb8a0770a1fdef0ab02e629c26d1de55b0d71eb4d06873265fba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 10.6MB
        • SHA256 734725df9d1b96d4ebf2371346b75b324a82765bd02eaf5063faf7a12f02d3b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 21.2MB
        • SHA256 68a17f8999b5de8349b3ea2954915976201115123ab9505164d46f100b1a9b61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 20.0MB
        • SHA256 71e738db00eefff89974a6045968c7bf1bbbe70932c223d03acfe025e68d4f4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 19.4MB
        • SHA256 4ba42d1b943e1908f883c4f06a4f98404d3d5c4dc563fd0e5d0589fd530b0607
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 19.6MB
        • SHA256 f1b018c8d6b60bf08a8e1faef0c574c85b4433e3a62cf1d76385387c6ab4a410
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 20.8MB
        • SHA256 cf804b2baedcc0876b4aab3eabb9994f32bb00ec2d9b852d0a85a68683234728
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 19.2MB
        • SHA256 4104511a6c611ad14c59cf0c0c78fd33e74d363fd0a391b734d91a552e618cc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 17.8MB
        • SHA256 97be7edce7bd0a738e752c0b3a9eb488d645fba708b2eb30b4bd829010ed3701
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 17.8MB
        • SHA256 c17d38b2646db81e154b40195134a7c75ab809c3c33f2efff6f32b08e7c433ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 17.8MB
        • SHA256 8744d08f440298d4ab220a88a05657a2c6563b208ffb851c92be93a0dc41c881
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 17.8MB
        • SHA256 5f63a4fe130e5c06a16af003c512cc0ff975c15193b755b08fde5f4206692f5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 17.8MB
        • SHA256 dec2da8e9578f1ea0009025e902bb12149d514e3df3a2b97eef02db358f201fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 18.0MB
        • SHA256 9de257d2f990468a8ca8a9677a0eee6936713b3d36be0041c41318a1f8a87abe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 17.8MB
        • SHA256 414ac100de5294588e917f2ba57b0a4276a43f8b91a0cc76d2388626a2de6f11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 17.8MB
        • SHA256 ef478a5a3889286e0a95ec1d22eea737ad0fc7c34a2a4e3b2d21d152e444cf57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 17.9MB
        • SHA256 773b913d40710f8c4a4e67328afc0f9617bf333ef8ac37d8972e2054f5b9f4db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 17.8MB
        • SHA256 d426433c11b7b32f3069ce5ba121687d4d2474d6e9e679254d0acb9680219ca2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 17.8MB
        • SHA256 0922c0c97e2f92f862b69ff086be4e58e948a1b53af07ac330919faed0b5fc59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 17.9MB
        • SHA256 f40d59e8afec03e4a814e11484bffcde0110ec818cb9311225fcda8049e27401
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 18.0MB
        • SHA256 f762572adbf22ef8d61d1b08518d2df0bf3f5d88f193fce11e2a05426626b8c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 17.8MB
        • SHA256 c97f28dde576ece5c522f67aa5b125f5801745e87fb3d883fc771ed07672cb22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 17.8MB
        • SHA256 9e0dd1613201a9350e5b5c11c129dcc7696cbb585264a44290ad3c24fb42e4c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 17.8MB
        • SHA256 cf914a7371563a072a7a19664713b84c68455505fdd1ae154e6ab187d20c19bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 17.8MB
        • SHA256 e3eb2696286c397e9fc38257743ba12c681c354722fc852c32b35bdd974543d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 17.8MB
        • SHA256 0127ccd946ce002c53938dbd5dfed2737acd6993ebf746ee64225b4efe028326
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 17.8MB
        • SHA256 cfc1979e64f2356b9e671a8341b1fac1a4f5250c780a4b220f05e84c764f8341
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 17.8MB
        • SHA256 5a70528633a87dbc79c6efa63cdefd0064e710b6f677a990d2b41da41a0ab555
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 17.8MB
        • SHA256 bed99e0b4be6182e1f8d0454dc1e9c0b59e6dd4ea649387b5490188f9e002fd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 17.8MB
        • SHA256 d858e89b72bdfb89861967b76631a22473cc5b35705f19f29344afd6801fb457
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 17.8MB
        • SHA256 dbdb979012514d37f3fa85fd89289cf74503f103d086e7415691421a0e48d84a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 17.8MB
        • SHA256 8f38756bda9340f01b986df3100c39bfca62d16e4f0a2c697e6de12ebf48367f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 17.8MB
        • SHA256 0cddbfbb36806cd348bb160d8fbde45df86c45c83e6243f0cf9d985e8d771811
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 17.8MB
        • SHA256 8e0ddfaadb826bb288f18afa4fc5f22ef28bcc6e56dc0c0d58280aebcd31161c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 17.8MB
        • SHA256 bf7d60374483120a5f470720897abda2721b723e9a9fd245ae713c9a53a24519
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 17.8MB
        • SHA256 54d2ef712f2ad7496412bd6310b1586d658e67fb4d7062fe93609963efa75457
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 17.8MB
        • SHA256 dccb21e5eeec6cb0c6a1302aa3e21270b856ed32f87e6d51b51b44b5a48cdd55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 17.8MB
        • SHA256 7a767943a5d3abdb072b03c8575414e7a3c9f8238ea7ac6531b89b57ca8183d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 17.8MB
        • SHA256 ad3a3e9ef528780cf517fed469f3b2804f328401ea6ba8a2eeb3d7228a82c291
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 17.8MB
        • SHA256 124aaab03a95f38b3e4c7426a2882e159b0ce5015abe03ffd58360c99edbcf32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 17.8MB
        • SHA256 d413c7aea32a15a4cc04ca0a5ffc4f3743aa4642d9e7fa1336f773729835da49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 17.8MB
        • SHA256 b7a238cc0c8c0d23eec780ea31597dafa02ea638f5c78cdb94a95fece9754181
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 17.8MB
        • SHA256 af1553290a16e0856bb31c4d2c446da22d9840e11af6e419f49d873ddc668be2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 17.8MB
        • SHA256 d8545d855e7cc03dee6235f9c348569f0d25a54869352b9d86adb65f7e9ffdab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 17.8MB
        • SHA256 23b30d45cc0e4e193f2a74566e118b8230896d19899112faac4eed569c99ad36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 17.8MB
        • SHA256 0f4275b00cc804e2208763071bb59567ef6d613909b0625ec5ea8abceecc1d2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 17.8MB
        • SHA256 22f575f5a6b3c7de9d9cbfe65f48efd719b0c57b35bf67e31ee888527e9462ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 17.9MB
        • SHA256 11b9eb11daefcd9e7ad84aadedc85658635e8b3ef1d56bec48d6d3b5a04f17ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 17.8MB
        • SHA256 ebd2aebd41964b600f8bf0bd1c5d5f2ee4849c35c55542ebe7ca1db77b9fbd99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 17.8MB
        • SHA256 9d8d73488d82e395319b87c465d03e7c251b2b3049b4f7a9cfd65c4d23e4a7c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 8.9MB
        • SHA256 23a395d3c2b9d03b53eeeb625eefa3e87c54c144b6d61e3c77f9232dab3ad18e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1296-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/1296-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5888-16-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download