Overview

overview

8

Static

static

3

2026-08-21...kl.exe

windows10-2004-x64

8

2026-08-21...kl.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    23s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    21/08/2026, 04:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-21_472d03c138ec07cb08f988ec8de75eee_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
  • Size 24.7MB
  • Sample260821-e9papshf65
  • SHA256 ba67ff792ca50104786013476f3a1cdd72fab3a655678b18571c1d77dd0765a8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_472d03c138ec07cb08f988ec8de75eee_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-21_472d03c138ec07cb08f988ec8de75eee_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3228
  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_472d03c138ec07cb08f988ec8de75eee_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-21_472d03c138ec07cb08f988ec8de75eee_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2648

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 25.0MB
        • SHA256 cd52f1a61e4d15566ededf6add413be75ca4dc7af4cbecc55ba6a3175f9cc3f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 24.7MB
        • SHA256 ba67ff792ca50104786013476f3a1cdd72fab3a655678b18571c1d77dd0765a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 53.5MB
        • SHA256 0d1c470202db7aa34ffb8fe77ae72fd30df30c2be7120f07c358c4591b2f588a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 49.7MB
        • SHA256 86ac33bf383666dcc76aa4e23125c74f4b2548c59ef8caa76215170a21a94db7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 53.1MB
        • SHA256 5c556ab85b53fe04845565722fab70ccd065a1f5fe1c57099002a25a84fd6030
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 26.8MB
        • SHA256 dde9556488c91a81b996e10e946c559b45b2d0c4aff6a7de55a7526eaa8a72e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 49.5MB
        • SHA256 f48233bd3450fb75f55d2712251865fed5dc8bc3668ce48574a71abb37f62b38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 49.3MB
        • SHA256 7b37f973ac53d81c0f967d31791aebd9c1877845429b0c20a8e1edc0c8166930
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 43.2MB
        • SHA256 3b67b0f8d76ab277ad579f3b7ee04c5585c06a47f5b371d431aa349daae474db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 44.4MB
        • SHA256 d1ab389fe58782952db34f6b8b885a36b814d200da9e35ad11a2095fffdb7ded
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 46.3MB
        • SHA256 5d1e65a10d018d26d27e284f42385a9d412f6214f36a4faff671b21c14848bd7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 40.1MB
        • SHA256 28ae06b5fa229b874a93576cca437be49037bfffeaf8ffaaeb15d33efd95622d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 44.8MB
        • SHA256 47ef5392e014bad124ff0fb2cf1a487acd15005c3d86b8afe87c7ef1763acf2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 44.5MB
        • SHA256 3bcc0735d4dd8be30968e229bee147677061f21d4faecb8996699c65d55bbb5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 39.9MB
        • SHA256 163db99527360bf4b6da3a7d0809b46649badb3ffb33e0839225422fa579468a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 44.0MB
        • SHA256 e8ec0ce6584bf367afa40ccb7de896acd97d98b357efaf88c8b1f5b6cfbb189a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 39.8MB
        • SHA256 5e43481172d7a6538e04de60374ae4733c1c354f1e51b67685da47c3eff1e8cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 43.6MB
        • SHA256 241c6ea0f7629883e5b9ced7cf3cb5dbf5f52d937191f972573c3fdeda3b0d91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 43.2MB
        • SHA256 10b0e9b5a9d61202817a512714c69328a6b0b947019a6486b9630b6be8b268f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 41.9MB
        • SHA256 5fba4511cd0053a0f34497af488e9d8fdefb2b55e9bb80ba19a40ed4fac52068
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 40.9MB
        • SHA256 f63d764b40ef88b7af45744fdff5dddf90ec13a81bb4a52cf335b8424ee2533d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 32.6MB
        • SHA256 b2154474ce7941f12e38b9d377340efc621c817c929dec867cbede7e18701507
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 35.6MB
        • SHA256 a57c6fd7299275e99f222616d03e5d05148aeb75d5ab4a9c72128d39727d8948
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 39.1MB
        • SHA256 03545e296df443048f8bf29c02c51f67cc302fe3f12b8bfda07bf6dec7a18460
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 38.1MB
        • SHA256 d109e891141016d0c2b1264175b744add6a26b179bc4008b43edd4154cd929d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 37.9MB
        • SHA256 446de7363644c73bc200609b5660b4ebbf9ef4eb740191f37a47a0cfe29bef1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 37.6MB
        • SHA256 0da3de89a6d86af8abf136d8fa4b8079a29fa05ad9d2389e9b407dd48d41b546
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 37.4MB
        • SHA256 a6413dda338398b44d65e27771485c097eca29786cb7bca0da521811e0b9bb45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 37.1MB
        • SHA256 5e9bafbae0ce61e2b0c42e7a67309a256eee4f52f0f2c7b8e654c24340d6fd9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 33.1MB
        • SHA256 5b42f800900f3e712d5fcc86f92556b0e939aa27a79af6f244d06321f43c61ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 36.9MB
        • SHA256 d4fdca4becfcc05615fe87a7f86f30b70c402fcc74b722270c36d425542ec2c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 32.9MB
        • SHA256 023821d5e57b31af1d935c4d07f37a7e82071ebbcf1e3c9261466e3ab83a7b07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 32.9MB
        • SHA256 c73d57a197cce32b216f18a315ee685bcf675d3a2156c8d89201370706485f4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 36.6MB
        • SHA256 2459d544cc238cc5c00a9ac07835796483c52bc42ae8a4ad8b8c8b3caa362a88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 28.6MB
        • SHA256 a76e7db0b596dad474a0c16e7fc318ae6c91a3d780417c717d181af909d366dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 32.4MB
        • SHA256 5ec5b9e87fbfdca42947e9ca9d56d57adc5def08691e84cfe548c40b0cad5470
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 36.2MB
        • SHA256 52a2e982d2fc3ee6d991a7cbda89274681a7aaa9b69f1acc357a8a83ebade572
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 36.1MB
        • SHA256 2451f5369625615252c805d2b7b4b052d1cec7664739d7d58c8cdd6c69d84d0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 30.8MB
        • SHA256 efdd689a23bd566facb16fad9d60e3057bae0b6c08b902f2b8b0888e94ce6a0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 35.8MB
        • SHA256 a79adf307f5d624d41c3aa38721eaecfdede243ba7eac62416f45533d61e13ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 35.4MB
        • SHA256 1e211e207f2f54201d98d06c9a42da4b3730ee623a419bc64b2a19666ae4d9f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 27.8MB
        • SHA256 87c591fe17f251a6e45f499a2615e91463ac102597523806d5b0a234bccd4a82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 31.6MB
        • SHA256 e1395cd09437528929375baad434bfbfe2481f878330b22d6d0843ed4ad01c29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 35.2MB
        • SHA256 15d651ef29f58673f9c5aa5fc3c76fe9e5d239cfa7b6fe07ce927b73a47ed04b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 34.4MB
        • SHA256 6b97f9ca5f6c4ab939516ff845934e35e5dcc4f28937b0284f3050775b08947d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 31.5MB
        • SHA256 fd6ecbcef5ac557fdf57cc9d56430083b5941bd50557adc89c3785b352059f8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 35.8MB
        • SHA256 f51ce10c7aa7f64cf69e8234e5f57ccbcde443c5a4a0cfb82bf72aedd9712222
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 35.2MB
        • SHA256 962a0ac1fa14272c84c3f2367e92dc2c1335a75120055f3ea34e77485a12fcfd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 31.4MB
        • SHA256 47d70aabc6a387f8367c838a9f80dfc9b4e0ff21bd28903f2ab8f0c112bdec40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 49.5MB
        • SHA256 d7a97347ee0ee5fabf742e5496f304b64463e6a34b69e490a5d480bb82215372
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 49.4MB
        • SHA256 332edfdec3d38b1296e9d814b779108fad483d38cb8dd3fdfe636d9890701662
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 49.4MB
        • SHA256 b52123a39c1fa1c7c7277e3a1754d143f934e20fa81009acfdbd88495017c14f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 49.4MB
        • SHA256 b3c97057346c8ac2a45355c3108935500ee03fb4fafe377f880341c2ce40c464
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2648-27-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3228-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3228-9-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download