Overview

overview

8

Static

static

3

2026-08-21..._i.exe

windows10-2004-x64

8

2026-08-21..._i.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    147s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    21/08/2026, 03:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-21_bfe5688efdc7f44c55211062d27c259a_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_i.exe
  • Size 48.8MB
  • Sample260821-ejs6zahe67
  • SHA256 b2671a9aac4cbe90a1ade1087f92d6a0500138f4d7cb67d46dbdb3c446621c68
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_bfe5688efdc7f44c55211062d27c259a_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_i.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-21_bfe5688efdc7f44c55211062d27c259a_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_i.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4860
  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_bfe5688efdc7f44c55211062d27c259a_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_i.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-21_bfe5688efdc7f44c55211062d27c259a_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_i.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:816

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 49.5MB
        • SHA256 55e59310a94733383108663f2427d0a68ba42bfa54e3d57da8c0c9436d252d11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 97.6MB
        • SHA256 7c18e286e8a4a3a164a57819fb618cc5c25a3d444aba0bf3f8a7ed652058a962
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 97.6MB
        • SHA256 56aa64fcfbeddde3862b3d8a5d045b9ef47deb136681d3f1a13345f9eb98832e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 97.6MB
        • SHA256 b385939f4c96904f7e27b12571ddd18da0809467a9b74859b6e0fd42133b1f20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 97.7MB
        • SHA256 163679daae5379b75ae7ec001530dc157266ef2ee85834a9b594b15ec0833a11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 97.6MB
        • SHA256 55ecc8b13c4fcc8423c7e6c1a3c5b9cc961c8f718b65d7b8d169b87ff3e6f7c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 97.6MB
        • SHA256 90e2d6959ee3143522738389bfc0697c3dd79ea7f037e99fb05e4ec27a64504b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 97.6MB
        • SHA256 fd702b099613474a6c329100853ddb738ba35ebb2a306e5c0ea4d7d5e5ebe2b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 97.9MB
        • SHA256 c12018ce577256cf43869a33efa299f80ed760a6270c2958051e034d74d42901
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 48.8MB
        • SHA256 c7f8322784817e9627d616f46ec58a777fa730db765d4aa02aee320553029e3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 86.2MB
        • SHA256 c9245cc0f944a60c078846563e193f1daad8979637bf0fca7c6cd8272a58464f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 70.9MB
        • SHA256 93cf10913e0966bdf121aafbaf9309eec950dc6f95ca8ef521c86c43387795d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 77.9MB
        • SHA256 2d889d66e681c23c1bbc043451f8567a30dbc92ebcc16bd99a918ed4c45d47e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 76.6MB
        • SHA256 25cf270e3a1a66e64184518a0e86ba60b494fdadd9b69a83de5357782f6cf25b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 68.6MB
        • SHA256 616bf0b205d3508665f3e3d5c2887aad196356821c67a875b36227fefd91a5d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 61.1MB
        • SHA256 bf4f99a81eeeb7b0e8366764fd2f69f2cad7bad36ea474b9d6d59b853b40f2d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 65.7MB
        • SHA256 d6bde9e24e9a84e9864c40424e94e8c0fdbb8fa66d0c2f69db67cb266f3ce6f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 64.9MB
        • SHA256 1920cbd37fe28cd552740172467a684327b17e0e7a33be929a318d508619a71b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 49.1MB
        • SHA256 e247db8a5b1eb3b3b4441b64aff479813276e44bc7d5ac076562afaab140b99f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 31.1MB
        • SHA256 6ccd4db97cd6039f776e6bf9c4691324a1feddf494abd7d44718cb5b4b8dead7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 24.4MB
        • SHA256 de8c6a0d602d74a6d799bba09ef42454c159f8fc38226ac0f5dcf2623bcd5341
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 9.2MB
        • SHA256 d8311b2e5058880388dc7119d935c9f9a8f83f06ac735c23b4d3d903bf4f64da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 7.8MB
        • SHA256 b3bb19bf6cadce2cadcda102384e94c6b8b98b99184214402241631e4243df73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 64KB
        • SHA256 d2eb08ebe0c7e7ff2223b6feb8c95f679251883e0b850d913bfa4b604432b861
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 97.7MB
        • SHA256 55c779d588d416507f82d5938242a0610fc0c287fde3998468effbdb33c93251
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 97.7MB
        • SHA256 e82392fbaf3f1e5e7a1de54c2479f6c4f7a639605a5780fd8bea269f58b02a23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 97.7MB
        • SHA256 c6ef3c36e6fd377316d82810843fa2eb83a863a33fc586e4e7a3f50ba0ee92af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 48.8MB
        • SHA256 b2671a9aac4cbe90a1ade1087f92d6a0500138f4d7cb67d46dbdb3c446621c68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/816-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4860-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4860-4-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download