Overview

overview

8

Static

static

3

2026-08-21..._i.exe

windows10-2004-x64

8

2026-08-21..._i.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    63s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    21/08/2026, 03:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-21_bfe5688efdc7f44c55211062d27c259a_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_i.exe
  • Size 48.8MB
  • Sample260821-ejs6zahe67
  • SHA256 b2671a9aac4cbe90a1ade1087f92d6a0500138f4d7cb67d46dbdb3c446621c68
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_bfe5688efdc7f44c55211062d27c259a_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_i.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-21_bfe5688efdc7f44c55211062d27c259a_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_i.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4204
  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_bfe5688efdc7f44c55211062d27c259a_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_i.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-21_bfe5688efdc7f44c55211062d27c259a_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_i.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:716

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 48.8MB
        • SHA256 b2671a9aac4cbe90a1ade1087f92d6a0500138f4d7cb67d46dbdb3c446621c68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 52.9MB
        • SHA256 047deb57a0270a976689f615afbc62c31035acb51992fbbeb6893761e3e967f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 98.0MB
        • SHA256 c1f9e32153f8462f19ec10369c8a8933dfbec0b9171219cf31217a26025f2a20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 93.1MB
        • SHA256 5e65424d53ddff5461c89244d28af4b685d3a8eb972233b0d83b717a1c7df6ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 63.4MB
        • SHA256 8b510a68ffb5f9fb3d01a7ef241dcf8b141476b756368b98ba36002ebc8af823
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 58.9MB
        • SHA256 d2f59254500cced03fc48febf141178332069e3c6490c886881e757b6b1ca68c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 57.8MB
        • SHA256 3ccb67b4a20d0c803ac7663df9e21a040e80fe55971845186224b16ab2361dfe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 56.0MB
        • SHA256 7007db789b745e08cde4661bb11f8c93a9bec34f4681e067287dec14ece89e18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 53.6MB
        • SHA256 27dd591e5c042a2de8fbc396ea67c4c377b225501d92dcd7395626fe8ca18fd3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 51.9MB
        • SHA256 95f3c2bf58487c46ca8a5e0aa1ddd8e648c3e9e4ecc7f32ace6dded408308fc1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 48.9MB
        • SHA256 e050a17efea4b09df7a9d521c3ad5a43d51188a89eb51f1f9836a6989339bf3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 45.4MB
        • SHA256 735076d6efe00219f2fc15783ebac9528eea23b7ab12aedbfe13e000393b777b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 43.2MB
        • SHA256 f7b0a47e0c33b7487eade05eef70f72a446e21bd33b92ff44bc3f1b7ca47523e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 40.8MB
        • SHA256 5075688c71eaa05063e747777ad12edb0762423c534bbc66be98dd3810932624
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 40.1MB
        • SHA256 799104cd978aa740e542f7ddade40cea1eb16e51a1c06783ef7f14cda85c0723
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 39.8MB
        • SHA256 74ec4859b2241f605468c99fea52f53c6fc0971fe5ad77f211569e6b08dd6805
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 40.2MB
        • SHA256 0ba3910466ff6ac8ff6335d18c8a40cd07f293396177103cac45f04111280cf9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 38.4MB
        • SHA256 74b673d6be192595cc1240673737e5277bf595535d00205bcdce208921d604bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 37.9MB
        • SHA256 b0f4938b45ccf957404dc1ef7d90c1b7de965b86e68b0fdebce1d2735560445c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 38.2MB
        • SHA256 b6371f14649f2d5016a9a1663032c87c4ab615d411c8016982afdf2a3676f2cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 36.1MB
        • SHA256 6d96f72cab9dcb3b575c2637cd65c6c516d4ecabc80724b29436f307fb551a56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 35.6MB
        • SHA256 f22a958ebc6a4a2b3465d4d9059079b5beae259d4a082469ad3c3745262ad308
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 34.4MB
        • SHA256 1642c1e3c430975159d5971d63b7c699058f7433a17038ec0d8c8b1d92e7b773
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 33.4MB
        • SHA256 53bd2e3b53ff497545c81eafddc20c6038c685f9de04073628507c87b675ff5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 32.3MB
        • SHA256 0f8cc2331703a2f020f9f91f76cabc192a3fc7b638defae2310bf871fe93e2cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 30.6MB
        • SHA256 865b09cef1dd21aa5ead630ee7282c3bc2fe344ab5a026ca69c3bd52467e8109
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 29.7MB
        • SHA256 3e79fe371fa9d98a8bace175de45b77b28c3cdcc61ed1c0627c0bc9a0128da8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 29.2MB
        • SHA256 ba2ef4d6376076ef7db553e36620c1615932a56da60500790645a5fb29d35959
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 29.0MB
        • SHA256 36d017df63766ee50abe29bb0476e33dabb40e6f500a994917e6c56c48aecb96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 27.9MB
        • SHA256 d9f4072cd3501426826666e3a85d4358b9ee5cffa8a182c35edede21f6070738
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 95.1MB
        • SHA256 fd346068404f246f204042cd5d7d42497ffed1da1907b596dfbf17bfab964584
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 89.2MB
        • SHA256 60b7c4cbb8c0bd4742fc0f0e525c4238238abf0c33aa61f4abf3b6ab6e9c5857
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 89.4MB
        • SHA256 47109452f3777fb08e1e598194bb544b722478e354338b5f07adbba40585ed7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 87.8MB
        • SHA256 6ff6202611af9ded0cd383d115662086d63eda3f558517351c5c8a9cb9516091
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/716-24-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4204-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4204-14-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download