Overview

overview

8

Static

static

3

2026-08-21..._i.exe

windows10-2004-x64

8

2026-08-21..._i.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    132s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/08/2026, 07:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-21_b06b72059c20f23f9b8799b192717b04_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_i.exe
  • Size 31.0MB
  • Sample260822-jte5basema
  • SHA256 27809531fdb57b81e5b703d14fdb5da69c72061dd480889abcc1fcb394f1f110
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_b06b72059c20f23f9b8799b192717b04_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_i.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b06b72059c20f23f9b8799b192717b04_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_i.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1464
  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_b06b72059c20f23f9b8799b192717b04_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_i.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-21_b06b72059c20f23f9b8799b192717b04_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_i.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1704

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 31.5MB
        • SHA256 da6d503427a620c0eea8344a1b68e5460f3505a921387dc5e1ff82f2b5001103
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 31.0MB
        • SHA256 27809531fdb57b81e5b703d14fdb5da69c72061dd480889abcc1fcb394f1f110
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 62.0MB
        • SHA256 587b6d83c889fe25d1a77f59e7eaf58e950aaa894a6e0e528dd10360379a2d43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 62.2MB
        • SHA256 2ba95a0cfcf85e5250d9f47c55a027f70975d239c583cf532461d8f76287b98a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 62.0MB
        • SHA256 16a18eae13d7de8cf889156aae4825c92c96707b5b8722087afeb0e61e487771
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 66.1MB
        • SHA256 9a96d36d40f7a845f87b1bab6bb64e773c668547f184f991bcb4c184610a4f29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 62.3MB
        • SHA256 b2f60db579fa0cb3b5002eb0ebd1b643db92837988be2240784d2368acc7f0bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 64.1MB
        • SHA256 eeca126ff24b6cccf53c338efe6f7b8e60f150c6ae04f0b8ca5ca7a5103224b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 68.0MB
        • SHA256 4652caef41902a55524c6d52e224f1bcdc0b11baa9318cacc0dd0134dc8a2eb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 63.7MB
        • SHA256 6fc9e0bfe262c7c91a2036974c41f18201942ce88554eabd6154ba3268db595a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 65.4MB
        • SHA256 9d8dfcf2b83cd835508908531d123558aeecdaa5f530a88563396b4bacf64ff1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 63.6MB
        • SHA256 0a9996bd1d58f3df4917f404665d04face9849c3d88aa0e67326e693cd55f924
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 65.0MB
        • SHA256 3882f5a3cc79d47f7c54cc8c898b0cfe73aa90732428204be5f667fb23230f1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 62.0MB
        • SHA256 47bb52067a340751f528e3a16792c2f26a3520f07054328efad144353f5e07af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 62.0MB
        • SHA256 d91433de2aa8c0f82406afbb65e19ef8c81466b8ee7339b62f160dd7038c59e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 62.0MB
        • SHA256 c2abb94a3a19b1eb918f097483efca633104ef3cbb8c2747a827a5743180cc56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 62.1MB
        • SHA256 4c8aac2827bca562781a21df565d010c0abb63bda9a6b182c515c95faa0416a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 62.0MB
        • SHA256 7f6d1c5b592ca4c8d169a33049f5a91cafbe7018ab89d4f90801c8e63442c74c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 62.2MB
        • SHA256 7a89ee60c0163226ed8c618f79dc371198757cd0d9963a21501e9142353edfc4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 62.4MB
        • SHA256 aea0ad90bbf9b5cb9544417efcb73766011e003fb17b24cff905059e9a3d4039
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 62.0MB
        • SHA256 0192270c7bc706c5b18122df0711921ee069516a035f7736f5dde5a151b7007f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 62.0MB
        • SHA256 4efcd028f8e0b45ef44b74fdd41165bef924a601c3f9c418db314a29c8c504e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 62.0MB
        • SHA256 9d238f4ba545c01bb8ce6d1befbd09fe34c2ae394bad7ae5145bbfa715a32b4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 62.0MB
        • SHA256 59cdeffe020b4e29217d4fc2b30ca22196a73b9dae1fa65dfeed81249aca87d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 62.0MB
        • SHA256 ed4998c807fe21a294468fa6845e1e891fd745e5d2e8d72e4249ebbcc0461858
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 62.0MB
        • SHA256 e2185c02d560c88625b668428c09fab10002fd705db3d1ac92ac728b6d56de65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 62.0MB
        • SHA256 ebbb435f0fd9585ec247a1248cbb95b66554300c8d28ce912b513eaeb7cd1f1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 62.0MB
        • SHA256 7311818efc2200899363df1e30dca6a1084a3814ff3d6072eaf63c1957c5beda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 62.0MB
        • SHA256 7ae0c42e658cbe3bd97e15269e7af421730715e5dedf2eefb31c666ca5bfc4f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 62.0MB
        • SHA256 d3217c087a86ec1cbf662b9f07b3f872c69063e6a4e2f48fbfaeef42690a00f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 62.0MB
        • SHA256 3dbad33b5f49a88835eda0479c382f48f6b947cd0fcd8ecde2d9a671f5f68b12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 62.0MB
        • SHA256 f7d6e9cf02bf7e5c65369738e2cb0ba3563453b48c14db0a103d1cc66a7c52b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 62.1MB
        • SHA256 9990c6c7d678ebcf997513a264091d9bdd31e7d3e0914dd64893ccb35e944bbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 62.0MB
        • SHA256 a93488c67fb9a756473d7d61cbc4532235ff303bc49dd77862b53d12dca14b19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 62.0MB
        • SHA256 515375f26195cff1c716c8198ffcdee4909b05e87bf0293eeb5a66314a5846ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 62.0MB
        • SHA256 e417e1a23ff1f017df8b616fc1dea103f40d15197dd50a3e77b512d35b0a4ccd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1464-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/1464-7-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/1704-26-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download