Overview

overview

8

Static

static

3

2026-08-21...or.exe

windows10-2004-x64

8

2026-08-21...or.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    22/08/2026, 09:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-21_9f79d02a6e8c5477803c8061e8b89f7f_akira_amadey_cobalt-strike_darkgate_elex_emotet_glasswor.exe
  • Size 9.1MB
  • Sample260822-k86fgsshld
  • SHA256 0df58f612e13b579b0bb7afd3da63ba5e950b9ab341c8e9ea8431ee0c2b87e7a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_9f79d02a6e8c5477803c8061e8b89f7f_akira_amadey_cobalt-strike_darkgate_elex_emotet_glasswor.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-21_9f79d02a6e8c5477803c8061e8b89f7f_akira_amadey_cobalt-strike_darkgate_elex_emotet_glasswor.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1088
  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_9f79d02a6e8c5477803c8061e8b89f7f_akira_amadey_cobalt-strike_darkgate_elex_emotet_glasswor.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-21_9f79d02a6e8c5477803c8061e8b89f7f_akira_amadey_cobalt-strike_darkgate_elex_emotet_glasswor.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2316

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 10.1MB
        • SHA256 10f99497c7b56974f0d6c17ab70ebbd824cd40cd605ae3e91986feea9467775c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 9.8MB
        • SHA256 585158e1cdde3b949e196e80598a660a8a3890d885e657d25ef13d6a3c4540fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 24.3MB
        • SHA256 aaff3c5a1ddcd4ca30340dbfcb5a9cc050b77cd27278327f207a63b7443c52d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 20.0MB
        • SHA256 c85aa9e6879ece37781c77a645db92193402467ea5526348b927436acf54324c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 21.7MB
        • SHA256 e2b8438c4ca4262dd7cb13536de4b87c15b091c97091f6924f3853f61670125d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 20.5MB
        • SHA256 0766d644528d2cd06c94bd120116d7e78ee50a819f86b45d0b3f4e19431ddd8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 19.9MB
        • SHA256 5789e1e46554aba877e661f01b75442e8980cf6dd1abb2d68e1b4e5d39e95581
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 20.1MB
        • SHA256 4c94f82d184421fe98eb2b092d37cae886d7df439be0349c804e584448b1db0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 21.3MB
        • SHA256 5a505a10c7e2c8f4a38c81e2431afaff311f3dc1e2883309b181adc4cf4dc0f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 19.7MB
        • SHA256 101e51480cbf597dc3b4959cb781fe5a70a39aa4d22b9b7df4e5d3636a0c631e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 18.3MB
        • SHA256 4b1ab7b8c7a550f0694500ea9b456b4fa63579570ac8b75cef1f30d3d90d633a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 18.3MB
        • SHA256 a5ce4d4261c9e47e1c1da99e4f46aad38d6086a483c47e75ba0d5a16dc033d4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 18.3MB
        • SHA256 6f6ec77b8b435fa4ae63e48657fb4d6de835d8654380f5e5c1298a34c729e210
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 18.3MB
        • SHA256 5ca606f3812ca796aac61eb9f30a0da5a1ccef940e761949c3710fed376729bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 18.3MB
        • SHA256 edcf82017f91c42fcabe93905c93be19a3b1f2882eee860e9a3ed666e3986d34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 18.3MB
        • SHA256 3d8c3a03f96a08573fda019f20256549f37f5b2faddead4f14d7727be8f775d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 18.3MB
        • SHA256 30b23057bae34a0e46fc25290e60d556c9b3887d13cbced1e522902dded15ddc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 18.5MB
        • SHA256 33c34bbbf94ca23778da9dc336164588aeaa5944ec56d8db5ba3287ab2863c2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 18.3MB
        • SHA256 d5dab17268844f2094a7c46df00aee60188f7cdf8297604530eef58ed6aca4fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 18.3MB
        • SHA256 26403353ec453e6da13f2b6ea7adca10599c57c56b08c791ce7c95ff6a08c4f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 18.4MB
        • SHA256 e8010f92bf5c9cf17842d3e8e0d81ca7b9dd4c3368e57a08d64d78f72e82c8c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 18.3MB
        • SHA256 3edcb135ad951a34617df6e3944ce8251f80b0c12f7db1afbf2f6ab3a938bdc9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 18.3MB
        • SHA256 df077ee003f7b4e43c8d06f752f3ddc9a8eac0541d320ab6784085dd80c7ab8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 18.4MB
        • SHA256 5977ce6a3bd033288f2dc64b92e4799dc1ff8e4f4295340292254fc6ccd6217a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 18.5MB
        • SHA256 ed5d3f32b86c7654e646e993a0c034f867d2b957b03a08f754bac6c419c663e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 18.7MB
        • SHA256 f80b2c51bd34ffecaf010b5a233892aded59b11f42cac6f97227383d794306ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 18.3MB
        • SHA256 bc2fb6b0d71deb632267c687dfecd65ec8b65e3067c794f04bd434f7286f68d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 18.3MB
        • SHA256 c97dd14933505459c31bb2831f3e98885c493b9d5070113d435d3d3b4d45cc97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 18.3MB
        • SHA256 89a6ea17d4766cb57390375b5082460548cc216946d42690e42040d659e579e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 18.3MB
        • SHA256 12b6165c39bccdf53b32b211c0e5eb86d1ccd10edd417e1d2bc84637207b7f85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 18.3MB
        • SHA256 00aad03d68c06590e4730263b8ebe511e89997ed3bb259a6ee90b0ee6c53aef5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 18.3MB
        • SHA256 43c98d7fb40fc0c22b0d65c90204f1608d185484ca4af6dc6fe25860828ad365
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 18.3MB
        • SHA256 2299ffa254b2286bd194c76f8415ac7d805e08bc5639f5a169f9c6f9f47fb0b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 18.3MB
        • SHA256 b58afe090374148e265598fa06756fec3e37b1b164cffa6d8bda597f2ee57f5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 18.3MB
        • SHA256 9973c8dbbc457482fdde60f424d91f5bb20d362ebb776615bbfc905577762f71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 18.3MB
        • SHA256 050ece58e7bf9ffb465500b2bd3b8c4a575e8623b79edb2c87aeccd7f434eaa7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 18.3MB
        • SHA256 48c16a257137fd1e5034c1edebb4c353b029572d7d04adb16eb0528540dfbd82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 18.3MB
        • SHA256 100349022dd2c7dcbcfebb4a37e87bad009220f5b100a9d37187fdaf234ac7a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 18.3MB
        • SHA256 b75ae29467a58530025011269be539bbc872fa525cf1b6cfb7cab3c19cb4bba7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 18.3MB
        • SHA256 6057f85a39debffa20586fe3f6e99b588033356b841ea65501574656798b92bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 18.3MB
        • SHA256 f0971a8f9887c56ce06d44a1451b436009a9feaa111356f675b1200ff663b049
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 18.3MB
        • SHA256 0627b2c1980cae56bc8628601db9d57d8f359329574af8808a36b340262defd6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 18.3MB
        • SHA256 275ed238c3b383c3f29dccd1d20d6832d683e552578e65a04b13c1b9eb8068c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 18.3MB
        • SHA256 9700376f899a9fe6381d295434bdc9ae8c8302a5a36c3c787348ad047bf9085d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 18.3MB
        • SHA256 1882930563f77f5b5c0fbed6948518d08b482bf0d8178db7ed4ac6d62a46d628
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 18.3MB
        • SHA256 18b0b1fff8eeb23aba0e46a9c88d5109d6e3b6b0ca119316f517913a60628f61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 18.3MB
        • SHA256 9b063410bc5a1c78d8b4b0c2708cc59a3464f77c11a62ccc4ba070e4c76a4c22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 18.3MB
        • SHA256 d333f66f2649ba20167b9c72a7ea6691c85c521f245296d3f447165a1d1ea359
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 18.3MB
        • SHA256 7a547541212b0aad917abf8d5252d0a1bcf838a0d2fc77e4d2a254f6860fb946
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 18.3MB
        • SHA256 558b2aa9587b9cdba9db139e2083532bbbe4201deb9deeb53354c264bf7f1589
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 18.3MB
        • SHA256 b587a179e2ee196bff59d8afb3c82725540a258142d5994e04eaa0828cf5f6a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 18.3MB
        • SHA256 e725bf999b29680213977d0cbffae84f6063b76878d98b026cc10f45e023d195
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 18.3MB
        • SHA256 d7e9ab446f6b26e2a610962676685f9a23dbabca0c50490487b543405fa73dea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 18.3MB
        • SHA256 bc9c54e2a5b824ab50d60730007d85796f18bfece8f89ab1fb7d1405ecc19219
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 18.3MB
        • SHA256 483fd3e90547baf050d2742faa245337c79eb4dc05bb393817ba69d55aea93e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 18.5MB
        • SHA256 18c87bcf405b242fb19b00e79304deca07c6c52aa6882bdaa0689acdc11091d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 18.3MB
        • SHA256 989f084ac21219ab7fb09791a60d1c711b18cdb9ca6cd7c6e2bc230f242c0d3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 18.3MB
        • SHA256 aefe67a1c272b1d78c46b9ad234deb57d1162489471f12192d3d94c64b369425
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 18.3MB
        • SHA256 f90f094845c3c29a5da94eb890002787b2080734d35a73aa0b16c86e19d42ce2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 18.3MB
        • SHA256 0a286bcf63aebc970f13872df7d08841a100199d3641f50776f52a7b6b43e442
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 18.3MB
        • SHA256 ae4988e28c7ccd39a9fd91eb528b06a72130f1f55945ce598374d8454e3c7ecb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 9.1MB
        • SHA256 0df58f612e13b579b0bb7afd3da63ba5e950b9ab341c8e9ea8431ee0c2b87e7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1088-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/1088-4-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2316-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download