Overview

overview

8

Static

static

3

2026-08-21...d_.exe

windows10-2004-x64

8

2026-08-21...d_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    151s
  • max time network
    139s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/08/2026, 10:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-21_97050105ea5a67561e7e05b78ff488f4_akira_amadey_cobalt-strike_elex_emotet_glassworm_icedid_.exe
  • Size 37.1MB
  • Sample260822-l4pgvatamf
  • SHA256 6f170027ae4a39b2da70cbe7d08f9c588a5884e7100a58f8dabddb343eb29180
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_97050105ea5a67561e7e05b78ff488f4_akira_amadey_cobalt-strike_elex_emotet_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-21_97050105ea5a67561e7e05b78ff488f4_akira_amadey_cobalt-strike_elex_emotet_glassworm_icedid_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4732
  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_97050105ea5a67561e7e05b78ff488f4_akira_amadey_cobalt-strike_elex_emotet_glassworm_icedid_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-21_97050105ea5a67561e7e05b78ff488f4_akira_amadey_cobalt-strike_elex_emotet_glassworm_icedid_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4216

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 37.2MB
        • SHA256 bc844078b11d9960af47180067c13baf984dbb70907573f6e3cd708dbcaad415
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 78.3MB
        • SHA256 971c5a2eaa16893303adda1fdd99a2fd8fed1264777a83218797a28210d59c1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 74.6MB
        • SHA256 71331e7e440975be0cd2836f48cb25f76963c4eec6dfa75550af04be09ff94cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 39.3MB
        • SHA256 202025834c49652dfc195809e8bf5775aa7b6a104c74e451a916adb96c096f08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 74.3MB
        • SHA256 8d394117c0e3b6e7f995976e91e4853949acb28da3f43348787cb482244f0ee1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 80.3MB
        • SHA256 dc1f7fa8924b7c56f4b25eeb84d7b9151f794f712d181040dbc613567d8ba1f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 76.0MB
        • SHA256 144bb810cc93555895dce71496e9afbfef4611b2074ddece5cc6d031fb8d3aff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 77.7MB
        • SHA256 00b12355669c9afbc3278d08630763973b3a15394fcb7d720fcbe30cc687dbd0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 76.5MB
        • SHA256 513c607c78bb08c10536b3a81d44609b080ea128f15241b7781c907b1749ff89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 75.9MB
        • SHA256 41d45087f1bf0fa77604e733a0a842978109cd0bd8a060d51f7d10f62f3f8cac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 76.1MB
        • SHA256 693b01fdbd297906214f1143fc6483475703ea42af2429ddd2edcb7817e72989
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 77.3MB
        • SHA256 e6fb92cb1127bfba9463dd393cbca6eebc1a1a7f8c53bb9cd947317d716e67e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 75.7MB
        • SHA256 f1de8c013890358595fb1f1a816cca0801fb9703928a2b634692c1f32b412995
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 74.3MB
        • SHA256 553d8086af8051c99601c66ca9f2a15d7a34768ef110949a51070b3f7aaeba26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 74.3MB
        • SHA256 dd10bb324c9f7e78c4e77bfc36bd9ed01faeaf5a144d18537f76d1a5d5917615
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 74.3MB
        • SHA256 049d25fa2a2e170867062bf8de8727aac825f0d270deb400c39a05326dc58089
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 74.3MB
        • SHA256 38297dc691d9a5301727efa503f5a7d998facc182017941923f5f45b879f3819
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 74.5MB
        • SHA256 867a60a1500be62b3ca40bd2cfba6a7a0eb76cfd0f7c2055ebcc799da6e1c92c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 74.3MB
        • SHA256 4ca9ac7865af4c459d8641bcaba49cf2b34379bf5cbeef9670b25c349bd7e123
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 74.3MB
        • SHA256 c6a068832356a9ae9b69513e9d81349361a2859b6b9ed41ccaf4f778277e0460
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 74.4MB
        • SHA256 bd293ea6f3dd4543d3636a04dc4d0c3dd00d6629036e74f4023db872233a9447
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 74.3MB
        • SHA256 5e7cbcdfb98d869c5dcb3a9c385dc61a141dbc89b0a77d2d9d1497d8c660e1c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 74.3MB
        • SHA256 9272c273542c6e1d690a9ba2809fb8fa97492c70641a6b904c91e0edb361bef6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 74.4MB
        • SHA256 68deb79ef6ee2a864f6390c398c961971cf7603529e34021154b0556eeee2982
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 74.5MB
        • SHA256 dbb5854ef542ce01d6c5e73e155a3f06eee60def2d5f7664a339189735b576b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 74.7MB
        • SHA256 855a862706df861bf92255be0116b1742565ff8a77f0006d01fda6bb0dd737f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 74.3MB
        • SHA256 4ca3ba793e7dca347afbd666d69b901f7bccf17b9bd4bdc45a07821257581c97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 74.3MB
        • SHA256 009f6a2e3df3cdae469f2ff1980868ad3b70f31fc5408fc2c4dcd010d3321940
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 74.3MB
        • SHA256 90ba484653ade896e570b10b58d93702682bbc944ab83e5eb20990ac0e6e306b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 73.0MB
        • SHA256 1f516c597568ac2fdd5d367798b81f253cdfdba2380aeda8e7b04370323a35e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 71.9MB
        • SHA256 b00ba7051484b4847b268661aca316f0ebfd37a2b6b441435a5b0cc6b21f3f76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 73.1MB
        • SHA256 201ae9b00c008554ea65ecc934e5dd4566296433cbf09447a789d8ead42ad9cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 71.2MB
        • SHA256 e1d0641d857278ced2199bfd8989d31ef8a4fbfa93f3d3444b35f03b2904e551
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 71.6MB
        • SHA256 f4e45f3c4ec3e8c8e7ef3cd1bfff308a6c89c79b621c01774f6dc4b745ae225f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 29.3MB
        • SHA256 9dc26bda7292e6ace45bc406c6324d422494618edfc2c87a7aef011f79ce75b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 24.6MB
        • SHA256 d963648d1a62c82de70bc8e57a44800396ee5cbdcc4d7d99fa40654edf6a1c81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 22.1MB
        • SHA256 593129d8ae550b1a0009b1f052185bf28f98999c6153d500efd01fb87c1684a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 8.6MB
        • SHA256 d41530654b805b43e618b3692e958769a38b7bd65ce946e8e2769dc02158b971
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 6.9MB
        • SHA256 8c4ffc635f4b273fdf90b9797f8e800eb0eea1ac1b99d4cfc96271ecf808681a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 6.4MB
        • SHA256 eb1093b39779a1247007db8f2f63014301302796fb823b304d05b6139abe5bfa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 5.1MB
        • SHA256 2c471943428ccd3832bffd0f52e50c741041158b2e4571cacc4438d5a0110f59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 6.1MB
        • SHA256 e5e59957a273d969af50d6544c12df3f8b5d16e31f675d3ee4d0d6f88e18be00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 4.1MB
        • SHA256 b6bbc6273b945fde33686e5ca4bfed7f551f162ed2c54686f24c49a482e96b4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 4.1MB
        • SHA256 d4d8ad1c07d0aec9daa28383234288c734ffb002567d4e98d86dd790f2654335
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 3.7MB
        • SHA256 cd279feebcb0b4a38e11ba87f06f862f4e31272e09a0b393fd8642c19347436a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 2.6MB
        • SHA256 caa5006dec794a4cd9f79fdd1aff66ab7ea413c17305f10f7091f214e9dde037
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 1.9MB
        • SHA256 7ac6f01fa8f1693cd1dc3ee33321a73ff0a4c8136a37fd1508a453f76c86f8bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 448KB
        • SHA256 30fda89260062596f8473df15f576de632ea44d623bd575d46ec46d32766b91b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 74.4MB
        • SHA256 f354dd034614d5c11a6537e5982e44e3c5576b3144f52a4cdb5229a675931317
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 74.3MB
        • SHA256 13eb2e0060411339f3d7cef043f7bb8c4aa79679d109bed507e1394ad8734203
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 74.3MB
        • SHA256 bf1183b1d7283e61792d8f1f7abfd693cb49555f3f65cd3efd4b7bbadc9bfe32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 74.3MB
        • SHA256 45cf8da2a68f57aa10a0343dc9ad174db7ab6b2c3e1e953b5d7e1d38d7b6ac23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4216-26-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4732-12-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4732-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download