Overview

overview

8

Static

static

3

2026-08-21..._i.exe

windows10-2004-x64

8

2026-08-21..._i.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    75s
  • max time network
    117s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/08/2026, 11:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-21_81446afda0bb8b2405473c14cbfd9d14_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_i.exe
  • Size 36.5MB
  • Sample260822-nvmb8seh65
  • SHA256 f0ac1532310da66a37273d792ed48c1f154c7199e8b242cea82b0d2a07a5a4d0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_81446afda0bb8b2405473c14cbfd9d14_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_i.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-21_81446afda0bb8b2405473c14cbfd9d14_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_i.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4264
  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_81446afda0bb8b2405473c14cbfd9d14_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_i.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-21_81446afda0bb8b2405473c14cbfd9d14_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_i.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:936

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 36.8MB
        • SHA256 40d7af8a41c50ca98162144967025da14c0f7664d95ff448e2f22075843be9a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 73.0MB
        • SHA256 6fa3e4e17467bec34f2a7230ad82013b35fb1f16704f73b3069afe5d7c2a4eac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 77.1MB
        • SHA256 7be3695c3505781e481a64f17ff4628069bfc5fe7723042a12fb8960d1929b60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 73.3MB
        • SHA256 31f24d4f1d25ab100d325a69ae0648ce391007a6604bfdbd89946e9a7852ef6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 38.6MB
        • SHA256 ed5cea237ee4f84b6610a590c31b5bf81e905db4aafb9b1a53f576e16190d01b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 73.1MB
        • SHA256 93629e8780ec668c92037e0127de12508d43dbbfebd387558cc22a92d5a631e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 72.4MB
        • SHA256 3b6cc67be4d82f214feb81c50ceeeca143a05cbe62d7789e7c82ba64aea1e070
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 67.8MB
        • SHA256 5a32b5269e58a51140f1378b8b59caab5bcfdf405d45370f0a39b8cae729da8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 74.7MB
        • SHA256 8d6ce511fe9c7f71bb359648a86460e1654fc120b2f566fd2815de2e31219e23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 64KB
        • SHA256 5ee579a102ce5bf0cbd0019815419a15a91d52dccc5939636170e988272f403c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 75.2MB
        • SHA256 85e780598efc5f61df9ed282ec4798df80e0aa53c90f821c4222b0a325464af6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 65.0MB
        • SHA256 d3aa9cc1b9ad4cd48eefc3fabed10ee5260d71b0cdc0a8bb0a5a6a1d9b65308a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 63.8MB
        • SHA256 93bc861cb80f665bc52928955573d36a52d1d26fe75c05e6ad3f4b7f8a3a7eeb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 65.2MB
        • SHA256 d5152a224f7ea3c2050fcc90130fea3f6bf3df1cfd91b998b2a74f2db6d199e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 60.7MB
        • SHA256 19305ed9723c721aa26db8f6cef86bcd2b1589e668ec32e0aab53a53b7715cff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 57.4MB
        • SHA256 bf336489cc7db730a3f36ef6780d79d9a5591e1da79b89da26e08d5e3880bfd3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 56.9MB
        • SHA256 64cb5a132ae2677038b88a6150a81fe9b5e475b0a36141f0b8e1843ca2e3e018
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 54.9MB
        • SHA256 3124919dd52586a82c5a4506802eaee4aba3ff12b5974ad9df7d818e06bd4f35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 54.2MB
        • SHA256 21f2024a7d4bd6c5886a6eb4a29b4ecd237294fe6a4e21b1532a269bd8f8f06e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 51.7MB
        • SHA256 797e7d2ea9f43c668083b683b763c0c74652a49b79b0d2fd401246f7105ad386
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 50.8MB
        • SHA256 75df2f230307f9b9db50b7ec9b816ddad83d822c2ab0f446be0fb53eb21ea054
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 48.8MB
        • SHA256 c547d81873f4d4f7547b79402d8fe010241e737d336466a4ecd70ebdad132325
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 49.7MB
        • SHA256 d84f13d74f8374cd2bee60a4c437fdf59636d5fa2093b34a34b8bd850c5a5bef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 49.0MB
        • SHA256 325ae37a4973385e966982aafe155124cc17ec4e8dc457feb67d6a57a610007b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 48.4MB
        • SHA256 2ada745a5c60e590b9c049220a95c4f892035e72396c8ca3a5db0c4e7c55362e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 47.6MB
        • SHA256 1d59f2c02b77bd4443e78c08253da7a3c81a3dd4a41050be477dabdfaf3fce76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 48.6MB
        • SHA256 0c1138da7280ad16dd381bdd732c52ed6db01c33ce3b09294b7577f9412f0a22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 46.6MB
        • SHA256 918e174801a390837f0ddd278df61d60f315043f516e3ca77faac779caa115ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 47.5MB
        • SHA256 ab524cf0518cd5e7f326a6a6d63b3ad7bdad2aec2e3b777f4a59f0ac4f3c8885
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 45.2MB
        • SHA256 538730613eac77f182dc8ed3ccdcbd5b5a60bedf8c5e13c9d72d6db9f8ab6e16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 43.4MB
        • SHA256 3713ca6e64604f6e2fea0fe60766a783b3c0e14423e8ce2353cc6765744b22c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 42.3MB
        • SHA256 1e6afc431d39d8efb6d3128ad16486e4c3def86e95e0e0856ef6716141252ddb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 41.9MB
        • SHA256 b12836d9054aa982e8128bef341fd9ed9c6c00490ec8aa5804c6cee456ee6e51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 41.5MB
        • SHA256 2ed5f9550fd35f080f58cf6063265e0d0fae30d7c57ad30ddeb70ec05a5545bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 41.3MB
        • SHA256 7783cb158d9850e653fcad5279c30787b7d2e8ab7f0d74ef919fda0e030c8b8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 40.9MB
        • SHA256 9a898a7182ca95e3de221416147e96d4ddcee3213e6f7d3f508e04ed431514ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 41.8MB
        • SHA256 ddfa011cfaf869ee1a1418328a084886185363e908514093380d7a8077d88c54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 38.8MB
        • SHA256 1ec55bd44b2d80be5ae15351b3a18f4bdf090bd042b1822fde34637035d52938
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 36.6MB
        • SHA256 5f9250c50f765877c8a0e2144386b0c59577d60dc925ae1bcb3ff7d6f69b96bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 34.5MB
        • SHA256 1f6607bc1003f5a7e917b2bc66d89fe7fc08fbecabb8566852ace9f7e7c2ff26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 73.1MB
        • SHA256 1b73c762ea68788d209f8ab81e9a54dc5915e77646cd9a4e62c859ee35add9de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 73.0MB
        • SHA256 38d8c491ac4665e768ebc32833aef2b8878f9a3a2b785a246841c2460e69986e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 73.0MB
        • SHA256 2e07e9f86d1e0433eb9a4882f17aea5a1fdb7e0e2a6735c19f580f790f9efc70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 73.0MB
        • SHA256 fb4eb19a9764ead4aeb8b4aec153bab95da0e559233cfa23eef53a14114d8707
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download