Overview

overview

8

Static

static

3

2026-08-24...kl.exe

windows10-2004-x64

8

2026-08-24...kl.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    117s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/08/2026, 04:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-24_ad596178132921b1b0a64730fbef8f0d_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
  • Size 22.4MB
  • Sample260825-e1zp3sfh47
  • SHA256 d19b3978084ac3f2b5ad3f097f2fc78b333129657945c3d3ee34f799b6e2377a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-24_ad596178132921b1b0a64730fbef8f0d_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-24_ad596178132921b1b0a64730fbef8f0d_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:248
  • C:\Users\Admin\AppData\Local\Temp\2026-08-24_ad596178132921b1b0a64730fbef8f0d_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-24_ad596178132921b1b0a64730fbef8f0d_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3720

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 22.7MB
        • SHA256 f007469a7b2b610b4196a1dccc86e8a80744e500e9e85ae6887a4d6fae894d10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 22.4MB
        • SHA256 d8e10d4ed0a7a07f257e964e01f61b9ff298af24c352e928b9ce50df2b0f7568
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 26.5MB
        • SHA256 78f8e0d2d7d092886f021d203548a3e9597c99e31c5dd99e3603b7591f7ca8f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 24.5MB
        • SHA256 cd9378bd9deb49269784d6050e6ebb1ac7eb6fd3c79b46f7c21156154c788fa5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 44.9MB
        • SHA256 628dd81dd0ca7fe5022fd1e5a12667b70084cc3ca2a0d7436d294633bd859bff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 50.8MB
        • SHA256 b29b4820f8909bcdc24c38a92ad98d4ef7eacb15cb1b5d74f1e9faadfb9b091b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 46.5MB
        • SHA256 3ec2763c4976d2871dc6834531f6b564170ccfcf8b37390fd3609d36f5e450c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 48.2MB
        • SHA256 4a99480125da60c60a5c0c74234281440b68c966c0aa9e47251c6e42129bb37b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 47.0MB
        • SHA256 52a562712e688ab5a0691c5ec96c437f5c8f7372f1cfb835c6e04f8c361b3cb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 46.4MB
        • SHA256 ee040681847a866097e2446a4365d1eafd9d91ccc1c4b267407d3ea7ac799803
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 46.6MB
        • SHA256 b6526c23631ff3d1715c68169488ea77f68c9f8d5466c48f32e78c5ee75dff44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 47.9MB
        • SHA256 0c091f05e6738a5bf00d51915743f9c597c6864f6079daeb56967c86f3030a7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 46.2MB
        • SHA256 e5113547c6e6695716a6446b7c500e5b51b7d6f6c3ade8d62ac1ca74263a0b35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ImportShow.htm
        • Path C:\Program Files\ImportShow.htm
        • Size 45.3MB
        • SHA256 e0f3edb9ad4336b1a68a391eea42553219fd1b1967e7cfd422b6d6a6b948bd4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 44.8MB
        • SHA256 96489636227ca2c715be2e71c42df3c2a24bf1d5f989e6a9fc044ab92269c366
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 44.8MB
        • SHA256 b7d05ab6d96fc033577af27931063ef7498b1ef7d8b403bda169e32b2c330755
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 44.8MB
        • SHA256 e17dca3b43d5d0b439b43ea9367ad48de0a50c0841f7ad4d6bbf9e23748b6750
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 44.8MB
        • SHA256 a985a35381ae686f48a1642ef3b9280930deae77ce7106ba47a4a5c6cf7b7b68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 45.1MB
        • SHA256 d1848e73af24bf60fe3163fac6c29fad227280913d42398cc02cdc9d367393b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 44.8MB
        • SHA256 0dad9f1240324a471b6051ca5db81a61d1031b9dca9c0cbe379f92a6ed079eaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 44.8MB
        • SHA256 bc2da2ce6b0292ab36dc5f2db6eb6f5e37a68ff5a7e20342c4eb60397fc07238
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 44.9MB
        • SHA256 76088bee1a07971012c69de25631a28536acba33572c75a169fab88abb3191c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 44.8MB
        • SHA256 38a142b40a254fbb149b8be6d2e04d8719f14cbd9f3df2367ed6d0a64cd885af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 44.8MB
        • SHA256 730b09fadd869feac0a9e93934a217f39cf542dd7444b327f2eba8370a871221
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 44.9MB
        • SHA256 7329a83681b1d57ab7877607e931dc6ee8161852d771c7fcbd83b1fc2370163a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 45.1MB
        • SHA256 02f9c3f21df7d6047c08e9c72240d99bb545d52b3ffed1621f040a8b0537efa9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 45.2MB
        • SHA256 ee258b3f0e30f59f080d366739a18354058cf47a2f1653137792726b35aa117e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 44.8MB
        • SHA256 87290eea79f40c494821bec5168d15a97f9fa5d4c441992b614b735d348423c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 44.8MB
        • SHA256 6ddee17a75731e31460f226800af19823e9227ca2a04db8ec4c074aa2252f3be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 44.8MB
        • SHA256 611e35f921d6db3eb06bd4f5b33e307b08f51173e64254218db98e333877645b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 44.8MB
        • SHA256 418e9c09ac3bb2a1edb5f5c535768106029eeb50cc8eb00f5e01facf4a35000d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 44.8MB
        • SHA256 61a595f7415a176a74115c8714bd0266e226872bb3bd07bbf31e99a716b69660
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 44.8MB
        • SHA256 5d11ddfc1c690e7808458567459fd4de4bd765e869404123be896049c1351fcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 44.8MB
        • SHA256 c3867c0f7edace8449acc7ef62a79af017ec5acdb3d4783343507bae65a7388e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 384KB
        • SHA256 e07c4b11762b0eba9b36b768cc55f5a8d7cd5cfc56661ea29c80135d6e9424c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 256KB
        • SHA256 e73a3db162a1bc55b335224f6393042a8aa3a42f76cb2c6bbfffd39feb358980
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 44.8MB
        • SHA256 16ac0217b405168ea66dc767780142d82942f95d32dd98e304a9f03148417a19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 44.8MB
        • SHA256 693b49e08a3ca0da46682366f27f9ef681c25b6587fff955d1f8038897652fe2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 44.8MB
        • SHA256 503bb163ee1560d9f4e418e4ed901e7c2ded80f98dc2d1c36c2d842f605eddef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 44.8MB
        • SHA256 d819a1835e69ff7e60cce0c21440c606bb010db915d82c3e295ab6b5b86c4241
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 44.8MB
        • SHA256 56bac152bf29dbf2c09ea90cfb217b46de9ae4d6eeb630f6ee6b11f01f8a3d01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 44.8MB
        • SHA256 97fae7b41bd2c64ef1fc8fb579634b3dee66742bb713d03420693814e722cb92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 44.8MB
        • SHA256 1074f31899bf4f01f08bc2803f9e0efa39f8c83ab7597511a5db5fedeb8dd228
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 44.8MB
        • SHA256 2d1cdf5831d0005b27b390d3b5fd01edf94d32e4da449b5dfa929a2c84972d49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 44.8MB
        • SHA256 cbcd8e531f6bb1a9cd800bf66da31253083ac9d00ff2d7427fd7d70749fc7ff6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 44.8MB
        • SHA256 16d4cc8ec12f9ffdcaeeab0ef7a455412047fa19f112ab085b7d1d2cd2fa4d44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 44.8MB
        • SHA256 d33b22652f2aedeab66f3b8bbecdcd75db27e29c67220a54e67a5470bdfaf4c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 44.8MB
        • SHA256 5acc4eb4854e62e60cda820e965d13fc4cd3902781203c963bbb99c051e14aa3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 44.8MB
        • SHA256 cb76471d8d67ac21a8d4d57f647f471b6459af00d7b3ebdb0df10583e4080668
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 44.8MB
        • SHA256 0982e14c8e37aec979d6fa84378c94c10b2e5451dafb694a148f4b01dc489180
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 44.8MB
        • SHA256 a61fb601c54f9583f232df3d4353a9240e952f20e88fa2a610544c304dede212
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 44.8MB
        • SHA256 201f9fdea90977543c19b2faa44839320a8d83e6b63a6d279b867ab31156f018
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 44.8MB
        • SHA256 9bdc560cff689f3b7c25c33f2933d2c4be244c890d03796f260f7d3037db8784
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 44.8MB
        • SHA256 3f80e947ac5b4aafcc07301206bc7ac619d6fea8aeb4693283e1325edfe449fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 45.0MB
        • SHA256 531a912deccaf6bce1d7921159ba7b61065f460b8216939162a00fdd8cf0c354
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 44.8MB
        • SHA256 cb1a50ff9674c541ba69d4c1e07ca8b6e5d52ba7e27715ab05e21464c5da3b23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 44.8MB
        • SHA256 e9dcae63ac40afa6077d8ebd013f8d981180176eee4d35b9fc0f363278d51337
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 44.8MB
        • SHA256 45a0ef5539abf5510e3825b0dfdc42001c3cc3c33fa6246a9c006610e7928448
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 44.8MB
        • SHA256 28586f2092c824f0c878cadc87c7bbe5a9f96c1ff6aa05ca4f667568200349ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download