Overview

overview

8

Static

static

3

2026-09-30...wo.exe

windows10-2004-x64

8

2026-09-30...wo.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    21s
  • max time network
    139s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 10:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-30_696a63d513cd53d7bfddfefba74840a0_akira_amadey_cobalt-strike_coinminer_elex_emotet_glasswo.exe
  • Size 24.2MB
  • Sample260930-ms1w6s1bnd
  • SHA256 254b071260c4edcb3dea4097157f2a68484d48e09ad8731d8cc993b11a04c9b6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_696a63d513cd53d7bfddfefba74840a0_akira_amadey_cobalt-strike_coinminer_elex_emotet_glasswo.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_696a63d513cd53d7bfddfefba74840a0_akira_amadey_cobalt-strike_coinminer_elex_emotet_glasswo.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4216
  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_696a63d513cd53d7bfddfefba74840a0_akira_amadey_cobalt-strike_coinminer_elex_emotet_glasswo.exe
    C:\Users\Admin\AppData\Local\Temp/2026-09-30_696a63d513cd53d7bfddfefba74840a0_akira_amadey_cobalt-strike_coinminer_elex_emotet_glasswo.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:460

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 24.5MB
        • SHA256 05f957812c613221f9493105f75e7c18dad580845deba4f43ffc2b46853d3527
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 24.3MB
        • SHA256 3eb36f1cd19bf8a64a58a799236702495dab547d21da65fa40d1bb34d4a9636a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 52.5MB
        • SHA256 54186d00f377d9f5c680abec2e7819987d5637676c6427002622e367103b1dd2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 48.8MB
        • SHA256 8d8e23a4a02ac339b72f0e92a602200102e6069e8147fddc3aa4b1c26af2fb9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 60.0MB
        • SHA256 14f0644f0cbe1da81a1cad4efd845bd2f24faf4ffb29f46e821c490403982e54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 26.3MB
        • SHA256 fed6e9bc7c11f9c0a164bb5f5798a1de89fae8d5928fc294b8d2c2a1fc990702
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 48.5MB
        • SHA256 0d79c97ca9c598c448e5509bb31b89c8a86da6bcdc5bf433f1a217c20016e8f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 30.3MB
        • SHA256 62d35727e8f48a7c579bb24aa94d877de122c46d663ef000fe7c2302d1c2efdf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 51.9MB
        • SHA256 d56a5e8c870fb14cdf194e9cb2dea4c36783960116faa9a5e3a91eccc75bb75e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 50.0MB
        • SHA256 ad4bdcca5fe7c33ea76560c123960078a0b9babc381465bc34fdf3cad951b92f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 26.1MB
        • SHA256 b4f4b2c5200965ea837c29a5c1942bcf396569e9fa9420435a499e1fd30d1d5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 51.5MB
        • SHA256 77ce010ee398a283213d36842fa6f425a70e38d03a202a561fa49dae7cb08120
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 25.6MB
        • SHA256 a7440c0b60431a9121aa3fde273bb95eaf5af5cd5e98c282f3df3d9adb475ebd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 48.4MB
        • SHA256 e1f660e3f2d21a7e077bab1bff4fb59f91aa2b8e3ce49442bf16f2d623b1403f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 48.4MB
        • SHA256 eec85ebd0c22ea24245cc4b1edb2a5f4b0374908fd9f48280a9ac13e1f23bc82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 48.7MB
        • SHA256 719d15cc51907ab9fd8a9449aa291109368c9ba6a273baf17d9059bec8127af1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 48.4MB
        • SHA256 d77b74da1051db2572e9014a1387f3363b75a4ea3b44fb90ede5f215c4fda90a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 24.4MB
        • SHA256 e05cf7c7337d7db344210998754b641c7f34ed71c9e27920cba1b0dd7eed3ba2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 48.4MB
        • SHA256 8faa292c696ded2a30c96c8659c76af5041618060bb2a70d811ab80e118af235
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 48.4MB
        • SHA256 1762d29333971dfe8c14d1ef196767fde11baa20bc8a531bac7a87ec65a4d88e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 24.5MB
        • SHA256 c9ba3c53595b8b7c3f4e1553874eb70cbd59f756b0dc77f04a05a14a5c83b862
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 47.8MB
        • SHA256 450e72a7075b722f9f20b8a9fd465baa6cad960fee0a83e27c958163676a9a1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 47.6MB
        • SHA256 aae14a63dba950a6ad8253c2c4c0dd100b584a5bc9718b15ba533a9826b1533a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 47.5MB
        • SHA256 d866d78bce0b1bac47fdd88166882a6e56521eeefb6419b1ea8f6a514ff4fb8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 47.4MB
        • SHA256 aa6f19f8fad144855754fe991ac5967b35999fd6545151e7320c08b0c790d414
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 47.1MB
        • SHA256 27f73144c0af9389516261969ce4f877a2ce05783ec30f2ed71a7762982b2867
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 45.6MB
        • SHA256 ac0f437f2f76261f2d3d8aa21355dfb9e9f94136dcfc477d3367baca568f6147
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 46.3MB
        • SHA256 5991989e224b2019cc658a69ece616efce4f6b321927083cf9c042040fb54118
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 45.8MB
        • SHA256 a32fab591e06bca6c6012b473701033da1516ae6be0d637a2da8e69b260f3f5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 44.8MB
        • SHA256 79e7ba3fb817955083085a69c889fb3f8de9d54757536ff5b9fac1ac4a3271e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 44.6MB
        • SHA256 81cde8ff9616f41512b30e9261f8cad9387c3ab2b57cba0b78342183f3224da0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 44.2MB
        • SHA256 8bac824f03dcc2c481c2500c26541a4c34133f76023509e4c494bb730aa7dc68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 43.8MB
        • SHA256 7cb659075b05c339274247874ccdf7a9542135b58bfd2db7b18e9927a851b87e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 43.4MB
        • SHA256 9d1802ae45d38617b114404514c647a183889a53c71ea166af783dcfd9e925ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 43.2MB
        • SHA256 df9eeaae063d991ba24ad193488a9ff3e251865f7f0d5ce1f5b1a20ece868430
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 43.1MB
        • SHA256 6d611c203486638478d4574a01c30d1cf836a5a600808cad076c7fd3e3d01730
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 42.9MB
        • SHA256 a9ae8d88184c93000e940764de27ed262ac622304db76dfd84c5b74e17a334cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 42.3MB
        • SHA256 591e214d25271d769ac4e48152c98ab01e6b2d260f2cd33bad903df534fb7186
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 41.4MB
        • SHA256 eae00a387f332a9c5d66e3d23e45be45a3183145f8223c488a930cec73335e3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 40.9MB
        • SHA256 9f88429c1d278d8185f27bcbff387ef7119bd7c3b23f5f7c7d9a63dd301ac777
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 40.9MB
        • SHA256 b683285afd991d02adedd8a6c61048992f39be99828cb047a8167ef35db0d091
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 40.1MB
        • SHA256 dc3ee602667cb188c0c24a3c18a33ad9bb8e063463dd634e54f5be6459f439a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 39.9MB
        • SHA256 ca6c1482f00434bd3d85f4dc1db77db66871485ff5976eace241bfc3a4420e64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 39.3MB
        • SHA256 b4fd9bcba870654001f709de596671e6506b9d2add83b0b3cf3bad9e8becb660
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 7.8MB
        • SHA256 682c83a307a01bb4922cad9459cc6ebf5c6ef1fc9e364f274507865bbb20bfa9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 7.3MB
        • SHA256 ae5d7446a96ce706bed309cc9533ac0f5fef2b8a9f602ee8c8d9e0037b8abbca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 7.2MB
        • SHA256 5ecf6a8d672f61f7681a6280b2c495f7f32dd4c281928f42634fee558819372a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 6.6MB
        • SHA256 7ded7646104a29e552a66f345466d812660e3643545b058bbdebd5172fe58351
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 6.5MB
        • SHA256 41a3d8abc6a4c06b5fff42c442669fc53c769c58137988543c93fa8643759f51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 48.6MB
        • SHA256 73e53e889ce324b758315723ece07f2b252ccde211d60495360820e7298768ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 48.5MB
        • SHA256 88a9602b9daa92d234ff1071b234e88cfb78737adadf3026543225a84b2ca1bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download