Overview

overview

8

Static

static

3

2026-11-02...or.exe

windows10-2004-x64

8

2026-11-02...or.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/11/2026, 22:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-02_cb83988f11492f4f4918f938ced0c5a4_akira_amadey_cobalt-strike_darkgate_elex_emotet_glasswor.exe
  • Size 8.1MB
  • Sample261102-2jrdpsfx9p
  • SHA256 fa93284d8fb2e0fc0b59e2435f8e969f00418d08d5dc673840bbb3045ba09293
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-02_cb83988f11492f4f4918f938ced0c5a4_akira_amadey_cobalt-strike_darkgate_elex_emotet_glasswor.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-02_cb83988f11492f4f4918f938ced0c5a4_akira_amadey_cobalt-strike_darkgate_elex_emotet_glasswor.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5024
  • C:\Users\Admin\AppData\Local\Temp\2026-11-02_cb83988f11492f4f4918f938ced0c5a4_akira_amadey_cobalt-strike_darkgate_elex_emotet_glasswor.exe
    C:\Users\Admin\AppData\Local\Temp/2026-11-02_cb83988f11492f4f4918f938ced0c5a4_akira_amadey_cobalt-strike_darkgate_elex_emotet_glasswor.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2872

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 9.0MB
        • SHA256 f0fbd1f8fb226d81e03ca25ef01a4ab6e2ca8c5a74bdc71ba78e8bcdd124c313
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 8.8MB
        • SHA256 4bfa4b201634e374f17716f6458ab5ee91b0904163ec58851538aedbe527281c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 8.1MB
        • SHA256 10a90bbd34dd46fd0bfa1cf82b3216ca2bf44f67ee811d56b3161e96f659506b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 8.1MB
        • SHA256 17a60095a938c05efbc12be04af5c18bc41e9c86a2a6bc3a856a5e5aba0533ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 8.1MB
        • SHA256 5b66197ec01ed724bf9478cb7fd76883b3168a1e2be66031a39e584c84df2102
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 8.1MB
        • SHA256 2e7e90e7f5ca6d2e2904726b4f41dcab617a7adc0d6bdddb1198508041b48fe9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 16.2MB
        • SHA256 e3b76713dbfd8bd844c50a3fbc350cac9fc070f59563ea41f0d161ec88f6f1fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 16.2MB
        • SHA256 229156792493f4c7b0fb991f028d9457ddff90b273d53b91adb72d722c81af21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 16.2MB
        • SHA256 e964f765d795089ec3729d7af434616ba6e6f858665f9887b1937cac0a61b86b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 16.2MB
        • SHA256 a3755dfc45c73538fc34827366321932fff5959b1f37f97c4d546d8b7ce01b0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 8.1MB
        • SHA256 4389a042b1ad6a8d5413050e1eb93fb7107d1dc7b1e75497430c540c9fa5dd55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 16.2MB
        • SHA256 cbacad29c194f12af7589a181e2006b3694804d72f0bbe9248e91ad7e906611a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 16.2MB
        • SHA256 06878e46c5b3ac10d9b4e560acff31e8dd5bc63574ee87272751c61be0856bea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 16.2MB
        • SHA256 6e9b8fdd7a78d685e0d211d031de8679a45f5d4b222ccc7e32ea298738bc0d3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 16.2MB
        • SHA256 8f8bbd0420936abb78778c44a1fff74c6d80120dc48b4e9da09d793e5afbd3b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 16.2MB
        • SHA256 3f986c1cdbab2a0cbc733a8263840079909fec6633d7bfb780a7001e08726fc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 16.2MB
        • SHA256 148cbc92f3cc92f6cd75255682ff1dbae74eb0884459b005e2c0de560fbc27c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 16.2MB
        • SHA256 159185b059744a89a6863081bb2d2aad2fec1f454088bdb6d07a786683f52cff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 16.4MB
        • SHA256 a1e5bd0701cacaa6a0beeec1067e59b280005a395ae16e1b40c1e3b6c618b1bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 16.2MB
        • SHA256 51b43796ae9bcb676205471f4bf3ed5276401aa2106bb4829ebe4a52ac4e225f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 16.2MB
        • SHA256 7ac215066fb3a9fd5003291a20165213920d56a2d5bedb860f8c05be3100493a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 16.2MB
        • SHA256 fda69753b741e8fd09779ceaad8a5e4f146246619350b4f70c8ffcbddf521fc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 16.2MB
        • SHA256 d5255b3bc741c81d7a08ca3572a36e44856b3b8259fa63e79fa6ed64b00386e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 16.4MB
        • SHA256 ab735e3982b752a1e87309340f91bfb97b5aa20ac11e752c0492a05d131f80fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 16.3MB
        • SHA256 7481e2457135ff710625dd6b8b4e10b2c2a7f349ae88c523b3b1bb425cca9e70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 16.4MB
        • SHA256 4b20e8f7a21b07ff948d3314f8de33036031acbcedfc4a041631fc32570b79f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 16.6MB
        • SHA256 18f070e1d05f1a0c89286152e54a3eea32a412e3704934f2867eb603298c580f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
        • Size 16.2MB
        • SHA256 456f5aaa883a753e87f66aab1d012ce01e2e4f01fd1e880b67c0e751f4aad18e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
        • Size 16.3MB
        • SHA256 aa4ae367b4cf7715483513191e54d3a67580f9a9eade195f9dec6e47cc9543a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
        • Size 16.2MB
        • SHA256 4b6ec19297a0d7c814a4d0e224ad0b001f1a94162c33a56ecdd831ce84964ed8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
        • Size 16.2MB
        • SHA256 6356b31ba589f907447f3ea77cc1cbd203fd13f2630c2169cec5c679ac925089
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
        • Size 16.2MB
        • SHA256 7f50f1d7e0324a6439a31851af2e5ed49a4843d7acc1e6809af53a3708cb22dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
        • Size 16.2MB
        • SHA256 c068ee1b5cf4503e2a1d9c9403ff6d97fc540c05d65587ebe5d64de3e058f567
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
        • Size 16.2MB
        • SHA256 d8fdcf45594f86f3fcde5de0d0467c8b7899775ff2f2eaed37e16f4c553cf8a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe
        • Size 8.1MB
        • SHA256 698b7f0fb7bf6b33eef069571fc40009153e1aed4fd1c94671bd7603a2c7fb05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe
        • Size 16.2MB
        • SHA256 89458780793aa6d10bb88a4c5c9060539f3f10fbfd082bb7640b7d29f0ac14ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe
        • Size 16.2MB
        • SHA256 336b012acf933f0d6373816ad14e3d1e4dba817da30a6bb6011def8802581c9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
        • Size 16.2MB
        • SHA256 4c14dcfb2de4da5641b5b1b22488093445cc3e6161282909588ffd9dc3687e47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe
        • Size 16.2MB
        • SHA256 5555ae17e75fe1ac60426fffd6bd1c45e73f7dd4077f0b32eea678861b66a09c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssvagent.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
        • Size 16.3MB
        • SHA256 70e474e2b03e802a5ab5d01d4867b4dab1a8f63cd08594fdc0bdc7f155b1d793
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe
        • Size 16.4MB
        • SHA256 5beaff700439f56d41c0592e3017cdc82a76c003752979f7b5267ba65aba068a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fontconfig.properties.src
        • Path C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src
        • Size 16.2MB
        • SHA256 bb7923862f16ac0d44c2ecaf3c00f5a2cbeb2a725e6d563eda8339d779e49c66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jabswitch.exe
        • Size 16.2MB
        • SHA256 fe2eeb5c424472e120a7a238e9c7d6c7914d3ce3f3e24618627ad3e3025cc3f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jre-1.8\bin\java-rmi.exe
        • Size 16.2MB
        • SHA256 c20f422f5dc4a76f2e3f53caf1720694e97d7469502e466107134472e06b37de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jre-1.8\bin\java.exe
        • Size 16.4MB
        • SHA256 9e7051822ce645cb7666d6f9a1ad46fdaf083206228377da9ef7bf9a27367fc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javacpl.exe
        • Size 16.3MB
        • SHA256 39fc19a311003801b8949b7d5fd1ad06fe3ff6a766dec80ea8db6ff0e22106c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javaw.exe
        • Size 16.4MB
        • SHA256 fc0cb29d78265ea1a720fe1ee3ad3230cb626dd58c11c0a578018af2f4040ce7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javaws.exe
        • Size 16.6MB
        • SHA256 38b66f909132ee848cfac467ce75f31d3eb04130d65c6f16c72eb3ee20a4208d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jjs.exe
        • Size 16.2MB
        • SHA256 106f0e15bfc47c933c30f4721f942107f211fd8f954c3a6e475cb23a425b5826
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
        • Size 16.3MB
        • SHA256 d558155c2f961fece838e46aec1da71dc83bef1534912bee5f15de8da8a42bfd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jre-1.8\bin\keytool.exe
        • Size 16.2MB
        • SHA256 88ba453bca21bb85192880667a3247382b2541931687757a6abc6ce19d045186
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jre-1.8\bin\kinit.exe
        • Size 16.2MB
        • SHA256 fabc43c1d2f81d386b0cfa2be11ff9a96df3f06b9c0150866d2ba67a21986bde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jre-1.8\bin\klist.exe
        • Size 16.2MB
        • SHA256 21c731493f6daf04f6e29397fb4300ed2b1099de77d4a3ece1b161de9d7a2ed6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jre-1.8\bin\ktab.exe
        • Size 16.2MB
        • SHA256 bf99f4edb8f673b9142226b8b35bbcbe855f6934aa9d2f4c63fc5cf31386e945
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jre-1.8\bin\orbd.exe
        • Size 16.2MB
        • SHA256 c59c7498532eea8b6c4573acea57e39f4cf83ab1ca85237c6cd7f0b8a007feeb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jre-1.8\bin\pack200.exe
        • Size 16.2MB
        • SHA256 f044125935d56427c9f0451baa42a1405799854e72d0a785c9d60ac16285b467
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jre-1.8\bin\policytool.exe
        • Size 16.2MB
        • SHA256 fc261d9aa485cfb8e827c77df3faadff1b3c83af853c9267e0222ab6d2535ce9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jre-1.8\bin\rmid.exe
        • Size 16.2MB
        • SHA256 c85471a99443f37698da16872b0a87961f9615893a0add5a324fc325ef998241
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe
        • Size 16.2MB
        • SHA256 e9241cce812598091f378a4883967e52bb568d7f40e57f599d165fe4ed355853
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 8.1MB
        • SHA256 fa93284d8fb2e0fc0b59e2435f8e969f00418d08d5dc673840bbb3045ba09293
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download