Overview

overview

8

Static

static

3

2026-11-02...or.exe

windows10-2004-x64

8

2026-11-02...or.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    140s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/11/2026, 22:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-02_cb83988f11492f4f4918f938ced0c5a4_akira_amadey_cobalt-strike_darkgate_elex_emotet_glasswor.exe
  • Size 8.1MB
  • Sample261102-2jrdpsfx9p
  • SHA256 fa93284d8fb2e0fc0b59e2435f8e969f00418d08d5dc673840bbb3045ba09293
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-02_cb83988f11492f4f4918f938ced0c5a4_akira_amadey_cobalt-strike_darkgate_elex_emotet_glasswor.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-02_cb83988f11492f4f4918f938ced0c5a4_akira_amadey_cobalt-strike_darkgate_elex_emotet_glasswor.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5388
  • C:\Users\Admin\AppData\Local\Temp\2026-11-02_cb83988f11492f4f4918f938ced0c5a4_akira_amadey_cobalt-strike_darkgate_elex_emotet_glasswor.exe
    C:\Users\Admin\AppData\Local\Temp/2026-11-02_cb83988f11492f4f4918f938ced0c5a4_akira_amadey_cobalt-strike_darkgate_elex_emotet_glasswor.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:8

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 9.0MB
        • SHA256 f0fbd1f8fb226d81e03ca25ef01a4ab6e2ca8c5a74bdc71ba78e8bcdd124c313
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 16.2MB
        • SHA256 613adee2975789d07970d37b3637a82d0d238a36c4bce85a27743b3366f49d10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 16.4MB
        • SHA256 52061609da73f2359f0ff514386ecb0d883f2eeb8d343e564a7e4cbcde01781e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 16.2MB
        • SHA256 8a30cd2ae58469255191bee95ccc5a82cca8175e2bf88764934c04e1ba27628f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 20.3MB
        • SHA256 e5605c178fa0a0a0409ef3ada9f7bec56a2abf837257da246041e5c48002d444
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 16.5MB
        • SHA256 2e7339cae3ba9b2d319e6661c6ccab26d5a30b220b93c8e27beab6de87084f64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 18.3MB
        • SHA256 12a4a89f8adea59a4633d88f6356389fbcdaa250f74252f2b843462473e59c2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 16.3MB
        • SHA256 d8a813ae623ce9a635d3fd90215af9b5735fd8431e76480964e9cceb98bc6141
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DenyBlock.exe
        • Path C:\Program Files\DenyBlock.exe
        • Size 16.4MB
        • SHA256 2047c4f86cbb37ce71beaecdf276540fa1b3cdf9ff5d089333ead946d5d688dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 22.2MB
        • SHA256 2042a1d18fd7c6f649677e98443a58334f786e55bca5645c703fb1684ac03d77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 17.9MB
        • SHA256 856dfa6bf8cfde578fe08e49cfb070f4fda83765687b8c0911f1affb27e9107f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 19.6MB
        • SHA256 61e0328a64187a568f0d5e8a1ad62a89441e9bd77e22f44c693f56d2e6f0f3ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 18.4MB
        • SHA256 8559f2a563f649e0228cfb3a93caf552ff317bca78fd9be6394e6e51cdd81bbc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 17.8MB
        • SHA256 6e3cc58e4e2f9bbbdf27504e4222c205378e9926f5d3f0a49b414296540e0500
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 18.0MB
        • SHA256 fe1b07d20f681af2b25dd0ab338a07a2e9927d7f55f8b6a3aad35be99e7e807a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 19.2MB
        • SHA256 4f840b977c2aed540f1094e0f5ce0130646bf42919fa041d4dd076b9d7f1da24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 17.6MB
        • SHA256 57481488ca262e1f3e87587a810d6fdcbeb5c1eb20f3d20a015baa1abd21eb27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 16.2MB
        • SHA256 ebfbfdbb904d45be697facb5dd3081858a6dbca102ddbb6d243a71d96dd444ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 16.2MB
        • SHA256 5df856c0ade2678cc8d98e9be1881ca6bb4c61f35fa0d2ea332c80c7e03e4895
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 8.1MB
        • SHA256 bef2096707f7e6669faf281591202cb31400cb9db163f654b70fb69cb59d2771
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 16.2MB
        • SHA256 10c2169010ef3c408ff3da9be6c05c68ddfa26de6f711d4a827361a972544741
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 16.2MB
        • SHA256 5736d9e643ebc3757bd52875f22a019abfe58acbe50b867df3bd49549acc664e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 16.2MB
        • SHA256 d04c478f6d60f5c5ece559ef5b6d170210548cf919a12ee08c7c0248d1ea1fbe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 16.4MB
        • SHA256 c0d978c75b53887e7dce56c5419f40b2ee058303fd460f8497cc510ad3f3bb02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 16.2MB
        • SHA256 f51ff9cd48cd0cc0b315e5eb7d66fe654b3c1ef001adb9da87994b7f24acc7b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 16.3MB
        • SHA256 d1bdb50eaa23a240106a8d532418426f88b7a3d2cd1f80cbc3ac59b49e1ddcfe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 16.2MB
        • SHA256 9e9106b88fba6b36a03fd4a234142eb4d422d84c5d9d877016185098e736a72c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 16.2MB
        • SHA256 b2a4740cf188cae2b449c3d8d63afd11ab930378457c6ce7679a55717d46e1c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 16.3MB
        • SHA256 c22af7a6e1da6510fb6322672e7d491b75d80e15c6276a8ee31d51d0de90f965
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 16.4MB
        • SHA256 4de1fe232cb348776ca07734588759b146e70f31c0de6ad2777d47cf804f5753
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 16.6MB
        • SHA256 26e646c5fc2cb061b091dab96c53a6d7b8bda64ea15ac7b4cc6e06106510efda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 16.2MB
        • SHA256 29b68fce74162a13f8eb56d11d89f15b0c7ccd7a5b72373eb941107fc476b7d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 16.2MB
        • SHA256 a9721d2d7485d487839ee9497c734512b3b442dddbe126ff5f7f741bc79e7cf0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 16.2MB
        • SHA256 fc604206d44eef485159555c0db87bfc72004fd6249d8c5445a0bfff37a1c96d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 16.2MB
        • SHA256 1803445d39fe08b1ddb0e971aac4080a6c3ca7ef1476f5b7456bf43e18c4ac3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 16.2MB
        • SHA256 4818d843de41e3d7a8e4f57847590983bf808b3e7b34fc9ad942e0d37ce9b411
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 16.2MB
        • SHA256 a0f9b66f40d76228621baa14915cb5b1b25f48b014b74a85a9ab1d4bf9c53827
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 16.2MB
        • SHA256 68aba48e81b9085fa8ab176e18c25073943f05ea53f51fd96de38c90fe50dfbe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 16.2MB
        • SHA256 0df215b0d7e2fd65357c8245f26d06585d8b5cefc914064dd8a5793b5387b7ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 16.2MB
        • SHA256 85acf5eed9217c51bb70bcb2a9c9d91375c4b628e12f054aaf7eeee453dca344
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 16.2MB
        • SHA256 6816b5571317e5c2a56f11afcdf96255ace8aceb732ee02c3b4a286351e852f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 16.2MB
        • SHA256 798ba9cec7a6f4a7e1a1d0b254e8235e19fee58151cc4674596211e90ba17229
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 16.2MB
        • SHA256 6d219a786f778884d013ef244ee0bd3b824126f04ab580749b11ad0a5383f365
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 16.2MB
        • SHA256 e3b76713dbfd8bd844c50a3fbc350cac9fc070f59563ea41f0d161ec88f6f1fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 16.2MB
        • SHA256 7abc31866830ffdb1d07b15b147961de647b643e968736828a41ca890a0754be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 16.2MB
        • SHA256 cfa92371709f3e0f928e0e7858e11f342dc464e4eba5e52e0947fe8bfd85c385
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 16.2MB
        • SHA256 229156792493f4c7b0fb991f028d9457ddff90b273d53b91adb72d722c81af21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 16.2MB
        • SHA256 e964f765d795089ec3729d7af434616ba6e6f858665f9887b1937cac0a61b86b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 16.2MB
        • SHA256 a3755dfc45c73538fc34827366321932fff5959b1f37f97c4d546d8b7ce01b0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 16.2MB
        • SHA256 ff4b5b456e532e760189e915915b26cb949fe02310f873535012e8c9d6291ee9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 16.2MB
        • SHA256 49d8f8123b3ca6fbab0e63629d973048084c94d921c9e37a918c73755e8dec8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 16.2MB
        • SHA256 cbacad29c194f12af7589a181e2006b3694804d72f0bbe9248e91ad7e906611a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 16.2MB
        • SHA256 06878e46c5b3ac10d9b4e560acff31e8dd5bc63574ee87272751c61be0856bea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 16.2MB
        • SHA256 35eb0bd12361a36f2edadbb93da3accd841947803b9c1dedca9c2358a8b8f64a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 16.2MB
        • SHA256 6e9b8fdd7a78d685e0d211d031de8679a45f5d4b222ccc7e32ea298738bc0d3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 16.2MB
        • SHA256 8f8bbd0420936abb78778c44a1fff74c6d80120dc48b4e9da09d793e5afbd3b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 16.2MB
        • SHA256 3f986c1cdbab2a0cbc733a8263840079909fec6633d7bfb780a7001e08726fc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 16.2MB
        • SHA256 148cbc92f3cc92f6cd75255682ff1dbae74eb0884459b005e2c0de560fbc27c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 16.3MB
        • SHA256 56e41c3e8bf290a6d21dc597ada4e47a8d6bac5246f2cb5b851230e3475d34a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 16.2MB
        • SHA256 23ade76cdce85dd2a59a01b3228f2d4c861480a6f6339a0cac70ba03a5e3b3ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 16.2MB
        • SHA256 a80e6c91058f7dc6e7e20fee21b7a5a292210a43ffa016bd89881a3c3b48d7c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download