Overview

overview

8

Static

static

3

2026-05-07...ar.exe

windows10-2004-x64

8

2026-05-07...ar.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    07/05/2026, 13:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-07_e5f66bf1fed42bbd5a48da95fe3d8def_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 15.7MB
  • Sample260507-qbcd2aas7k
  • SHA256 f5e7accb2cbbe2de6ccdf531a4bb00e377a05b5a92b61c3867e95133f8d6966e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_e5f66bf1fed42bbd5a48da95fe3d8def_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_e5f66bf1fed42bbd5a48da95fe3d8def_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3452
  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_e5f66bf1fed42bbd5a48da95fe3d8def_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-05-07_e5f66bf1fed42bbd5a48da95fe3d8def_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2216

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 32.0MB
        • SHA256 476a64c66664552a623a800a050e2c977dcec56617d417c3e25d23b9c59a959a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 32.4MB
        • SHA256 67c9fcd089a045ad8e0fb72537a795c23c79d673762b8a664b6ba508217583a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 32.2MB
        • SHA256 4edbf988ee96f2dc66c0f7df4eb46b88ef6692126e2344feab9a44c1678d68ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 31.5MB
        • SHA256 04a4d6635469a18ef509d8a24a366fb96f3c566ffda7f0fdad0afc96c7ba63cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 31.8MB
        • SHA256 3623491626e17593baebb4edf0ca0caa86068c36f2fadd4759a2abbf877214fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 33.6MB
        • SHA256 d11d956ca62a15eca9651e7c830b318ca1b6c26d5084b7ea46c405fd2273190d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 31.6MB
        • SHA256 c4b9d27d6554c799d7678391c9966df53e323666de11e19479d0daa82d8c481a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 37.5MB
        • SHA256 fd4753ef8eb464cda69ffa8ac99957cd2e01028e7c5a28da32591f24936c8a19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 33.2MB
        • SHA256 2f8911ab5c1fb239706d26a0134cdacd46d6d82ff0783f345728549ff15c7958
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 33.8MB
        • SHA256 0b741417153cb1c939fd430f5c2a5e856f402d3dcaaf36dccdbe91c702845ccc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 33.1MB
        • SHA256 d6f09001c91efbb5c0985d62861281380d9e5546d5efdf89f0d77371864aa3c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 34.6MB
        • SHA256 4c97680aab29df4f4b68efdedb91a3a60738b2fb074f5961b9fe246a89af3e29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 32.9MB
        • SHA256 166607910236a28dee25fcc69ea02cd0626b9681760d414d9ff2a57b2e9321b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 31.5MB
        • SHA256 6b887b4d10694e3371beede0e41838f0625f710f038efa1e4e1e85f0cb6eb4b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 31.5MB
        • SHA256 ea5bb79a117a58c926225d36221ca2094da046cfb9996ef9ac3ad237fe8238e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 31.5MB
        • SHA256 0107ee5cdecb0d335e901e2d27d7415fd490ec4e2e381f551dc0d6f7175ac961
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 31.5MB
        • SHA256 396d98355643887595af5b87e510fab52d5e4141d2dc300ab4e3237cf8f45df5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 31.5MB
        • SHA256 39c016399358c833d8635e361d827bd941255b2bcbc972b7da4c0dbab58c09eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 31.5MB
        • SHA256 12fd1017b10bbfcdff30a7942a3dac4d727a33c078b0e8d42009ea46c4f74ce2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 31.5MB
        • SHA256 49f6993bba3cb4ae3ed85424d900d0b548fff1d3308e57bd95c9fed8a212d5aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 31.7MB
        • SHA256 2863bf994df9c9e92f821e8aa3338c4de0b79d8db11eb577584e99c78c72a5d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 31.5MB
        • SHA256 170a8a1052d98a618949ef0ec166130ac996ce8c11a407f3cafee32881816e95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 31.5MB
        • SHA256 81874afe7ea03c736b1da0e4d2769cb4970075f19c1448264897f2062d41132e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 31.7MB
        • SHA256 299c5080342a126079d2d811af89617a8356746d4e5e6f915eb65b0bc6b37d53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 31.9MB
        • SHA256 a093c1965af93bc39918e9dc5eb813c8c0e23b44b4706844ed32e6ed23d3c5c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 31.5MB
        • SHA256 f6142d52820184e43d982f117dc508a5f12121cd4be23162c227a41e4ec7bae6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 31.5MB
        • SHA256 c13da0c616e1580fbc8706ac14e21cf4d39d712a9f3d4f76bf1d73da2d5c4ef7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 31.5MB
        • SHA256 8b2827ac1dac76eac9efd5f28d0258d3f3cf03c511279ea69072980add9e1662
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 31.5MB
        • SHA256 6976b6ef7ff461843456fb16943dd797adb616aeed8e8dfc180b4669a3d3021d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 31.5MB
        • SHA256 312f9137774ee379a79c24cc93e0aef2b65139a1f9b9b6d9d57541c847466308
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 31.5MB
        • SHA256 88f61dad6b9b496aea68c747e445c22f02787c3d6db4c0c37cee9b0a51ffe8cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 31.5MB
        • SHA256 d6af6ff87ddb597ddebfe7ec4335a18adf7b507dafded6661f737398191d79d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 31.5MB
        • SHA256 a4b7aabb02b087ed9a54a0c9a14d41819cb9b019f0e8d6a359766b3bb0fdb3f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 31.5MB
        • SHA256 8b069d849e9a49e3db2d0b1ed10acd6fbc016637867489be5cd35b5ecb09f9b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 31.5MB
        • SHA256 a361c079a66cf37c4705702b9ae36842ce1d60a3e1816257679059d6d40494d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 31.5MB
        • SHA256 7a539a75b761a27da7e4f02d2116fa004247989edbf32fcfe90636d60cf985db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 31.5MB
        • SHA256 a1911d0bf37e25c4bc2c3a3fde998d5dee212fe0eadbfea30362356f902b37ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 31.5MB
        • SHA256 ebb6fef22dea5ba34e2029e42f79669d7246016cc4f6ccb00b4ab8b97bd15a4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 31.5MB
        • SHA256 5b96b820d9cf20af462c10fe7fb38833763d19ac72f78f15ee1133e001a9749c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 31.5MB
        • SHA256 aae2312129d0cdd90e7c5d5bd6bc584b5177fda63d8c6a625add28e3b6d69467
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 31.5MB
        • SHA256 d5e368c941793964c9b739044f9bffc454d407555e1aabfd95b1e5d845886a05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 31.5MB
        • SHA256 ceb9186eac2a904e4f548d5f4876ae613c43b9585d9fa4599eb0942955d8c551
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 31.5MB
        • SHA256 1f79c003351495c6759735750ff7dd3216c0173fce7ebe929cc0a3a8d5bb4048
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 31.5MB
        • SHA256 4bd6c4a7ad8d5143bb6082d6c5468b83ea444a83affdf558cba0ffb096cc1f45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 31.5MB
        • SHA256 77bc49f6268fa630dde09fb4001343ca1a5cbb1cc6c7203c89e35ac402a18c1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 31.5MB
        • SHA256 5c8865838740e85fd7f9c9af909583a810e97235c92ff8e24e99868921f48779
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 31.5MB
        • SHA256 d429498cbb9a51849cb7c66e9c227d548c50f44e8ab8082a0242e0e32b2a63ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 31.5MB
        • SHA256 6f22a377adc3d9ca9fcfbbdc3fce24f88abf2381b99089f912ec551be4afcbb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 31.6MB
        • SHA256 57eb2d31bf4d05359056399afa96cbb84567bdea499160caa91be03fde7ff3d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 31.5MB
        • SHA256 de86b05165753431524d54ccee3286fd4d9de353338845730cd56fb711e15a4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 31.6MB
        • SHA256 1d272d154e858471176974527700ac451b6ac8938f1be4c09f4c46599e823a00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 31.6MB
        • SHA256 01c1f1f48f763af4f81d1ca76df7e9d216503bcf0f33c939002c82b09901d3d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 15.7MB
        • SHA256 f5e7accb2cbbe2de6ccdf531a4bb00e377a05b5a92b61c3867e95133f8d6966e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2216-31-0x0000000000830000-0x00000000008DF000-memory.dmp
        Download

        memory/3452-29-0x0000000000AA0000-0x0000000000B4F000-memory.dmp
        Download