Overview

overview

8

Static

static

3

2026-05-07...ar.exe

windows10-2004-x64

8

2026-05-07...ar.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    07/05/2026, 13:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-07_e5f66bf1fed42bbd5a48da95fe3d8def_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 15.7MB
  • Sample260507-qbcd2aas7k
  • SHA256 f5e7accb2cbbe2de6ccdf531a4bb00e377a05b5a92b61c3867e95133f8d6966e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_e5f66bf1fed42bbd5a48da95fe3d8def_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-07_e5f66bf1fed42bbd5a48da95fe3d8def_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3100
  • C:\Users\Admin\AppData\Local\Temp\2026-05-07_e5f66bf1fed42bbd5a48da95fe3d8def_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-05-07_e5f66bf1fed42bbd5a48da95fe3d8def_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1636

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 16.4MB
        • SHA256 409f884be4fa8b6fcea19a6ef1aa86a000fbafeef6381fb2fe40b60c5a14295e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 15.8MB
        • SHA256 1dd7cf2fc2ba0d8d38786a59fe54fdd8695696d3715566cbd6aaf2a1fcb38ad8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 37.5MB
        • SHA256 fd4753ef8eb464cda69ffa8ac99957cd2e01028e7c5a28da32591f24936c8a19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 33.2MB
        • SHA256 2f8911ab5c1fb239706d26a0134cdacd46d6d82ff0783f345728549ff15c7958
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 33.8MB
        • SHA256 0b741417153cb1c939fd430f5c2a5e856f402d3dcaaf36dccdbe91c702845ccc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 33.1MB
        • SHA256 d6f09001c91efbb5c0985d62861281380d9e5546d5efdf89f0d77371864aa3c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 33.3MB
        • SHA256 633b1a3c66dc9e34f109b9c085248251260874cefefaea89792a72bf54476ee4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 34.6MB
        • SHA256 4c97680aab29df4f4b68efdedb91a3a60738b2fb074f5961b9fe246a89af3e29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 32.9MB
        • SHA256 166607910236a28dee25fcc69ea02cd0626b9681760d414d9ff2a57b2e9321b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 31.5MB
        • SHA256 6b887b4d10694e3371beede0e41838f0625f710f038efa1e4e1e85f0cb6eb4b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 31.5MB
        • SHA256 d2547570458276d683969f33c9bf78ea515d1925e1bf7843355b371686c50f4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 31.5MB
        • SHA256 ea5bb79a117a58c926225d36221ca2094da046cfb9996ef9ac3ad237fe8238e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 31.5MB
        • SHA256 0107ee5cdecb0d335e901e2d27d7415fd490ec4e2e381f551dc0d6f7175ac961
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 31.5MB
        • SHA256 396d98355643887595af5b87e510fab52d5e4141d2dc300ab4e3237cf8f45df5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 31.5MB
        • SHA256 39c016399358c833d8635e361d827bd941255b2bcbc972b7da4c0dbab58c09eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 31.5MB
        • SHA256 a62b2635a0f2e35970ee8afa7f9b9b12a4b02a15fbd0b2a7ec50066c4cee70e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 31.8MB
        • SHA256 427251f5c5909033b15f99c067bd47999b8f6e1ad472c760eb53a32460c8b03e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 31.5MB
        • SHA256 12fd1017b10bbfcdff30a7942a3dac4d727a33c078b0e8d42009ea46c4f74ce2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 31.5MB
        • SHA256 49f6993bba3cb4ae3ed85424d900d0b548fff1d3308e57bd95c9fed8a212d5aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 31.7MB
        • SHA256 2863bf994df9c9e92f821e8aa3338c4de0b79d8db11eb577584e99c78c72a5d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 31.5MB
        • SHA256 170a8a1052d98a618949ef0ec166130ac996ce8c11a407f3cafee32881816e95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 31.5MB
        • SHA256 81874afe7ea03c736b1da0e4d2769cb4970075f19c1448264897f2062d41132e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 31.7MB
        • SHA256 299c5080342a126079d2d811af89617a8356746d4e5e6f915eb65b0bc6b37d53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 31.8MB
        • SHA256 297b7adc88a50f26e19cca113f8635ea18c363b93fbf6839f52aacdb0a541ab2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 31.9MB
        • SHA256 a093c1965af93bc39918e9dc5eb813c8c0e23b44b4706844ed32e6ed23d3c5c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 31.5MB
        • SHA256 f6142d52820184e43d982f117dc508a5f12121cd4be23162c227a41e4ec7bae6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 31.5MB
        • SHA256 c13da0c616e1580fbc8706ac14e21cf4d39d712a9f3d4f76bf1d73da2d5c4ef7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 31.5MB
        • SHA256 8b2827ac1dac76eac9efd5f28d0258d3f3cf03c511279ea69072980add9e1662
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 31.5MB
        • SHA256 6976b6ef7ff461843456fb16943dd797adb616aeed8e8dfc180b4669a3d3021d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 31.5MB
        • SHA256 312f9137774ee379a79c24cc93e0aef2b65139a1f9b9b6d9d57541c847466308
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 31.5MB
        • SHA256 88f61dad6b9b496aea68c747e445c22f02787c3d6db4c0c37cee9b0a51ffe8cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 31.5MB
        • SHA256 d6af6ff87ddb597ddebfe7ec4335a18adf7b507dafded6661f737398191d79d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 31.5MB
        • SHA256 a4b7aabb02b087ed9a54a0c9a14d41819cb9b019f0e8d6a359766b3bb0fdb3f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 31.5MB
        • SHA256 8b069d849e9a49e3db2d0b1ed10acd6fbc016637867489be5cd35b5ecb09f9b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 31.5MB
        • SHA256 a361c079a66cf37c4705702b9ae36842ce1d60a3e1816257679059d6d40494d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 31.5MB
        • SHA256 7a539a75b761a27da7e4f02d2116fa004247989edbf32fcfe90636d60cf985db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 31.5MB
        • SHA256 a1911d0bf37e25c4bc2c3a3fde998d5dee212fe0eadbfea30362356f902b37ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 31.5MB
        • SHA256 ebb6fef22dea5ba34e2029e42f79669d7246016cc4f6ccb00b4ab8b97bd15a4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 31.5MB
        • SHA256 5b96b820d9cf20af462c10fe7fb38833763d19ac72f78f15ee1133e001a9749c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 31.5MB
        • SHA256 aae2312129d0cdd90e7c5d5bd6bc584b5177fda63d8c6a625add28e3b6d69467
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 31.5MB
        • SHA256 d5e368c941793964c9b739044f9bffc454d407555e1aabfd95b1e5d845886a05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 31.5MB
        • SHA256 ceb9186eac2a904e4f548d5f4876ae613c43b9585d9fa4599eb0942955d8c551
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 31.5MB
        • SHA256 1f79c003351495c6759735750ff7dd3216c0173fce7ebe929cc0a3a8d5bb4048
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 31.5MB
        • SHA256 4bd6c4a7ad8d5143bb6082d6c5468b83ea444a83affdf558cba0ffb096cc1f45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 31.5MB
        • SHA256 77bc49f6268fa630dde09fb4001343ca1a5cbb1cc6c7203c89e35ac402a18c1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 31.5MB
        • SHA256 5c8865838740e85fd7f9c9af909583a810e97235c92ff8e24e99868921f48779
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 31.5MB
        • SHA256 d429498cbb9a51849cb7c66e9c227d548c50f44e8ab8082a0242e0e32b2a63ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 31.5MB
        • SHA256 6f22a377adc3d9ca9fcfbbdc3fce24f88abf2381b99089f912ec551be4afcbb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 31.5MB
        • SHA256 19a53f29f772c33a22828478f7ffc8ff39ec20c65eb4d3554a8172924e4b8e48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 31.5MB
        • SHA256 ff7bcc7038e536492f9af799ad0b5c9e24096e778966e3b34dec91a438d44ce7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 31.5MB
        • SHA256 5970608a50398626eb0fe67f9eb9bcbe4612662632ca43194f321e1de75eb89c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 31.5MB
        • SHA256 da4f8b837b1681b0e9c895a6c5993f8428b4cf89bffeeb450e5579047c881a04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 31.5MB
        • SHA256 ed13528b038be4fb28449074db2acf5cf2c7f8071a308a3fa318d243e0063470
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 31.5MB
        • SHA256 9dac934fecd6f1f8d4c9d9461b6c99c51c6643908ef710a378178cc5289b1fb1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 31.7MB
        • SHA256 bbc326193a4aa812b05d007e12bf4225c5df76e9f24981ecc335a417b587af90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 31.5MB
        • SHA256 fb42d3d053cf38d8e543eb46a02ffdbeda8fc8138468aec6d005684b6624b330
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 31.5MB
        • SHA256 f49e2d786f32f72bdf4597c78161f48a21111692a1689e774e803069cc90949f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 31.5MB
        • SHA256 ef61543ee5ebe6ffce04fb22fe37403a3ce7de167119568cedd7c2ece1b14a14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 15.9MB
        • SHA256 efb2a02e2dade2d13a1e67a657afcd6199cbf331ddd5a6894e4c3485a97b506e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 15.8MB
        • SHA256 65054b80628584edc5240ef86c0bd104c01efed0c70ea1550b91f5eb1bd470d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 31.6MB
        • SHA256 1d272d154e858471176974527700ac451b6ac8938f1be4c09f4c46599e823a00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 15.7MB
        • SHA256 f5e7accb2cbbe2de6ccdf531a4bb00e377a05b5a92b61c3867e95133f8d6966e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1636-127-0x0000000000A30000-0x0000000000B0F000-memory.dmp
        Download

        memory/3100-85-0x0000000000B70000-0x0000000000C4F000-memory.dmp
        Download