Overview

overview

8

Static

static

3

2026-05-17...ar.exe

windows10-2004-x64

8

2026-05-17...ar.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    17/05/2026, 03:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-17_53f040d6da4b020e55970aa14939aa56_akira_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
  • Size 19.2MB
  • Sample260517-ee36dab17z
  • SHA256 864f31a34ec9975c7a0093464b4535e9daca381db22e88d56f9c8294febe096e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-17_53f040d6da4b020e55970aa14939aa56_akira_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-17_53f040d6da4b020e55970aa14939aa56_akira_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3560
  • C:\Users\Admin\AppData\Local\Temp\2026-05-17_53f040d6da4b020e55970aa14939aa56_akira_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-05-17_53f040d6da4b020e55970aa14939aa56_akira_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4536

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 19.9MB
        • SHA256 a6e819e97e09af188bfd20812b20e563fa98a2bb971c783ed40ffa9b5305ee5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 23.3MB
        • SHA256 28683f6b86760659f36120727df5db54334cf63a828eba41d2483396cd449393
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 19.6MB
        • SHA256 14b37c1121bbfa937e716927c5eb63e684e20e39074d35f8135394b9743cbe8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 42.7MB
        • SHA256 ae34be9eb0a0942c6e69201770a6463e8a7cc0a673926d8ffd8c63b5521449c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 19.3MB
        • SHA256 5a2fefe81e9313bbf62f90ec970d7676bac3061d43f414bbaecad98807678381
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 44.5MB
        • SHA256 b1dad2f16edb335ee52d4d65fd27287a5abf2894405a49afe1a60125289da6ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 40.2MB
        • SHA256 d755264c1d4b0ac53d81ec8a618e3f9703bc7c6183f6953e9c5f25b888ddb1f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 41.9MB
        • SHA256 09502c68b4211d4e500d29544c92089c6521c685fd3e6a00fede1433c3cebcff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 40.7MB
        • SHA256 fae6e50a33565847c163eeacd9ed80a3c24440fda995ea18b6fc3a307c74decb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 40.1MB
        • SHA256 3924e6a43fc793921a210da9b59aa7374b8000f5ab62b63ca4cc9ff6c7c2db72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 40.3MB
        • SHA256 25cdfe76a8d6be927b734df7bc1026edca9ca42da75fa8fffa9dca6109996ad1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 41.5MB
        • SHA256 5b573be5e93fb855f92f8bc129f1b06157502bedde53bc751e5003ed33f81c1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 38.5MB
        • SHA256 c7b29c0652fc5a608eac11d192e430f1af69ef3ad9a102d481332641bdf18980
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 38.5MB
        • SHA256 1156e201d951dd0753a48dbc2be64fb22481ae251caee805c5289e3c719c030c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 38.5MB
        • SHA256 9af912c1cd5da4ca2f548b48eac86dcb983640a9ff75b7c7a3f0804ddd916b5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 38.5MB
        • SHA256 8c795eb668bb83d491ef751ad639432c9c0e0f3b7db2b64ef9842394cfbade8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 38.5MB
        • SHA256 e7f47744590031bb3f0c8b3444eb8d8b8649987dcd7c05a3e957ba1fa66a9dbd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 38.7MB
        • SHA256 a64dd546f4caaadc1548cbb9db46e9e23d485569de586d1a9b0e97228dece42d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 38.5MB
        • SHA256 a4926104fcd995438b804260573df701d9c318e723457fff9eb1e441a9820092
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 38.5MB
        • SHA256 ca36945ad4ad53ada23f466961b9b7b2ab579431f14eacb41c0f962a35c5d9e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 38.5MB
        • SHA256 0181085f806b1c650a68fa0a0f015de381768ea6690ca7d58864e8980f0a82f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 38.5MB
        • SHA256 b4e1da282a1491652f1fda58095dfc362a80d2fb6fc6075d871d53b84ebfa6f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 38.6MB
        • SHA256 97623b6b5deaa9d7e44feeeb48ab1c372f097ebebcf9f9e3aeb690069d2f7f8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 38.7MB
        • SHA256 7ef84e78e92848c00c9e36510402cb4b6ec88c23925be71f9f0784b790d00ae4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 38.9MB
        • SHA256 04daf562f272b56641154d7e28843b7d55eb68ecf1e7b36d26ce2c7e437f245d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 38.5MB
        • SHA256 0926a8b8a928d62110c881f31101e0f51bdb3b4e35a4531ccc19cae9e65be938
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 38.5MB
        • SHA256 a5cb29cca903b1f244d795b27a9d3b45ccd478919fbc64f044ccd4bd46228a9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 38.5MB
        • SHA256 8b1b562c8e6ecd2ca0b1e8bc89c93ccd2c172cb3d2db563a4d179fa97e8754a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 38.5MB
        • SHA256 0046da9cbdc2a0291e86f17b39247a9294bbe35db42b0dcad97ff512378ddf62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 38.5MB
        • SHA256 c4ed8713cd565064d5eb6746db45ce8968338d813035a800656faa610ae38f14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 38.5MB
        • SHA256 080d1c941fe9db77f7c4b670be40b22c5f081daeae6ed3b45d26a4d1700a68c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 38.5MB
        • SHA256 a8a7661bc0aa026b125e405d81ea994a7bacf5d0e383e1beac144210b3e270a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 38.5MB
        • SHA256 686fec5f148def046dbd49a4c093f2978a7be50e715261fb29bed00860ba9565
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 38.5MB
        • SHA256 640f82214d8b9481b0fc1b1e4c33e4b727bdf7a1584ae7736d3962ea72bd4992
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 38.5MB
        • SHA256 3e33f10ca758db8a0014603d2f76ddd820230d8e505673b3f51b7a145c8faa3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 38.5MB
        • SHA256 15fceaaadb773849b4bf3c5718fd8fe8cc98a45ad798765bcb25dc9454efd7d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 38.5MB
        • SHA256 57aa4886518b94b923d492c2a0d69b411014fd061cb7c66f94524d1c3e9a6425
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 38.5MB
        • SHA256 a7d32cec396f7ab3cffe330fdf01d87c77e1e8111c67f218b92009a46038dae0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 38.5MB
        • SHA256 9b608258e03f66fe5b5fa2f2c7034059f81726edfb94cbc52a3ceff5a875d9f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 38.5MB
        • SHA256 c85fcf23c247a0407d1810e7691c3c2db6277660fa3a0d58999572b622f0235a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 38.5MB
        • SHA256 ab653112aa04fc2926bf2412f2e7807d058d35e85b61efcc9395ebd597e6ad8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 38.5MB
        • SHA256 d79ce023de571491d59ad5a96a5146616d0bd2b33cd7595735343792cd3148ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 38.5MB
        • SHA256 c8bb1622e708db7b2ac444ce2bf694c9602e25d78df67fd17da1c897f7aa3fc9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 38.5MB
        • SHA256 4898487c12b9e17880225ab251f9de32a0ad5abfe53663b90492895274631aa8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 31.8MB
        • SHA256 dc6efa3ea8695d39860e745f2ba3d074bd530197fee00da8c99cf75874c72fc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 20.0MB
        • SHA256 ce5864bc7933e7308d71fafd10c6d35df7316f11e6c0596a6fdd8f83fdebb24c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 26.4MB
        • SHA256 1890235f9f971fb62e34c68ba9fcb8b5145e151f7193dd66e5f02b07e5354330
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 21.8MB
        • SHA256 277bcb6c0ba9e2ab0cd8c6e75c0820b30e54f8badec10bbea552175d1262c6a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 17.8MB
        • SHA256 de96d517456123e39b35ca4e651ea4207d7b642d90bc0abef60cf858b2687a01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 2.2MB
        • SHA256 e56141a33465c2d883249b90a455151355bb09b7edcecdc9366f2fde05323e64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 38.5MB
        • SHA256 aeb99260d97f5609092b3938c0f28ed624e76a4080b0186cc3bf4b848ab32d12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 38.5MB
        • SHA256 ad82c450e4547fa8711a87c0029858a4fe792c10694318562cc4998e1cb5aa88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 38.5MB
        • SHA256 8095ef5cf184d0cb4b905005e1ba025d77c93084b2fe04da18646a079ac204b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 19.2MB
        • SHA256 864f31a34ec9975c7a0093464b4535e9daca381db22e88d56f9c8294febe096e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download