Overview

overview

8

Static

static

3

2026-05-17...ar.exe

windows10-2004-x64

8

2026-05-17...ar.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    17/05/2026, 03:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-17_53f040d6da4b020e55970aa14939aa56_akira_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
  • Size 19.2MB
  • Sample260517-ee36dab17z
  • SHA256 864f31a34ec9975c7a0093464b4535e9daca381db22e88d56f9c8294febe096e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-17_53f040d6da4b020e55970aa14939aa56_akira_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-17_53f040d6da4b020e55970aa14939aa56_akira_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3616
  • C:\Users\Admin\AppData\Local\Temp\2026-05-17_53f040d6da4b020e55970aa14939aa56_akira_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-05-17_53f040d6da4b020e55970aa14939aa56_akira_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3564

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 19.9MB
        • SHA256 a6e819e97e09af188bfd20812b20e563fa98a2bb971c783ed40ffa9b5305ee5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 44.5MB
        • SHA256 b1dad2f16edb335ee52d4d65fd27287a5abf2894405a49afe1a60125289da6ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 40.2MB
        • SHA256 d755264c1d4b0ac53d81ec8a618e3f9703bc7c6183f6953e9c5f25b888ddb1f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 41.9MB
        • SHA256 09502c68b4211d4e500d29544c92089c6521c685fd3e6a00fede1433c3cebcff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 40.7MB
        • SHA256 fae6e50a33565847c163eeacd9ed80a3c24440fda995ea18b6fc3a307c74decb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 40.1MB
        • SHA256 3924e6a43fc793921a210da9b59aa7374b8000f5ab62b63ca4cc9ff6c7c2db72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 40.3MB
        • SHA256 25cdfe76a8d6be927b734df7bc1026edca9ca42da75fa8fffa9dca6109996ad1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 41.5MB
        • SHA256 5b573be5e93fb855f92f8bc129f1b06157502bedde53bc751e5003ed33f81c1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 39.9MB
        • SHA256 b05db04183dcd464215496a8231994ea6fefff2cec2941c0f528ea7c16fd4fcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 38.5MB
        • SHA256 c7b29c0652fc5a608eac11d192e430f1af69ef3ad9a102d481332641bdf18980
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 38.5MB
        • SHA256 65f9afcb277979cc0253b2c0faa097eb273508f26915aff6c9fd7eeb8eab3210
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 38.5MB
        • SHA256 1156e201d951dd0753a48dbc2be64fb22481ae251caee805c5289e3c719c030c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 38.5MB
        • SHA256 9af912c1cd5da4ca2f548b48eac86dcb983640a9ff75b7c7a3f0804ddd916b5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 38.5MB
        • SHA256 8c795eb668bb83d491ef751ad639432c9c0e0f3b7db2b64ef9842394cfbade8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 38.5MB
        • SHA256 0926a8b8a928d62110c881f31101e0f51bdb3b4e35a4531ccc19cae9e65be938
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 38.5MB
        • SHA256 8b1b562c8e6ecd2ca0b1e8bc89c93ccd2c172cb3d2db563a4d179fa97e8754a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 38.5MB
        • SHA256 c4ed8713cd565064d5eb6746db45ce8968338d813035a800656faa610ae38f14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 38.5MB
        • SHA256 080d1c941fe9db77f7c4b670be40b22c5f081daeae6ed3b45d26a4d1700a68c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 38.5MB
        • SHA256 a8a7661bc0aa026b125e405d81ea994a7bacf5d0e383e1beac144210b3e270a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 38.5MB
        • SHA256 686fec5f148def046dbd49a4c093f2978a7be50e715261fb29bed00860ba9565
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 38.5MB
        • SHA256 15fceaaadb773849b4bf3c5718fd8fe8cc98a45ad798765bcb25dc9454efd7d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 38.5MB
        • SHA256 a7d32cec396f7ab3cffe330fdf01d87c77e1e8111c67f218b92009a46038dae0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 38.5MB
        • SHA256 4898487c12b9e17880225ab251f9de32a0ad5abfe53663b90492895274631aa8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 38.5MB
        • SHA256 6726f2d9adb8910df41021c0cc9924e658b0835e197d7f9f9a22e7bfb8ed417a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 38.5MB
        • SHA256 9689a339cf515adc5d8a90c6ee5de93faeacb64aacc56b361ac90f27ec0a561d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 38.5MB
        • SHA256 3c47be9a0b84a511cea202cf3829f16464d519df0781d3ae9c37719f0d1a153e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 38.5MB
        • SHA256 fcfded8ea1e978bfb29cb6b1a399ba5017d517da748fe8fd336940eb0a2b67c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 38.5MB
        • SHA256 a77887b2f971a2fe505a2a4c2709699a3ac9d354a192c67e3f252b11353e9b65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 38.5MB
        • SHA256 3cfd75ae19a795874671150bf989442a131b81cac11cf33f6a9c52d74737946d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 38.5MB
        • SHA256 4277d5f47d4eb3dd0b8c096a98f3ca3acb0e6fe5d78dfef8dea621fd90a290e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 38.7MB
        • SHA256 6ecddf912d5bd767f8e6db96e71d899a38de88190879a842b966c8c0a7f08bdc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 38.5MB
        • SHA256 139f3a86e3b146aa86ae98f0f717c012d6be7c356a16009246ef60767e9c1b14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 19.3MB
        • SHA256 b6142353b1877ef3095f47a1c88e6d096e1b33edee0c47b7d0b6c1daf3c28e88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 19.3MB
        • SHA256 0cc2898c3fc0af9e483fb599705f52385909ef5aeaea0f6dfb0d88d3012cbf19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 19.2MB
        • SHA256 864f31a34ec9975c7a0093464b4535e9daca381db22e88d56f9c8294febe096e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download