Overview

overview

8

Static

static

3

2026-05-22...ar.exe

windows10-2004-x64

8

2026-05-22...ar.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    148s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    22/05/2026, 16:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-22_e5f028e1bd79786102ef2ea67e8062fa_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 12.0MB
  • Sample260522-vctrxsc12z
  • SHA256 2722a2d8f8086cc72b993cf8eef38834a1480c5e2dfc7dc3ccd09d2599c55fc9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-22_e5f028e1bd79786102ef2ea67e8062fa_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-22_e5f028e1bd79786102ef2ea67e8062fa_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5320
  • C:\Users\Admin\AppData\Local\Temp\2026-05-22_e5f028e1bd79786102ef2ea67e8062fa_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-05-22_e5f028e1bd79786102ef2ea67e8062fa_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1664

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 12.5MB
        • SHA256 e6be7d4c9df08b03dc6b2545900514a8a4d6e3e8d3c55df15a00b8da31f90dcf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 12.7MB
        • SHA256 413b151e15e6175ea69ee12d7e36dcf4cf06f42181934f1058e6d4576e0ce9d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 24.2MB
        • SHA256 72e6f266da0cb63e372c40ab5dabebf5de6b83477b204792022bd4671282b056
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 24.0MB
        • SHA256 fd6554f3eedf4318dec4d45cbc9f65187c699bf6342b322ad8c88d54fda9759e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 24.3MB
        • SHA256 42b72b594308ceeb2c1bc0fa1aa7a91a9392fb27f17f7b08c178219efb14debe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 24.0MB
        • SHA256 fe5b0a778561b0922a212c2e6d95be9417a2aa37f64446985bb01d23f14f3acb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 30.0MB
        • SHA256 cead668df48cffca987e3b182eced3dc581bba02cfbcee21dbccb7a433dce021
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 25.7MB
        • SHA256 4abcb40e815a3d0db717e7e6fc6488ac1cdef711819cbe0dcb567874a7726e02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 26.2MB
        • SHA256 070b5a7c0774741a2bae1d1378d35f494ade2874b019552553249b43c5c1075c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 25.6MB
        • SHA256 86514b8c9f5936db0a7afa4a0e65ba381631925f24ffb559b48d9e8abdb27430
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 25.8MB
        • SHA256 e96a6fed7758e6a027b8b0ea7296d381544e97085d38b36b7e8974ea82df5f2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 27.0MB
        • SHA256 6692df262c70c24a977fc61dc1f3ac64dcc9c6aa3d1ea5443571842dbe81f483
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 25.4MB
        • SHA256 4ee90fb1520b61b7db41fb732729f22005052a922a3c8708d76580ec9f823b33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 24.0MB
        • SHA256 d7c39c272e23b5d58b211ee6c2446763895c8c27af66b6541e8e407db7d3dd84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 24.0MB
        • SHA256 c8bc71a7b73015483f2a7fea5fc6508f99a162993c8a3485e728c644a568504c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 24.0MB
        • SHA256 5ec3585b3f32c2ea0bf3d79e2f722b1deec6637fdee3ad97df9fded39931fba3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 24.0MB
        • SHA256 5dbc6b9a4a935f4b6b6c2835b6688cbde80dbe2b9bc7443c044deccfe0e42b3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 12.0MB
        • SHA256 5382f1857305f7a48e088fb67501d83d96c545faf14d411af82d9dcc42021b78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 24.0MB
        • SHA256 e18b8e5cfb8a76a58ae8eec40160e576f0a43309b9450f0fcfe29206aa2b2fee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 24.0MB
        • SHA256 b1aca2e4a13b7244a83526305dd473b44c9708ac184214990afe508f0d30405a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 24.2MB
        • SHA256 a641232c873992e04603be63cbe758405f4b9c2e15beb2389b178604393a31f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 24.0MB
        • SHA256 2e7a68fa650737ff9e4e057e7ed42c2419667ceab325e922183436542851aa90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 24.0MB
        • SHA256 f92f682a31fecb8c67a6e3faef506582f4b83ab45b4dd85c326bd43bd25f85f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 24.1MB
        • SHA256 8d868d03ab0ccbf40f65b78e6107c58b6e221332ca5be8653b1919c36abc1d99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 24.0MB
        • SHA256 cf03d8d029da052950a8dfc7f63fa9d49457966cfa5f3891a31ac910d56f8d11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 24.0MB
        • SHA256 abc60f6c7e46653620bc4d1b7547fc1c065b3a5bb248a99a290daaab3e7adfe5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 24.1MB
        • SHA256 99966d906fb25eeef24e90089412b4a907a5644f2fa297f90a7edccdc05d4d61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 24.2MB
        • SHA256 eaa7c5aa89f5252d3dd0e5401d4c77c668305eb4016e670db7b288fe027159f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 24.4MB
        • SHA256 d142edb436ec372ff4405b4b1b744a664f43d0882f33a205562ee751ff57c6a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 24.0MB
        • SHA256 71558c76be73645f6b1784b65ffc73333b846675b232dcd7c27962ed36f81761
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 24.0MB
        • SHA256 f7d86f5d3e025ff28d55345d620c8f46b9d2e21d8ee7bee84936f41dc71462e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 24.0MB
        • SHA256 e92eeada4ee147b2eb8b577f9460a30e1b160b5d658f57422c4e436d091e11a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 24.0MB
        • SHA256 d60c7ac613401120ecbba1959f8398e77b0471d33aded29a9b1a185c41178dcc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 24.0MB
        • SHA256 2126bd8eed90c098650bc6267154e9f6a3b2ed1fe00457906188bc5e738bbd2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 24.0MB
        • SHA256 a2e4f395f790b252380a5943a26c5a38446aeec5dbe54c41d9657631e454d03a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 24.0MB
        • SHA256 68b0155fcfde7224e7146ffa32834f61b79e1f11811637b1d09567baa1c267ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 24.0MB
        • SHA256 c7c713e406eccd3e5c42ccfb3fbe016cee5ec03cdf3193dd38bbd21729481425
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 24.0MB
        • SHA256 4e4d223643911906da3af4ff9ebf25f26b3fc24f91f1660d440cb80a9c9f4556
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 24.0MB
        • SHA256 56b2c875acc4bd97c1f368e8a28e51255e20cb5c1afab1a09e5d0ff21a51b3d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 24.0MB
        • SHA256 6048d4db2b50c40b45142a15b07d6c5f3c859a4b8e7e53a813d6917fb86173fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 24.0MB
        • SHA256 e89368501a6d4567b450e3b7a9d38b4ec49027727a2f9563124e8a91854a1676
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 24.0MB
        • SHA256 2001ae09bf1b074de98eefeb1cbaf857f9637137c11ebfe58a75f9fbaa65fff5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 24.0MB
        • SHA256 1bf5825a2ce1219d8fdbbe441bfe2b10b5666643be355dec09e1296226a15cd5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 24.0MB
        • SHA256 9309ee32196d971e79bd304869540fff68f8d4c2ff04f154d9c8dc0ac0bc00ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 24.0MB
        • SHA256 dac1a126d5de5f7cf75832231e2f4d8f31e51e89f15e5fd37e2e8067e08a3909
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 24.0MB
        • SHA256 72f491831e87646cde702d665637ca48b75daa037d43bdb2dba238724413fba1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 24.0MB
        • SHA256 730633dfd113de6806bedad96a4c03e4cdc820ab0238bb496494da7a9d835b68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 24.0MB
        • SHA256 32a88bbe9f06cfba077446470d6f8b95dbbd8ba45205d82ad7057af21ef3e4d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 24.0MB
        • SHA256 67ad96ffc9af3443e1fffe17aa2546b8b3adeeee1792abf82cace38774361e90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 24.0MB
        • SHA256 194d0b9baceb32342ae6e3d4127a28c913e9cc38aa84ac0303ce5c5251bfac0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 24.0MB
        • SHA256 2dd76f384212987925e44a507ac995e14f989df15dff5f10680c45c47c093e79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 24.0MB
        • SHA256 704fdf03d06d60ea1fe58dd063297995c1d679c121ea76ebacc15fb8d8fb42db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 24.0MB
        • SHA256 0796cadf9ac4d9e2a613033ccc93ca3f9e28a5a1a6dcca26ac593066e779997e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 24.0MB
        • SHA256 eb78c99e1f2e98380b59839fc9331ab75eed701ccf481dfeab99b00d18978cda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 24.0MB
        • SHA256 985a35106846bf999380824898fc54385f402df866daf088589317e18069ed36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 24.0MB
        • SHA256 ec663906686cfdc41ee32f3912a5ad3711a5509fb0394a0e046fe33724b3f870
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 12.0MB
        • SHA256 2722a2d8f8086cc72b993cf8eef38834a1480c5e2dfc7dc3ccd09d2599c55fc9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1664-74-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5320-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5320-29-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download