Overview

overview

8

Static

static

3

2026-05-25...ar.exe

windows10-2004-x64

8

2026-05-25...ar.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    97s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    25/05/2026, 11:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-25_0dd0267bc3e947cf908b5f42c5953df3_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 14.9MB
  • Sample260525-nbq63set7r
  • SHA256 a6839fcb49d4fb2da3c3816695fb79e83ed0ca513a9e5d19078179042c7a1a4a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-25_0dd0267bc3e947cf908b5f42c5953df3_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-25_0dd0267bc3e947cf908b5f42c5953df3_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1916
  • C:\Users\Admin\AppData\Local\Temp\2026-05-25_0dd0267bc3e947cf908b5f42c5953df3_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-05-25_0dd0267bc3e947cf908b5f42c5953df3_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3536

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 30.3MB
        • SHA256 654139336522f403fcd3b604a8ee3abd7e6733573258d20365fd6e5623b754dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 30.7MB
        • SHA256 41a19949ba13f3e1919d609f775a3ebb856fe504918a87134ab039569f5838b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 30.4MB
        • SHA256 816968e2f8ff20f89841805d7dd2a6115a4f1539a11f90b05385fbb8dcf0b6fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 29.8MB
        • SHA256 381a1fd0129c0d327f981e77dadec9ae7c6111924402915ce887ebf952b47e7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 30.0MB
        • SHA256 96afd14ac4bc61581d42bc1efbd5772df8c75020125af6d63ff6aa117678d72b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 29.8MB
        • SHA256 ca41c4027c6b04663e9c9dce5574e4f316b4d1ce53980f086107eab0e00e2567
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 33.8MB
        • SHA256 1eb929a187c6d6a69d6f0fc15f7cd1f871d963ce5c65847fe1efa101947b2852
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 30.1MB
        • SHA256 66d014ac7713c04db7c990b5f5018a5f731a5e59cca8e1bc4cbc223383f8e532
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 31.9MB
        • SHA256 1cb0a16824494ba5fd96918ad23fbf4183e129297d801730d4cdc1de180d21c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 29.8MB
        • SHA256 657c81546e60301676d0ba4836c140dd03648494316fcdc36cf8119a7048b337
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 31.5MB
        • SHA256 2415fe49a22a547fe130774ac3a2584e7ba0b2ff3ae456ec97d990bfb2f43e25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 33.2MB
        • SHA256 cbd6dd6cfd2324fbe0779bcdadf7c7af86ecaa3796bfef21ff441fa37bc66cb8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 32.0MB
        • SHA256 46af3e3be540a0a8dc0c43914205d41de1fe36ac0b60fada4be1a970ef0cd36a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 31.4MB
        • SHA256 46d104deb334f8a9c634ce8244d114504bca82933aa33ecaed3564a9201e48c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 31.6MB
        • SHA256 11033bbc2f179bbbfa1b7aaf492ad5fe2247a033bf6d35e537cc2c6c6900d89c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 32.8MB
        • SHA256 1f746545a59b42bf466b19bfaba72338eb09a9f06d4d9231682311b362203393
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 31.2MB
        • SHA256 aadb583daa7c5d99dacd3caf58d4b5e07d78786770f4d7b65127c64409c2b02d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 29.8MB
        • SHA256 93da5a1055cca7721d6022c00c8bdf4c39ee979d691d0dc0af6f0981cfcbf32d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 29.8MB
        • SHA256 8c6300f7a5c28dd858187bc5dec90e8cc749794c37c373faed0f2abbe2a7f59b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 29.8MB
        • SHA256 17e63a4c7f0fcb5d8bde7ac7140e004abc67c92aa24472e599f5f56987dae7a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 29.8MB
        • SHA256 9121ae60a43133cfa093fd5e14b68e729400fe6579e7aabae4f5a38e50b5bdeb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 29.8MB
        • SHA256 979060584ee26157bae46845d18c788abc2e16bb5c53be80b8a446b2dc06fc8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 29.8MB
        • SHA256 84a8cbc4a1d9ee4af03993d8a96ff9b77aaa700c2886312a217884c84957de4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 29.8MB
        • SHA256 11628ad4d283b353bff9186aad85412382113f867313d9cc3c5e85d24236ddc8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 30.0MB
        • SHA256 113318469e645f0f528992918fca8ea6d155ad3297e5aec811fcf61126ad42ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 29.8MB
        • SHA256 25863ff4f9ea18e6e4e2e0a17d365d92f350785348bcf154648a28ecff6809ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 29.8MB
        • SHA256 8237bc7b9c152a3102d92967c95c6a2983c682485328b459a3fb70084a67355b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 29.9MB
        • SHA256 a7b1ed4ed37358f037651c4a01e4faf46715763f67605cbeef546ef1f4b2e908
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 29.8MB
        • SHA256 426f6446beec690556729b6dd41fecb689bd340ce6f224fd19ab64ec8f421390
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 29.9MB
        • SHA256 2c967a0439968a7322de53fa1ba2ccebfae04ddb1005e60f47ae44b951d7f2f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 30.0MB
        • SHA256 c703c40044f471f9b86f73dcfde31340cfa1629ec037344c326160114cda425d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 30.2MB
        • SHA256 b3aa675c85a8eb1849e85f81b564b4a5c22a4045c553c728036a4a12fc09a441
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 29.8MB
        • SHA256 d202222609e0e2c215f46cd2d99b17aa1c6a3f38e7bde0d5e3388f6233eaffb9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 29.8MB
        • SHA256 7b91e6d75d79e4e40dcb966f2d862c6acfe798d317b7c24b0b0fda3e90bbd121
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 29.8MB
        • SHA256 a86ca9f5ab2b157c4ee988023fa8d58487a42e7de9bf0c6606b09011927d6b8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 29.8MB
        • SHA256 a9a67cf59fcb39e5b9225ac6ec4bddfa9c6b8605b508d5d16311b2a509795d0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 29.8MB
        • SHA256 7898dd179b1b5fcdd6c7765724d39a3b6e7eae7a84cd3d9e08bf50bef5b12d84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 29.8MB
        • SHA256 e0801207c89f8176236565dfaa9e172686c9ffeb2c50c1a903ad9a3d3adfadcc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 29.8MB
        • SHA256 ae226e95c3a1488a6cd2fb5b739b596e1851b7fd2db81731cd5e68a8c342094c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 29.8MB
        • SHA256 92c02067a3a197d94c613fec23d563399e511d6a36d231c8f29e3e9764524b09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 29.8MB
        • SHA256 b8507b6716b5815029f8885718dc7c9911200aca8b2cdd96486650b1e6705c3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 29.8MB
        • SHA256 2211d73f62a6c2261da943e25e77408241ac5c632a6c9107dc78a78a818a2164
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 29.8MB
        • SHA256 f1389564be999bbc0598d4091d1f6785c70f0c75a6be0ac83b86adf5245ca6b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 29.8MB
        • SHA256 dce7918388dfbeab0ec1f9818912320f5cd34d7f970b6094e9b25a9dc7a12a9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 29.8MB
        • SHA256 1ba0f0adbb8c31d07aae5d873a70ce75ad7031a2ba4e7d424cf38b660a26c451
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 29.8MB
        • SHA256 f25c84e6fb82683403dde8660c248a76b39c8c84d8691c91a852489d1648a307
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 29.8MB
        • SHA256 1fc1f2aeedbac501c03284b4e114e0cd2e93edb3f8821e78b25d0bcda07db79d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 29.8MB
        • SHA256 aa8a6464144a264e30428b2c3fd5975897e0479ebef41fcbe46cc49315c8de7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 29.8MB
        • SHA256 e2748fe4de3c1e8557b58fc82f00f9adb88fb3b69a70b753a6af0107e36ed9dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 29.8MB
        • SHA256 ad81bb1f968ca4a2ed59855338ab8ef49782249714695b1fee574075f8a2bee4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 29.8MB
        • SHA256 085147e5bffdb17df6dc1c09bda122943c699bf446484f01598fd1146358f309
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 29.8MB
        • SHA256 7d7334c87e5b2872491de8143d0271f4ce4baede7f7e284c4dc4455fc80311e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 29.8MB
        • SHA256 952452b148c14443f120ac929f5165822da5373af0e66adb4504f8cbbb09f3a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 29.8MB
        • SHA256 248d7ccebd90907e26d0bbe6184d2ffd17f7d112b724c58c0216a86e7698b8a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 29.9MB
        • SHA256 5b1b12759a45a13c488acef9d763920e3eb9f970303de851ff7589bc346ab174
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 29.8MB
        • SHA256 53725d57ee7f084261a0fb7490445432ef49f92cbf0b62cc5fa85623304ee57a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 29.8MB
        • SHA256 856a36f43fa78470bb090aee75f1b9c6db1d8860d2b9f16e33e1a20d116d5e8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 14.9MB
        • SHA256 a6839fcb49d4fb2da3c3816695fb79e83ed0ca513a9e5d19078179042c7a1a4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download