Overview

overview

8

Static

static

3

2026-06-02...ar.exe

windows10-2004-x64

8

2026-06-02...ar.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    146s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    02/06/2026, 15:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-02_2db87532e1ca2761fac7300e0f1d556a_akira_cobalt-strike_elex_emotet_remcos_vidar.exe
  • Size 7.2MB
  • Sample260602-sdt3zagt5t
  • SHA256 1ba63a85ad68f5eded369a0358e1c77c4b69b4019ec418db77021853cac1a49b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-02_2db87532e1ca2761fac7300e0f1d556a_akira_cobalt-strike_elex_emotet_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-02_2db87532e1ca2761fac7300e0f1d556a_akira_cobalt-strike_elex_emotet_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3444
  • C:\Users\Admin\AppData\Local\Temp\2026-06-02_2db87532e1ca2761fac7300e0f1d556a_akira_cobalt-strike_elex_emotet_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-02_2db87532e1ca2761fac7300e0f1d556a_akira_cobalt-strike_elex_emotet_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1916

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 14.9MB
        • SHA256 13511da20c6cf561aee81c6095455a345a6a810b795056eb9bab25fea6d1835b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 15.3MB
        • SHA256 d484b4bc2e68496bcd5b3eecd1275d0181f99fd7c68f111c22705594e1877001
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 15.0MB
        • SHA256 b33dd0873e565d9da8fc2311197ecccf4b7458c6c0a212c7606251e778f95750
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 14.4MB
        • SHA256 7f54a787b29f3778066c2bc63d14698983821f19807a68e92f9631509624711b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 7.4MB
        • SHA256 2850230eeee1cd7084ab9b57ba6d93c528fc00f151a7fdd6d002964ef1682328
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 14.4MB
        • SHA256 7e6c2799bd9e0c1fd07ff43a4e0c0d2cc044aa0f30c9a039ae2b135bfb182ff8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 18.4MB
        • SHA256 f12321f1bec01fe70f5e9536e4528b6ea729bc2e08a1d8ec54db375a49a6ff47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 14.7MB
        • SHA256 91bb9696cee15975ed2ff36a01f85f9ff993fb6181dc2a2168e5fd25f46f6212
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 37.8MB
        • SHA256 4a1d2defa0d7f68b289169a5969915d5fba5b977a0fb4b26720bbd1c01881df1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 16.5MB
        • SHA256 4da999e9ce821da97a962192d5cd455721d24e33dab28f761c5f98aad3ea8552
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 14.4MB
        • SHA256 a14b343aaf236870a9982c91d64f1b0fc7acd9b9ef7c69def87aa17c1d08728a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 20.4MB
        • SHA256 d3a81f42c3b62795dc9f6a0bf44e9b752a44b2bbc60ba0616c1053de3a86676c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 16.1MB
        • SHA256 75f0256c71aa02a6eaf9f932ae8262b145a3f4e9cd5445fde75ed346d599af8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 17.8MB
        • SHA256 5fdd4603d5824eca1329bbdbb4f92d240f4563dc47fc8ce079df181b4bc1c265
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 16.6MB
        • SHA256 2991d046e01a60daaf19c8fc9f34cfae709c4d01e6b8754d0deb4576d1ec9252
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 16.2MB
        • SHA256 50baa002bc58f0ad6e7571eafb286a5130a8729be0b4ce07c3375784a6141781
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 17.4MB
        • SHA256 66b4fb954daeb7ce8593d4b9ee1b97c0dbf76fdc0dce58656f49d5be60e521be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 15.8MB
        • SHA256 b4a082bb8b127ee01652089dca2b2270df5bd63971f0c345b55042343e25c2cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 14.4MB
        • SHA256 d5993389a598a35629779be135d979d5c9a8808c86d02f83bcf698d3327bafa7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 14.4MB
        • SHA256 51b3331cbfeaf315ab9e8cadfeb83935bf7df461fd1b572c74070e79191c8362
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 14.4MB
        • SHA256 717e34b24dea9346bc132e456c054019ce223d00489dc1ce7f6829d0a110e697
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 14.4MB
        • SHA256 7e41b6ef332defedd30a070ab3363c73f049cb3799afd2848f35cf634019449b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 14.4MB
        • SHA256 659148ff887f422cd75deec0258b7b44f8e753465ce0c284646f97b4dfdd568a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 7.2MB
        • SHA256 8766e682f7076f3d2985106703c2cbff15ffcb057a157aa7ab8456ab1434ad4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 14.4MB
        • SHA256 01089e4589be760aac341459a010be8a42073a3b9c4d249966f9b4e60cbab92d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 14.6MB
        • SHA256 5f296172f94c056826da5106672d027e0a4a95e26bcff25f04f239d287fd5502
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 14.4MB
        • SHA256 0f84d44502727e475527b48d68ee6bc6ef213202d06ce33666f61a8dc34c8fc1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 14.4MB
        • SHA256 af1211709a058f38c52cd5aa73a36ab20605505004ea1e71a520cc2ecb6c7d86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 14.5MB
        • SHA256 6c7068dfdbad4bea9600d73bd3c73ce5346e520e9f5b610ffb2d9ac2dff2c16d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 14.4MB
        • SHA256 803019dbd9d9fd3330db4689f08a7b2fbb18022b1b4bf2a3bc2a82f461da005e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 14.4MB
        • SHA256 292c3652b1a7173d8f0774d5380b8fa7fa69cf5a1df940077a4280809a6b27d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 14.5MB
        • SHA256 da4826d0ba7b7dc95bbc60bb9cffac81ee85017671e9b5c1a7fc237a11b41fa1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 14.6MB
        • SHA256 49c96de533174a80711a7883775cefafcca43486ba61e10633be9f8aa87d6257
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 14.8MB
        • SHA256 b3c5c6f7c0f53d2babef4d21b8e2f9881fb39323d4d2196621efbbb1b684692b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 14.4MB
        • SHA256 896aedcdf689a649228cd89799685c51c50c22846fa1101cd110fe53f6d5b5f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 14.4MB
        • SHA256 a6521bc5f4653e7f65d4efa46d1bb6b79e23f309f14bc2f688a0eabaa3709450
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 14.4MB
        • SHA256 ec1af5b2ca604faea8f4adb394a49c35379f027adb9bd87620d2a186388c20db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 14.4MB
        • SHA256 1f1f3e63ff577e0dd62df42d79e8864acaaa1633d11ba2ca6850a05b4d080161
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 14.4MB
        • SHA256 76768ab8917ee971daad38f86191fe35d9d451cde005f92ae7e18ed0ef3c8047
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 14.4MB
        • SHA256 da8f107275a115756f7b9071b50e72279c33950f4acec00d61a8e347db709250
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 14.4MB
        • SHA256 ca02dcf017f15ddf5f1119755d7296d13ad6a3113140157f71123ac4dfceefe4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 14.4MB
        • SHA256 f99e7752298abf60b08b385e4371634c86ea5ee5348c6a015928c23cdfe5caae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 14.4MB
        • SHA256 5d2161e320aed91cf54e153bfd8051b6a05c29bc1f78a8be88942c643a8166c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 14.4MB
        • SHA256 417d5f5fc71813a4b9dbeeed2a048c274e64ff0340be35b2ea6a4b88d4ac68e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 14.4MB
        • SHA256 3e85f7b3fd35a0bb3e4771e61db0028523d24969f741016c3f5bca4de35567b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 14.4MB
        • SHA256 a2a6c8d5a33c3a33fb2f29a4d35de080112c3ec2672296a38b41481cefa7cd76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 14.4MB
        • SHA256 4ec7e2f7cf85b09a21eae0ce2549d9960b7bbe65714f34ecce011e93e8f2428a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 14.4MB
        • SHA256 02e81195c57528c3e91cd1dee9ca7120aae1a3bda936182b76d5d27620e507f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 14.4MB
        • SHA256 a79b6db28ce816e2aa8f4a2e415aabd35374a37bbbca41b61f27256f28670aae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 14.4MB
        • SHA256 80b36d0384913ca3ba6e59e976a89b57a91c28dbedba8527be05eb3af837680d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 14.4MB
        • SHA256 791f401242d967bece7612fb6db5abbea274be94f013ccf00450a0202830ece9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 14.4MB
        • SHA256 b5896bf08feaa490bf0bf4a61d4b0f5f6d65fb58b2f58d96328adbba4d1d2562
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 14.4MB
        • SHA256 0fecd824605e698944e4359d3538c8f9736b388b456b58a278e1bc2310ddc546
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 14.4MB
        • SHA256 945ceeeeb05993ef57d0b0572465bec09019116274e2aea37b0924ea15782d6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 14.4MB
        • SHA256 5c76238b4769aeda512a325a5ff77c10eed3c2666848a844ee716ab41b65a80f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 14.4MB
        • SHA256 720dd91b890cb96b2189ccc32871d711b21d7c7061b329854c6ed0ce64716fba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 14.4MB
        • SHA256 0b7a6e27307e35c21a9982697a2a2e01911f6c7530518e729a3d4539e7303df5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 14.5MB
        • SHA256 83b64777bd4bae2b0162d0a18795e7d8789f08ad14480b38a7134e69cef0ef2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 14.4MB
        • SHA256 ab9de9729eac06ff1e5378bfc7d987fe983511966b297cb85c40da160223752f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 14.4MB
        • SHA256 a13e2552c160b6ce97914614fc80a76030ecd49fc9d1e4375e2ebf823245c7f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 14.4MB
        • SHA256 c43a385cde062ca36beba015cd869c8329f5168decf6403ed4cfc9e5cfe7d9d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 7.2MB
        • SHA256 1ba63a85ad68f5eded369a0358e1c77c4b69b4019ec418db77021853cac1a49b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1916-288-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3444-209-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3444-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download