Overview

overview

8

Static

static

3

2026-06-26...ar.exe

windows10-2004-x64

8

2026-06-26...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    131s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/06/2026, 15:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-26_545ce1a6eddadf28de32d2466ecec277_akira_cobalt-strike_elex_emotet_icedid_njrat_remcos_vidar.exe
  • Size 26.2MB
  • Sample260629-texe6ahs8t
  • SHA256 8591809e3d057032843731c99fd2abcbfa4cc54e4dde9a579b58c51a95c08a3d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-26_545ce1a6eddadf28de32d2466ecec277_akira_cobalt-strike_elex_emotet_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-26_545ce1a6eddadf28de32d2466ecec277_akira_cobalt-strike_elex_emotet_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5192
  • C:\Users\Admin\AppData\Local\Temp\2026-06-26_545ce1a6eddadf28de32d2466ecec277_akira_cobalt-strike_elex_emotet_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-26_545ce1a6eddadf28de32d2466ecec277_akira_cobalt-strike_elex_emotet_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:6000

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 26.2MB
        • SHA256 8591809e3d057032843731c99fd2abcbfa4cc54e4dde9a579b58c51a95c08a3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 56.4MB
        • SHA256 744bb876a46d6d977972a74e19632bedc155fbdfddd5f5ffd2733444214cf4ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 52.7MB
        • SHA256 47d754dfcc177697266b4be1e46c0ddd7bf79399fadc9b2ecb48595299b45492
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 28.3MB
        • SHA256 e8a122048ae445d462d13158ece4250910fb4e9323dc1d2c29b5f651d729a090
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 52.4MB
        • SHA256 1bdc7d897f5ca4f15041abe3320b5af3112ee49d6c1a2942b88dca75e6ed5621
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 58.4MB
        • SHA256 5d9d762ebef1245cdeb28e8131798212d2c51522278cdbf686ec90460f87af9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 27.9MB
        • SHA256 4e7f50b153280ee84994e62d2345efd2ba39f3ce42663c5e68099890c5a0a65b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 55.8MB
        • SHA256 f1cdb1f6d8370af9d911528acd4e136e9c0a46735d033fa1e458abe05d7f3efa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 54.6MB
        • SHA256 5e29647fca8a22fac0f1614df18df28155d74b11ac4562765d6b868cb8f93288
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 53.9MB
        • SHA256 d6ac300c592fdaade398069a72d047b422d631dacf78cc1ae97aee451fe18b3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 54.2MB
        • SHA256 b68ad8b3d113c1931dfd3d68240013f22a0c5243cf00716aee1a33858dd576c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 55.4MB
        • SHA256 c7cf5e8a11f6ac316504e683f59a5b40b2eb998836729dfa0529bd3ed3307774
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 53.7MB
        • SHA256 1b43c15d7770d4447175bb73a1a79d327dfbd659758dfb225ed439a0abda7fa0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 26.2MB
        • SHA256 3341aec195a038c8ac94cafd745b3b3cb513149816c4590a855b03a753a8a8dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 52.3MB
        • SHA256 096f2bd32b9542158159e5a5a8cf0ad5219023943b95e18fba527e5156e19967
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 52.3MB
        • SHA256 0b6c4595a1dfba8bb8692d7f0957524f46c5c8e0bf40eee1d214a7dc71ebb383
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 52.3MB
        • SHA256 994197fca016369398bd8bb36cfb60eeccae43841d8808ae3bdfef30a07aa1e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 52.3MB
        • SHA256 a130336b271e6f21c68eb7c8d7a7db49145ec65cdaa6ed18644c0349cabf8e5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 52.3MB
        • SHA256 58097f4339e14392c3f68ea873b8810c1f0e5cf03dcae986fabefef3ca6b5b6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 52.3MB
        • SHA256 98709e63ae55abee7e7c3c54a3bd2358713f263a7274fafc90f46dcc25932265
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 52.6MB
        • SHA256 be2ffee5bcb88e892f6f0dd10ca504174f3f4c2b5d64a534a8c19d83f11dd23e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 52.3MB
        • SHA256 e5ccfa9ea48e4ecd3b5806e94047849da580bfa43787db8e69a08d77a6d655b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 52.3MB
        • SHA256 e10fd7178c2b3b1f2d3c88899ee71a7b0bf1c8f6aadad61ae7dae4f128b659fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 52.5MB
        • SHA256 af63de40876d64745992264f47224e4eb28898ea76633adba8576bb668b6be09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 52.3MB
        • SHA256 637c867ec424ff044dbe3127150dee8e10094d6850f92c058e50fd9b4d6646e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 52.3MB
        • SHA256 99d2a76be901e5bbd6df4e1dc6f5d0d0b51faba160a43142a46dedf71db00c2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 52.5MB
        • SHA256 41a95c6df061db39aa072cb55a3ef12f6f3f937d36c19c28e384e0d048d0ec99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 52.6MB
        • SHA256 15ac7ef6843718a936922424a5e1aa05ca2c2e55b9b1b834633445078d38f931
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 52.8MB
        • SHA256 805e57c0623e092552969965047bd514a192dd7a5bd2d1c5f890b6b299f60912
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 52.3MB
        • SHA256 a8928dc3684ed1468d0a9d6ca7e6cb9ac22eb89378e300e71e65037256984493
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 52.3MB
        • SHA256 6639bd04ab0077b406eee1fdc2e9f89cca739a9d5e5fad58935643c199dbca16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 52.3MB
        • SHA256 f4c3c6e3d556d17b06b4a0f6ed9772d55fa5b2d4706bb5705f1421892b3f0579
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 52.3MB
        • SHA256 67297ff0ac9024f5f06c6aaa97f4299611c658cf97435a0383846468b88adbac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 52.3MB
        • SHA256 a82c781fedaaafe358e33afeed6bf2e410ffe70fe3ff904fbfd4654b6aee369f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 52.3MB
        • SHA256 7df645cdeee5ad1dcb810c54f1218a9127c4289c48bf90e442674650892fa274
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 52.3MB
        • SHA256 e15b664b93681302250f05324bd13d6b11ab18f0210a677610ab1d17fdb179aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 52.3MB
        • SHA256 413078b296f34ab9b545dcfd424b8b2fdbd6f819796af9bef7f3da79c837187f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 52.3MB
        • SHA256 f8920a2df950aa99a1dc8f1a126281be3a8aea29b3ddec1a7567f594a1e30074
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 52.3MB
        • SHA256 281ef1f045fb2858748ff9b663b2f6a7926094b68cbe06a9c0992b30c16e5bde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 52.3MB
        • SHA256 dac99fe90c6c5169a900660ff54dc45fce7cf5c59cfd1715d42e8ce66ba88a1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 52.3MB
        • SHA256 2f319177ffe3b41c6e2530ada9915a2f0acd8d0eb45e050187ebe547f85e195c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 52.3MB
        • SHA256 4abe0171bed957fe5260f5527e49bd25d98293afe88a3fd3493ea2ea73507da8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 52.3MB
        • SHA256 d5974a37953d8e65b99daff3c83ed31421a3b00717aa0896ff14d364f84bc8bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 52.3MB
        • SHA256 bc2950017df116231b13693ccf7461cfb76136758c12687071deb136b01ca8a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 52.3MB
        • SHA256 9f1076da7e6c876e647766cb7d547f87c22e21ecf8fa48d554ad1f433c7bec51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 52.3MB
        • SHA256 aaf765b695c8b0dd510c1eb0007b7c0bbef603a65409fa22b67bb9e93db978ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 52.3MB
        • SHA256 4aec2b70f008c0e8a47fd6c415ac3860b178745cc758fdb754d7d98b35d4a373
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 52.3MB
        • SHA256 4ef3f86751ca395ba49a4a21326553982de60a03378378f33b7eb50faf1e0416
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 52.3MB
        • SHA256 04522f75e5e3fb3eef41693b5ac2b78a9ab0818d68482cc24d29909f88d099e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 52.4MB
        • SHA256 5bcfcc67c78e17c529abfc7aea95419c7a4ef83383d83a757899da059040e48b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 52.4MB
        • SHA256 5370cd2aa60fb83f6cf01dd421971d1fe4bcd52903ad22de1f2c72db9a5c59ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 52.4MB
        • SHA256 76641a6b5bda88b664d69df781410d0ef5e60fa8aa64642b863eb53f65009325
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 52.4MB
        • SHA256 1408ab8f36267b224d18e667d637db94d085ce8191a3ff70b48a9dcd35b5f586
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/5192-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5192-28-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/6000-41-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download