Overview

overview

8

Static

static

3

2026-07-06...ar.exe

windows10-2004-x64

8

2026-07-06...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    27s
  • max time network
    119s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/07/2026, 22:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-06_0080c72b5d9248beb380c98cb677fc82_akira_amadey_cobalt-strike_elex_emotet_icedid_njrat_remcos_stealc_vidar.exe
  • Size 15.4MB
  • Sample260706-2vmvnaat3l
  • SHA256 06aa624405d3366b4cc83bd5d42c9542a3ecad16ae9fecb06f9e97d58764fe81
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-06_0080c72b5d9248beb380c98cb677fc82_akira_amadey_cobalt-strike_elex_emotet_icedid_njrat_remcos_stealc_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-06_0080c72b5d9248beb380c98cb677fc82_akira_amadey_cobalt-strike_elex_emotet_icedid_njrat_remcos_stealc_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:6020
  • C:\Users\Admin\AppData\Local\Temp\2026-07-06_0080c72b5d9248beb380c98cb677fc82_akira_amadey_cobalt-strike_elex_emotet_icedid_njrat_remcos_stealc_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-06_0080c72b5d9248beb380c98cb677fc82_akira_amadey_cobalt-strike_elex_emotet_icedid_njrat_remcos_stealc_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2308
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:5768
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
        PID:1800
    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
      1⤵
        PID:2720
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:6084

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              7zG.exe
              • Path C:\Program Files\7-Zip\7zG.exe
              • Size 16.0MB
              • SHA256 7dff48e0bd70b12cfd0d6382e93e9776e633340f3bbcd2c6a5eb5c8858432152
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Uninstall.exe
              • Path C:\Program Files\7-Zip\Uninstall.exe
              • Size 15.4MB
              • SHA256 434785e4fbe2f552a4ef549bd5280e74f92a779cc69affe632e57f6cdcdb8a2d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppVShNotify.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
              • Size 31.0MB
              • SHA256 fb86feed01c68ce331d43228dad7f135d8460be35f480b46d1e745ca5f46c05c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              InspectorOfficeGadget.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
              • Size 15.4MB
              • SHA256 dba814f60a079f68645eff71cf942c278807e00ad74d302c55fa483e3090f301
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              IntegratedOffice.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
              • Size 31.8MB
              • SHA256 7601df8f00924502147e622fd64871f569599772acb8f67c24fc7d0403b67254
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MavInject32.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
              • Size 27.3MB
              • SHA256 68f3c2360367be6eefda41544bc15fd8b6bc86ea61697c8ab2c4668e2ced2a86
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              OfficeC2RClient.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
              • Size 22.8MB
              • SHA256 5c907c24d357a5ffd54aaf40503645143baf7148beea5579ee2526f1cc314f98
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              appvcleaner.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
              • Size 17.5MB
              • SHA256 b0e8efd8b4583d7d5544b6de0c1b353ca9b9a34e84641eb7dbef4e97864e0730
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              setup.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
              • Size 21.0MB
              • SHA256 c299fb99a6e67e417cc5ec017796303200509eb0e1d8e4add9c175437c9011e7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevation_service.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
              • Size 20.1MB
              • SHA256 e68169d5530b4cb3fd1767304e52c7eeca1d091e63e8c1f1a4f7bd9d7b03ac32
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              notification_helper.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
              • Size 19.8MB
              • SHA256 88f23498c4b86f83a85b7333201cefdd2ee33ba67031e1a2db8fd38cb1caa2f4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              os_update_handler.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
              • Size 18.1MB
              • SHA256 a59949947d654d7d6fc0859e23f793411fb039543a30278a94c8c6dbce985622
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              GrantDeny.asp
              • Path C:\Program Files\GrantDeny.asp
              • Size 17.5MB
              • SHA256 effcfdeb9f287d0808cb7930f162f3d910d54ccd2e2adc741b56275cb313488d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              appletviewer.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
              • Size 17.8MB
              • SHA256 f3f5ba80f4138a3b6e62d4705680faa37d63bf14e48fc68dda64521c213dfd7b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              extcheck.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
              • Size 16.4MB
              • SHA256 89770f70bee7878879efdb48dc04e60f3364b466e9d8a09eb8176c5f5b62228c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              idlj.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
              • Size 18.2MB
              • SHA256 c1f081d48612ec19f7d63e9923f18165d62f416ac45e94423490f3f4cb17cb6f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jabswitch.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
              • Size 19.6MB
              • SHA256 80834f60b9a471315dbc8a90bfb1e16e0be4e54dc2fd99d6afb34b66524aeee8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jar.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
              • Size 15.5MB
              • SHA256 3b7ea4d91c877022a5cdaf2aa3e1be7c202a7d4f398fb0a9be7efdf2dc354927
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jarsigner.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
              • Size 16.9MB
              • SHA256 2942d50939e1a95aaf26c870c93bf4aaac0724f3b1f384b2655b7be4b52f5b64
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              java-rmi.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
              • Size 16.2MB
              • SHA256 5a925ddbd6ac4614b59859692976f41bfd95f60779a7a6450c13d73408eec9b9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              java.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
              • Size 15.0MB
              • SHA256 e8abee10dc37478a5db73a1d97b667257fc47e9ee6c45ed5874e77932f1aa651
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javac.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
              • Size 18.4MB
              • SHA256 ef994feae0df54578f31f7988172ad2af2f719a5be5055e786bdd48f5070ef1e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javadoc.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
              • Size 16.7MB
              • SHA256 dbf49a5dc4bf6a64bbf0c990d90f825c606c70d788703d510de75071006cf137
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javafxpackager.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
              • Size 15.6MB
              • SHA256 a942caeaab940b96485031c3aa98a293c22b24ec540f57e1ad6e30a4a7836299
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javah.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
              • Size 14.1MB
              • SHA256 6326c54b8facd6c5068f8330b57b765780707790275b9b00fb2fccff367931bf
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javap.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
              • Size 15.7MB
              • SHA256 64a9ba8edcbde2f1b106011e81e5952f23adb4d5c09bc7656249c4a5e293908d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javapackager.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
              • Size 15.9MB
              • SHA256 d8db1dc3cdf2f5c3a1861921376db83cf3cc5c4ff330bdacee289143ccbaed50
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javaw.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
              • Size 13.8MB
              • SHA256 c7d69c20ee2609c028f5657479c4731fe7412f7cdb8c973c4529bec0d29a6acc
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javaws.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
              • Size 16.7MB
              • SHA256 35495cbbe7ee7092b056cbf3f67a2b6e3f3acef09ae5325cdcb06fe704cccfb4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jcmd.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
              • Size 13.1MB
              • SHA256 f91b0db43556401d26fbf193468baec4209c42e7855461e7873f4bcb7171c883
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jdb.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
              • Size 15.1MB
              • SHA256 43a2b04d669d8db2157bac09280ff847f60a02f7d6c0862998b49b6cacde9ee9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jdeps.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
              • Size 13.1MB
              • SHA256 dae802004329d983b157adb2ee454f10b59ba236941f14240b6177c33dee5638
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jhat.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
              • Size 13.5MB
              • SHA256 a76d79f04f09d70e5930a2451f63856ba971d1d5e9d1602357b120796a2d1b6d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jinfo.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
              • Size 12.8MB
              • SHA256 e9f1872d54bf4b3ddae87535431a503187e72562000606b9dd1e038572cd70a4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jmap.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
              • Size 13.2MB
              • SHA256 56168d90dd8774eff765c226630c76204d7bcd00096e0745eaeee94b58f669ce
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jps.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
              • Size 12.5MB
              • SHA256 9ce9300896eec8112c6bb0fcfc1f0f4fa869e8c598d1c50b1af8c47babac6526
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jrunscript.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
              • Size 12.8MB
              • SHA256 8c45ba592524ed44998c6c6d0529d393d92ea32b47e454126dd55cb530a609a6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jsadebugd.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
              • Size 12.6MB
              • SHA256 082e655d76f80e50d065be756f1dcf4a881cb38d459df2cd51b922c402e71b9f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jstack.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
              • Size 12.9MB
              • SHA256 32ff96115d33bc37076e77844760a51273fd4313ca39c14eda69b31f0b5aaab3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jstat.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
              • Size 12.2MB
              • SHA256 87aef3f6e38c7fee92ac4687ba4c7151fb256c5ed8bf91939d0b56b64c2fe02d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jstatd.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
              • Size 12.1MB
              • SHA256 02489d7a035cd9b8a1534c52d9710543f316674c890c480bfa12b6c10a1d9b86
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              klist.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
              • Size 13.0MB
              • SHA256 2159d83b6199034cccfe60cdba8eded13eb659ebc25f2a3470d7b94e30f741f4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ktab.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
              • Size 12.6MB
              • SHA256 d4c2b8f4aa31c6d245cfeaf5d94778289a99b9a1fb8dc2bdde923b62e4681ef8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              native2ascii.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
              • Size 11.9MB
              • SHA256 89768450e193cf39114a64dad10bb0734b2f7c7723c97c9a2c28b1d3e8125ee6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              orbd.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
              • Size 12.4MB
              • SHA256 50e4cdba077f6fc135454a57e6f9c69b928eaf8cdc1d246bc2d78e584d7aea21
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              rmic.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
              • Size 12.3MB
              • SHA256 d9792b7ade84dbd0fec759021f9e28261b92b87c9ffc791844ca3d1301aaffae
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              schemagen.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
              • Size 15.4MB
              • SHA256 ee96b727fdd876044b8eb9d8333b1a7ba7cba24b90f347b1f4c27ed0c5fdf0f8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              createdump.exe
              • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
              • Size 15.4MB
              • SHA256 06aa624405d3366b4cc83bd5d42c9542a3ecad16ae9fecb06f9e97d58764fe81
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              createdump.exe
              • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
              • Size 21.4MB
              • SHA256 bc496c608aaa96ad1c85ed228a6a78454a15c93d0d9e07a325806e0ba2d6442f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              createdump.exe
              • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
              • Size 15.4MB
              • SHA256 04bc2c2f34bc6788256d8b26a3710c1255f4e8509c5e2c0b553d143823c1279d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              prep_Activatable Class_Hermes_perf.cache
              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
              • Size 607B
              • SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              memory/2308-3-0x0000000000400000-0x00000000004E4000-memory.dmp
              Download

              memory/2720-245-0x0000017793650000-0x0000017793750000-memory.dmp
              Download

              memory/2720-231-0x00000177F3AC0000-0x00000177F3BC0000-memory.dmp
              Download

              memory/2720-230-0x00000177F3AC0000-0x00000177F3BC0000-memory.dmp
              Download

              memory/2720-276-0x0000017793A60000-0x0000017793A80000-memory.dmp
              Download

              memory/2720-229-0x00000177F3AC0000-0x00000177F3BC0000-memory.dmp
              Download

              memory/2720-262-0x0000017783450000-0x0000017783470000-memory.dmp
              Download

              memory/2720-243-0x0000017783200000-0x0000017783220000-memory.dmp
              Download

              memory/6020-0-0x0000000000400000-0x00000000004E4000-memory.dmp
              Download

              memory/6020-1-0x0000000000400000-0x00000000004E4000-memory.dmp
              Download