Overview

overview

8

Static

static

3

2026-07-08...ar.exe

windows10-2004-x64

8

2026-07-08...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    25s
  • max time network
    144s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/07/2026, 15:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-08_06069dc336c76c52016a8374f49ce14b_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 27.6MB
  • Sample260708-stbxbsht6t
  • SHA256 96c989f027b55bbb526a2a337c4e7914c50deb7b3704383b610d7630b4a46cd8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-08_06069dc336c76c52016a8374f49ce14b_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-08_06069dc336c76c52016a8374f49ce14b_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1112
  • C:\Users\Admin\AppData\Local\Temp\2026-07-08_06069dc336c76c52016a8374f49ce14b_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-08_06069dc336c76c52016a8374f49ce14b_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3348
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:5140
      • C:\Windows\explorer.exe
        explorer.exe /LOADSAVEDWINDOWS
        2⤵
          PID:4116
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:3172
        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
          1⤵
            PID:3728

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                7z.exe
                • Path C:\Program Files\7-Zip\7z.exe
                • Size 28.1MB
                • SHA256 02fcb42bcc65ec6a7ff4f7251832f7f388aef2c75d5d593edf7ceb9a015d8a1a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                7zFM.exe
                • Path C:\Program Files\7-Zip\7zFM.exe
                • Size 27.6MB
                • SHA256 96c989f027b55bbb526a2a337c4e7914c50deb7b3704383b610d7630b4a46cd8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                7zG.exe
                • Path C:\Program Files\7-Zip\7zG.exe
                • Size 55.9MB
                • SHA256 a425ae3dcc2017898aaf66e0c548ad6af7a06a15dd250b503383088d30fe263a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Uninstall.exe
                • Path C:\Program Files\7-Zip\Uninstall.exe
                • Size 55.2MB
                • SHA256 5b2aac0b57596b4bf806ba22834b4bb26efc961bba6d3e1394a023f6f960e799
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AppVShNotify.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
                • Size 55.5MB
                • SHA256 2b6c95e03f46ad1dba003c87183b869764108d16dcdb72b977c04b121b822dfe
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                InspectorOfficeGadget.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
                • Size 55.3MB
                • SHA256 418b9cf30bacdc06d00c91016e7264adc43e72fa6d35612434b46c017f753277
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                IntegratedOffice.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
                • Size 56.4MB
                • SHA256 2af450a0956b892d3194f5f5e1cc3150ecf4ab4d4b27f29512026062b2616d6a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MavInject32.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
                • Size 55.6MB
                • SHA256 a8bb1f62d89ec4ee957f0d0613c1e7b5f606a1723d305aaec85d1e712db980c3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                appvcleaner.exe
                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
                • Size 57.3MB
                • SHA256 c1185a734520a2b1fc30085e3421731b3d26ded5bc481aea998bb89657521fea
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                VSTOInstaller.exe
                • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
                • Size 55.3MB
                • SHA256 68b03dd06a7d30530a10c89efc7bb50f4ad0d56817ee1bc605cf02ba2852a48e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrmstp.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
                • Size 51.6MB
                • SHA256 c53df3113658ac2e0c7feab369f35d5b800d99c759f0923264d975bab031ae16
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                setup.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
                • Size 45.4MB
                • SHA256 f73a54e0f181b658ac887bea839c4c0e39ce4ac15f4233f03649acc5d762754f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrome_pwa_launcher.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
                • Size 52.8MB
                • SHA256 cb850368d213e3d41ba74f24a7547fc36b57e103ab917f6cd225d01535178824
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                elevated_tracing_service.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
                • Size 48.8MB
                • SHA256 523f227f3d0c6b3f45ca780cc05670c80406ef7ef743de1124d5ba9ffa036453
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                notification_helper.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
                • Size 42.9MB
                • SHA256 88a34de5076df8ce470b3d96d61c2c30b758cbabccacc6b32e4869dcecb03091
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                os_update_handler.exe
                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
                • Size 39.6MB
                • SHA256 63fdc69f21d2462d42e6d78289075b347c7b09900e2dfb4987bf79e34c5dc10b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrome.exe
                • Path C:\Program Files\Google\Chrome\Application\chrome.exe
                • Size 40.6MB
                • SHA256 8b3bbde326efb2045c340d8d6f064d4cdfbd2ec91e109e32de81a9c7fb5d92bd
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                chrome_proxy.exe
                • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
                • Size 36.8MB
                • SHA256 f671804c42146a744d4a7b15128eedb04fc32d46f1c58c26e81d55afe444e3a7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                appletviewer.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
                • Size 35.5MB
                • SHA256 0f52549817c06dec4ac1689f3f6c14904b2ca4ff864cdcdfac21041bebed24c0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                extcheck.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
                • Size 30.1MB
                • SHA256 c320ca3efcd9ec8656255b5d5c627f4867cfb7af419deea3894647a614c48aeb
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                idlj.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
                • Size 33.8MB
                • SHA256 eaf03024d68a6f3c58c78bf6d2cfcc910935c3d557d428391302ca201fa5ee58
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jabswitch.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
                • Size 33.4MB
                • SHA256 9fb3d9392efbbec4f4d98519c7a61eaa85f5afce2940f643c702a13a1f3507ba
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jar.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
                • Size 32.5MB
                • SHA256 3ee22b49023400b376d69019b1be7a395571b32840e4942eb9905a82f6e6cb11
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                java-rmi.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
                • Size 35.2MB
                • SHA256 0d85506929d605a7e3cf0d2a4cb4d20c14525a79bd344a848ac7b7dd94b59e15
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                java.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
                • Size 32.3MB
                • SHA256 00d8ee4fada32e7d860c12a73aa8653f35be612730468ab78725a51f01186d02
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javadoc.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
                • Size 31.9MB
                • SHA256 7bc6515440741832af8fa2409326c9e34534aaf1fb49365558acf1dc4088d46f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javafxpackager.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
                • Size 31.8MB
                • SHA256 5fe788f431bcd389f1303f0759205c4e18e6bbaaebf37d1a036c91198d32a930
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javah.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
                • Size 27.9MB
                • SHA256 f3ac62e3df4e6f0a1a17923e03cab19f848b7c272f75a2aa12917de20f6724d1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javap.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
                • Size 31.8MB
                • SHA256 3078991bc05211e46a7c6c58619263f64b2a0320e81ddf1ab3397abee900c9b6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javaws.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
                • Size 31.1MB
                • SHA256 55e51cd770d28a23a429d3783b5a87d8250351910b2b5945223d0c65623abcfb
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jcmd.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
                • Size 31.1MB
                • SHA256 2d78322eebcd32062e04e2dc77b9abc45674739c0dc027b47e446ae7c32f725e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jconsole.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
                • Size 30.9MB
                • SHA256 4724ceadde4eec411a7b5124a3295e5151a063a14a874ea966d53bac4e91e8d1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jinfo.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
                • Size 30.6MB
                • SHA256 f4a8e922562ed52cc5afcdfbea1ddfeb4e75c2a3fc7f23fa652793933021c94b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jrunscript.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
                • Size 30.1MB
                • SHA256 65b9b6a77388366c2e380bd9e3d504a5776323182c6e2cf4b23761800c7ef705
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jsadebugd.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
                • Size 29.9MB
                • SHA256 0189590a21f6f5fcd3473fd18e004bb5fd355ef4d315a18757663080424659c1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jstack.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
                • Size 29.6MB
                • SHA256 7e0e17bdb0570ee43bed4514386a7ee69c383d32ecd44afdf0efe045a44f652c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jstat.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
                • Size 29.4MB
                • SHA256 ea3797878526bf711fbf7d4df4bf02eb0358214db82b6b9fc78e55941b1827fe
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jstatd.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
                • Size 29.2MB
                • SHA256 5bd28535af64d2c5f31253c32a1b1184ce2262cfad70ae2e0d22db165a49c99b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                keytool.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
                • Size 29.2MB
                • SHA256 628149e931008b6caf43c30f85a08c31f487bda69d3bfbfe89958fd07bc29dc1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                kinit.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
                • Size 29.1MB
                • SHA256 4a87e8ac1ebfd1b7ff35db8fa1d71a7c0d6f1eeda7fd8b5ff24048b08e8a9acd
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                klist.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
                • Size 28.9MB
                • SHA256 01c55dbb515b92a18c74e9b5dc0e309a918a287256122dff83daa6396ccdba70
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                native2ascii.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
                • Size 28.7MB
                • SHA256 88411668384a6214a75b1260411c5fe9638c23ff8b8024cceb2fba947ef9fdfb
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                orbd.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
                • Size 28.6MB
                • SHA256 e8fc9c545e519de660aa16c24ae3a9db11dee3c4da697d639d8e1aa3775b036e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                policytool.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
                • Size 28.6MB
                • SHA256 bc374f2f98daed3f52df7c204b9e176dac5bf661656055129d3c6f688d31116f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                rmic.exe
                • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
                • Size 28.4MB
                • SHA256 512917e3d920c86ff0f433945d4d1f742a00304dff01130a6027fb7e71e0e008
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                dotnet.exe
                • Path C:\Program Files\dotnet\dotnet.exe
                • Size 55.4MB
                • SHA256 ff28556a119e6524f50c7a6d75a35c197a8152455c0dc4390870e56123f83b0c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                createdump.exe
                • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
                • Size 33.8MB
                • SHA256 05db61d8de50d0906cf0c34240b0c5c008091119339a3754e6a5bf7f12279be8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                createdump.exe
                • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
                • Size 54.1MB
                • SHA256 1cd26ca8f478fa34e6c07add2954bfd3e8e3f8f729341451b5da3fc545d2306a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                createdump.exe
                • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
                • Size 52.4MB
                • SHA256 4880d4b8069c5cf6738dd6559db10c6e4a9f0c7a27fb0951f787a32bab5ef485
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                prep_Activatable Class_Hermes_perf.cache
                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                • Size 595B
                • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                memory/3172-288-0x0000019A83240000-0x0000019A834DE000-memory.dmp
                Download

                memory/3728-321-0x0000020F1AD50000-0x0000020F1AD70000-memory.dmp
                Download

                memory/3728-484-0x0000020F2F0E0000-0x0000020F2F37E000-memory.dmp
                Download

                memory/3728-348-0x0000020F1B130000-0x0000020F1B150000-memory.dmp
                Download

                memory/3728-362-0x0000020F2B6F0000-0x0000020F2B710000-memory.dmp
                Download

                memory/3728-322-0x0000020F1B170000-0x0000020F1B270000-memory.dmp
                Download

                memory/3728-316-0x00000207172F0000-0x00000207173F0000-memory.dmp
                Download