Overview

overview

8

Static

static

3

2026-07-11...ar.exe

windows10-2004-x64

8

2026-07-11...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/07/2026, 19:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-11_e13bcdc5d1730b709c394a91f4549990_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 11.2MB
  • Sample260711-ye62tab14v
  • SHA256 14896ca44376908e3b9b23c0af9a94857409a339a9116b5f3be9ffc8df84b732
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-11_e13bcdc5d1730b709c394a91f4549990_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-11_e13bcdc5d1730b709c394a91f4549990_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4460
  • C:\Users\Admin\AppData\Local\Temp\2026-07-11_e13bcdc5d1730b709c394a91f4549990_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-11_e13bcdc5d1730b709c394a91f4549990_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4824

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 11.2MB
        • SHA256 6f0c5e5526da7d5134ebda7606983c2e777a62ec44ada6da8d3ab76763c400fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 22.7MB
        • SHA256 a9b901277876edb3d632147ecafc2022f0bda0cf6cf3b0a9531e4fb61efe520d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 26.5MB
        • SHA256 d9deab97b0c6f75bb1a0303ba4a9becc8a4251b69d272d837f400dabbae32ed4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 22.7MB
        • SHA256 c3d3dceda8233463f8f2b50bd3c40cee5bf3a3c69a9bfa93903aa00f8dbf3642
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 13.3MB
        • SHA256 2aa53b21aaacd4e72e40d4245236d5b73c4501e1e67aec2334eaa7eb99b67de6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 22.5MB
        • SHA256 ad34870f51f84dd5ee5140349d62f3a7a2a4973614342f5e469246b86d5eba92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 24.1MB
        • SHA256 17b6b568bd1e4e04a985ae9fbd2950b0bc2b37258693676a615bae618b86b39c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 24.6MB
        • SHA256 bd2656df29ae0a05039940726cd501fb02dee83219dd567872b3689e45850af6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 24.0MB
        • SHA256 1caa72fd7ebafcfb4d75e162f012918426171738e26a29ad63470144d9fb1c59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 24.2MB
        • SHA256 9c11091d436e86acd9af2b62f143087d7ea57bfe0ad78b830ad84e1586ef086c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 25.4MB
        • SHA256 aaa6267d1086ea134e75221f761ea6cbb17227029ecae60b553adaf3a18914b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 23.8MB
        • SHA256 061a3e39e58af81cf02df8dd19f755b7f0c6b02b11b7bec4442cf641cd244071
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GroupConnect.asp
        • Path C:\Program Files\GroupConnect.asp
        • Size 22.7MB
        • SHA256 13607583fd471e242e56bcd0c56b940a0ee64609aa634dd188e932e7620f0956
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 22.4MB
        • SHA256 edf838afb760bc1abaf98aad3c98968a642267151b9fbf27f324cbda037f712d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 22.4MB
        • SHA256 9ba4f53c9784bf738cce67e4378c8c9b1d1e50bfeb22591498a47a8bdd974d5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 22.4MB
        • SHA256 d8df4a057658b6da150d42ffded5ef7d4ec1dfe3ea06904732297a82b19e2866
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 22.4MB
        • SHA256 ab929485a6333b6d8157302daa1b866f4cd7caf0f435febd2135b929238b930c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 22.4MB
        • SHA256 32b50f1b97a469ed09714a0418bc8d8d936406385648c142fabd5bb8f4eabd8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 22.4MB
        • SHA256 4dc998ca24271a3b471fa3fce0bf4fd4fbe048bb4a73bfab27ef4622efc7bfa6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 22.7MB
        • SHA256 4b41add58e7a2bb8163a99e8b69913566c8dd8f4286ed102aedb603b3d0585dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 22.4MB
        • SHA256 f48c291f8cf2a438ef13fe86413c0a4eb6422359e3f17a8dd3e8bf6b662a160b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 22.5MB
        • SHA256 dabe89f3bcd545cbac1e08caf291b29072800630f20ef3812041d941f559eb40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 22.4MB
        • SHA256 1b58fcb2d0ab4e10660061cafa242452a021fa90e585dfa88a9f56f87971c71f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 22.4MB
        • SHA256 bd38aa9f34968eef74390dda3b0948fb35e9b682579771d058669e931f554ea6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 22.5MB
        • SHA256 782cf5a73d4d39e41e060825023fa33601393ecd25f90ac7d54926deaa2c7501
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 22.7MB
        • SHA256 5be567ad72992fb4cf2a4f8c5304c684c98a8dcd01a77d933802c9c65860e98d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 22.8MB
        • SHA256 cbc5b772623dcffc210657f4d1f42c3034a13e2f58b2b1ac1a6d85d98abf6d96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 22.4MB
        • SHA256 5b4be5e00c064107c2c2a0a9ad90ed1600594a3691e28467c17b70a4f0bfa1e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 22.4MB
        • SHA256 c12dce53dffa9f18b47f6741c2af0a27ca5a715aef057bdf9f54f574a1def799
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 22.4MB
        • SHA256 d7cca0840aeabe74be9aa9277e32bda58134c306d8f21c4dfb16d857d4e7acca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 22.4MB
        • SHA256 9e68d2cc62b1d824bb236e9067bb148c688345616e952ee20d99e231751c2e12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 22.4MB
        • SHA256 f550f9f1f06076b312831912cbd59b8531d7cc7392a6c59e39ac17ef441192bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 22.4MB
        • SHA256 3b2da823f293c9c7032936f37c41ff069e18e4528254b3db6535867f0e3772a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 22.4MB
        • SHA256 1e6ddb7f1875f6861ed11e035100155a613ba745ce1005001c9d9a9932d347d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 22.4MB
        • SHA256 abe82fbb6624aa622f0c2f501330d07590630fb8f90d6f54e3e50488fd96f6d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 22.4MB
        • SHA256 290795b216840a9e90f048af2b171b7c8775a158b62ed8b5126908a8938edfda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 22.4MB
        • SHA256 2ba5bb41e6f61ccecd1c5c3e80cb45b09328a0b344e76d1b3d8a51711303681f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 22.4MB
        • SHA256 bc8167ca34445238511194fdffcaf4a9618037804f24295881840f693962abe9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 22.4MB
        • SHA256 ed5ba9d1e3008c3bcc0fc1aadb7885ece8d1bcd01d62cb92949ac5efe856ef14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 22.4MB
        • SHA256 aa7dcbc5571cae03830ca6f523c60bf53b3af9b1eaf25bd2a97f2a2b82f92302
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 22.4MB
        • SHA256 7dccafbea58b4c6bd89c87feda68392c3bf932d715810437b3840963cddde956
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 22.4MB
        • SHA256 6850aa26a67170a702909d40851d90e4bfaf5088e9e4779e857475d9ad34580a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 22.4MB
        • SHA256 6ea36c5b3acfbb1ab55d43a40dba493e51a92123f70a2a044a34d7eee93f7279
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 22.4MB
        • SHA256 bd8c8924b058296612d2cace469644aa1bc94c651ea4d2b315245531b8c1b8c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 22.4MB
        • SHA256 cd64b9bd8f73d9cae5443a14c951f639cb6978b6e4378c4df2a7c6269a65f2de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 22.4MB
        • SHA256 7163295a4a4bbe8d7d763be11bf5912f0533b7cce303eb4dec5342c6415dabf8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 22.4MB
        • SHA256 89399af2d47145e9b7fd08ba8699ba005ba572ced622f4423d95da448496ed13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 22.4MB
        • SHA256 d0553ff23d2dc39ceb07f20b43727e07f9321374792d01a45429e94c804c58ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 22.4MB
        • SHA256 cb3356c8fa11408c21986ccb0a79134e3f49f97269ed5bb9274afaec9cecd4f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 22.4MB
        • SHA256 6edb9bc16932d74f61edf391e009dba02fca06a02120175e98a614558eb5a5fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 22.4MB
        • SHA256 7bdec5f5d1ee798bd6ac716ff40a678c7f5bf22a0cabd58b9ca00102de5ce422
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 22.5MB
        • SHA256 051501defb1c5bd1115a097571bd23999388e627d3660ade15ee7473ac2ab620
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 22.4MB
        • SHA256 08ccb2afec3849fbd26dd36bfd2922e598371f620dee0976548bb0fcd2f5b76a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 22.4MB
        • SHA256 8324a0e905d635bcbb7c4e0ea5e1bbcb7a6f93326d5ddf5f6da96776458fc5cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 22.4MB
        • SHA256 e95eb48a85f1a522b076d722923c861548c05be63d5042de8dcc792aef2a6a5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download