Overview

overview

8

Static

static

3

2026-07-13...ar.exe

windows10-2004-x64

8

2026-07-13...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    62s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    13/07/2026, 04:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-13_6d2f683d06a1288069d1f0b9157389f9_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 22.5MB
  • Sample260713-e2v4aady4z
  • SHA256 0f6b05a0998fd6c01fbd308208239d04183d1fdf9d9e8531df868155beaf0f03
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-13_6d2f683d06a1288069d1f0b9157389f9_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-13_6d2f683d06a1288069d1f0b9157389f9_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4428
  • C:\Users\Admin\AppData\Local\Temp\2026-07-13_6d2f683d06a1288069d1f0b9157389f9_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-13_6d2f683d06a1288069d1f0b9157389f9_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2440

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 23.2MB
        • SHA256 3d06925868c92754e57f94d56e24c31b99d05d51751944aa83c8cf113808d60b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 26.6MB
        • SHA256 ad6650a2a86693e7c0c756eb422d513405d6a2cae4e17623c797efdb1894c015
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 51.0MB
        • SHA256 2eb51ff511e0027c76b5031668eda04bc49534f5d6e12b8f799878795fc3f824
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 46.7MB
        • SHA256 0c7164c7bfe6fc3bbec085ee213b0e9d089b9bfba734d70620d919bec9a4edbc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 48.4MB
        • SHA256 4d0dcda76de21f155469b436662a5b7a80df4e4b0c341ff6307cf48733b1baaa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 47.2MB
        • SHA256 ac0e1dc5849a293c024b7f6f9ccaa269101f876a69d1c42bea8ebb18131dcc53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 46.8MB
        • SHA256 1ea3ce3be5e4082b77931a91216a4b45d3aac47f26a3b3a24d72355ed333c59e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 48.1MB
        • SHA256 174f29e7e70642eb941966e7991428ee0225872e964fd0cd3fefdb6fe6f0fb34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 46.4MB
        • SHA256 f86755be3367ac610558cd9b6a812f09df606a1d92b51ed53d87a40a281ed5dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 45.0MB
        • SHA256 f0eba22cb96b41713a04494285543aabe09b3feff023fd37b259b025f9e80bd6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 1.4MB
        • SHA256 637c4bb9196859d3ee21c66d6896f36707da0ecf10877371d2e8b93bfbc91e51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 35.7MB
        • SHA256 af419a021980a287098eec946a46d6beeb3edf3b20e1fa0fcf3f9c57a12d7f27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 36.3MB
        • SHA256 04a3c7d486db05b6abdf4accd4900015fdc877058a2f9fa3bcca46886cfd4320
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 31.1MB
        • SHA256 bc6390bfc579c8cb3cc9c322c31cb63b89eb6017734c2f7459e15ca4b12c1be3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 30.3MB
        • SHA256 c2ae8e52d6ce2769b04572e0ea148cd49da65bdd6593d7792821dcfebc8592d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 29.8MB
        • SHA256 5ee5cafb1b83093a3faa3886a7add34cf82211867c8aec15da8012b4132bbb3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 27.5MB
        • SHA256 f8d1142eaed4a176a10827dae409d0f845902a1119d91ab5afd3f926d443166e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 29.0MB
        • SHA256 588fb4375ce8c856f0d744c0586c64f001c0c5370ddb165a8a0d24cd30e732ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 29.4MB
        • SHA256 7db366a4c80b1056798991e817a44ac901b116a5a087dfc5d586cbc36a4b81db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 29.4MB
        • SHA256 d0c6d0304a9381cdfea32ec41ceeb3a229d566a434a6b8a3d24e57ef25d01486
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 29.2MB
        • SHA256 4403966c89c26727176e9ac49dcfbe5870b5e0a200533b19b63e0ea49c0753a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 28.9MB
        • SHA256 2ef23ac63a1d7715281e9cdc0ae47ade948d55e04b92397d1dffac2741917b57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 28.8MB
        • SHA256 6ae8d48b32e7322a33f07cf4f6e05b5f8f85debc1fd685be07522f53558eba3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 28.7MB
        • SHA256 f032b7b3fd8d7dd8b01ab7f85ecbe4c69fa310fba8878f78c62c516755082793
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 28.6MB
        • SHA256 eb98d337ace81f7c441d1b152e93bedc7f7616d5caf08287cbe28873cb9f348b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 28.6MB
        • SHA256 080b036fc36e80f7f5368a9e2eaefc2f007c28a90605fd6677bddd2c18eb9916
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 28.3MB
        • SHA256 81036c6f410fc3e3ffe2196359128f2d29efaec5c7d82bc6f837a90577172550
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 28.4MB
        • SHA256 395c801572811bd3dea9e21f75fa8eaf0a8fd4ca3c4948a7692e1e08ba063f93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 28.2MB
        • SHA256 68d913bbcf610bb5a585554c796ba1dabb050753ec6a2ad408b32d9ac9c5e3e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 28.1MB
        • SHA256 3a0997cebbbedfca03259a74e14bd2e92c301f7cb832736991be47ba6602e4c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 25.6MB
        • SHA256 67208b653845eae04822e9398fd2a5277f6d1d6fd061e0e10883e38044bded63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 27.0MB
        • SHA256 98730dbeec960fcd96021779ba2b43dfe5ffc895af7a221e3d98eb71a96f09aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 27.8MB
        • SHA256 f041242ce5b5c7ed497890a038ad38fcce865f1369396d7803eb5efacf85fb6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 26.9MB
        • SHA256 a0e2eea59b5605c1a3564a2afcc968cbbe50d61c4e522cef960c4455440facfe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 27.7MB
        • SHA256 849aa7b1d151033a4e619470e028c9b53103fd3fdf2cc117a0419dd1468a88c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 25.2MB
        • SHA256 02c575dfa8b741e379c81e34e3d9c7b98485be7a35bd7025b843fad23c4f72e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 27.3MB
        • SHA256 b640fe76edf1dc9a3af066116558f0be572802a6626ac09688da8973d355e5ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 27.4MB
        • SHA256 c9b8ffb498fd6afb4e7ef66ad8d78d9a54d49e14e245130e19e4ff86eac13ccc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 26.9MB
        • SHA256 014e7ffc9125753bcf1c56c06c1a7488cd8468c146ee3bb8f8f2dca366b2ec66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 27.1MB
        • SHA256 74e20b5524fcb78bfcf6131ec95029b03d12c657d96fea075955298fbaddadd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 27.1MB
        • SHA256 f276a053a35897e2086b69d3609b890ac34514ef1f50154b653d5377023a7c03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 24.3MB
        • SHA256 7719d3dd620fcc3f98cdcf8adfef4c59e0e799f71159a763871b474f58e6194f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 24.8MB
        • SHA256 b76adf2bbbc803449b479c63d9ddf243a9dbfb98967ca22af197a4148a4a4d43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 26.9MB
        • SHA256 1b1241fb31ac887e490353715537c06a9b3ee2cae8b29e6bc0ce6fc67b752b01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 22.6MB
        • SHA256 5e762b6c27258cc07c05c863474388e891bc8bcb51d41e6191c757da29428811
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 45.0MB
        • SHA256 3bb0a05863a30bac04ab47cb7ff7f5a0d58471a3848aa9843ad4f380191943ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 45.0MB
        • SHA256 fc59528d19fb7b9f6dbcae36090047e655654bd10985dd3bd2cc5ada47fda1dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 45.0MB
        • SHA256 7c46f280bc94f158c8665fa64c19f5ede9c23966215725128d5191846d72e7e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 22.5MB
        • SHA256 0f6b05a0998fd6c01fbd308208239d04183d1fdf9d9e8531df868155beaf0f03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2440-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4428-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4428-4-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download