Overview

overview

8

Static

static

3

2026-07-13...ar.exe

windows10-2004-x64

8

2026-07-13...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    19s
  • max time network
    114s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/07/2026, 04:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-13_6d2f683d06a1288069d1f0b9157389f9_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 22.5MB
  • Sample260713-e2v4aady4z
  • SHA256 0f6b05a0998fd6c01fbd308208239d04183d1fdf9d9e8531df868155beaf0f03
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-13_6d2f683d06a1288069d1f0b9157389f9_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-13_6d2f683d06a1288069d1f0b9157389f9_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5096
  • C:\Users\Admin\AppData\Local\Temp\2026-07-13_6d2f683d06a1288069d1f0b9157389f9_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-13_6d2f683d06a1288069d1f0b9157389f9_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3648

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 26.6MB
        • SHA256 ad6650a2a86693e7c0c756eb422d513405d6a2cae4e17623c797efdb1894c015
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 22.5MB
        • SHA256 0f6b05a0998fd6c01fbd308208239d04183d1fdf9d9e8531df868155beaf0f03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 47.6MB
        • SHA256 7721a46bd4be56e5f1202c9626a323db9934f0ca5a355368d4bcba9ad1d185d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 24.6MB
        • SHA256 307e728b70a18d5639c83c6ac7307f7a35950e4722039f0afef83d8e7f17201b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 45.1MB
        • SHA256 21bfcb3a8a61bffa7e1eacbb2fbd8a569aa9e83a494d0ffa4662b1163b2ba0d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 40.4MB
        • SHA256 da02bac6b2d977735381a09d17292c811502d4e04611e6a8ecfaf128cc9feb04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 39.3MB
        • SHA256 3295a165247f41eb4e50c05c85cae065c2be166bda04324e7912a621fe38ab7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 24.1MB
        • SHA256 a37064a6892831eb77523001e9f6860a1a5a14c0afbb6ddc1ee756104b60c082
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 25.6MB
        • SHA256 7c0ab857755c18a0ee85616028763fa129d4f19eef8306885f0269a7b5a2f155
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 38.8MB
        • SHA256 292f6a80a7f59cede976693a59a0a62750284c6962ef65bc587d23c86e141867
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 37.2MB
        • SHA256 6a342f56d318c21162bf6513aab801c7395ac7f24d73b805795b350754a39102
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 37.4MB
        • SHA256 4fe083d40ddbe13a809cae350b6191574e51f9da7d0776909316cbdff1e15526
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 36.6MB
        • SHA256 0e81a1486d083ecf7b32c51e63ac0a3803da3dbc17da957ce355569d8b4544e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 33.2MB
        • SHA256 47a44b5b3c4fc6dba1b57d1b7d56ef62ba9ea0c0c522142a15c3443f798a8664
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 35.6MB
        • SHA256 bf494ff2ef9fc05844468c57dc1ae90fc4cb3a3ba4dc991d6ade60f8e8c492a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 34.9MB
        • SHA256 7cb0792df142e852e21edd68d8981131a627eb54b71d297b20d707b0f2d3092b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 35.1MB
        • SHA256 d604684daa2dba9672274ac37316a8606456cf2dbe697042ff24cc8b6cb0e875
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 34.3MB
        • SHA256 55be8b449f767da37f0629af1c22b6b39ea79461161ec985a042a316c7974e52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 32.2MB
        • SHA256 f52077f90bc28d296a3acfa096e8b072cbefcefabd3994b8c41f1b3baf4cece4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 31.2MB
        • SHA256 c68b2b75a1f178fdc15e05f378d41f12ceb4df19936cba5c170821b35057f4c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 34.4MB
        • SHA256 f02dad606b71994880b44e3996fb11388050dc3b686b142b399c1310dbbf150d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 33.5MB
        • SHA256 3a5925379c0d66b9b094a68219158c300cdd41a0ea86b0f35f292ff234f4b632
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 32.8MB
        • SHA256 14d6382537f5d12c4ebd8463f324b26fe436a5171ba17f659a9752f4fcf89b4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 33.1MB
        • SHA256 d531ec892421571a54ebf72024cc82dfb6d55deef681e7191e591d82e24b4af0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 34.2MB
        • SHA256 4f19d799e94c4e53851c199d4f1e6cc2028e871fc3a1da0f5fc0dfe4add44147
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 32.7MB
        • SHA256 0228d422f2d00a7e97cc1059177b729d9294dd9e2b91b6d667726303865edc4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 31.4MB
        • SHA256 7065dbba05e803119b5ad4ebfe2a7b00f5709f837d742b72e72351e446bbda52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 33.6MB
        • SHA256 92fdcba3b8a69b15aeea7d732d1bb8494414986c1c01c22467b0b686a6f55313
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 32.4MB
        • SHA256 debccc7db2eb9fc5338845bb276ad82eb65807e1a59cc14989296199fc2d8b55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 32.3MB
        • SHA256 74f457560bc2155222a3de47b388439c1e47f0ba50fbe65596cfd921992194ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 29.6MB
        • SHA256 7949f69d6f929590e5656234242ae4b4f0456cad69d6ba70f0b22a968e339d4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 32.0MB
        • SHA256 e6d7f4abe524fdbeacb3addf415d27c889277fde3633c57533e28437bc23f0d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 31.7MB
        • SHA256 329bc5b7b98e7919bafc47232d37e768c5259dad24da5cc99e82f1063c3e6e2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 32.5MB
        • SHA256 1b613755bf072a7e96d768809a38c923fbda94d2ab04dea535655218ad52d42f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 31.6MB
        • SHA256 c19deebd404b0bdcb3ab71d72a77985956433a6043ab904287cd90475e1d98a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 28.9MB
        • SHA256 dbcdf1af9139aacbac610b008144fa48ccf0eba7583a66ebd428539816d8c963
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 29.4MB
        • SHA256 7db366a4c80b1056798991e817a44ac901b116a5a087dfc5d586cbc36a4b81db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 28.2MB
        • SHA256 c32a7509c47aa402ad66dd753e4271f4d3aa48fe3f16941fc3b704bdeb11be0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 31.2MB
        • SHA256 2bc46e3d4be510d1bcded7f18b28b9e96535300d090a2207ec7576f7cbcd1cd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 32.2MB
        • SHA256 9c58d54bb72716962abfa2687a7ef904252e41f58d651da628b74697a92abfc2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 31.1MB
        • SHA256 bc6390bfc579c8cb3cc9c322c31cb63b89eb6017734c2f7459e15ca4b12c1be3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 22.5MB
        • SHA256 8d4851bca0054adc9476f40a0104a8f67399e3728ed26867bcc9644fa0c29d0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 30.8MB
        • SHA256 81200cb95f6feeeedea02b629098130e1eb80f06aea4998c2bcdfb1ac71fd512
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 31.5MB
        • SHA256 61eaad1478f84750135a53f94d14f328b395411851e980770c0d9d95437f6012
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 22.5MB
        • SHA256 1d9e34931868ee93fc538a9deaae6d6bef829cd1654b24e3e145e242d398fdcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 30.6MB
        • SHA256 8ea07731e58735bf05c5f72847f20027508efe71b6703aa9eb479996144cc620
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 30.2MB
        • SHA256 103c9fb5c561b84a85efaf44152da4e0461c27d006c8b357d8469db00538662a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 30.4MB
        • SHA256 144512e16c155f76c27ff91428021b6ea3fd7f464708e735f3763e129d831330
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 30.1MB
        • SHA256 9172257fa91004f5587b6be0580ffddcaf71f93f1e80403b71ef14d78cc22310
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 43.2MB
        • SHA256 86fb35e4802440b809644be41c15b13d9270eb886ec3329ef8da792be842b5c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 41.5MB
        • SHA256 f40e7458358dc9c5674791106559fb67f41ebab9bb30e50df0423bced11611bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3648-7-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5096-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5096-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download