Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/07/2026, 22:01

General

  • Target
    2026-07-28_d606f10ac9e48d6a31003d18f7b7d5f0_akira_amadey_cobalt-strike_elex_emotet_icedid_njrat_remcos_vidar.exe
  • Size 5.8MB
  • Sample260728-1w89lsam91
  • SHA256 27acb4c37c03033243eeab075c782a5fc277edffbcbcbeda81dde6f9dc1110cf
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Control Panel 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-28_d606f10ac9e48d6a31003d18f7b7d5f0_akira_amadey_cobalt-strike_elex_emotet_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-28_d606f10ac9e48d6a31003d18f7b7d5f0_akira_amadey_cobalt-strike_elex_emotet_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5500
  • C:\Users\Admin\AppData\Local\Temp\2026-07-28_d606f10ac9e48d6a31003d18f7b7d5f0_akira_amadey_cobalt-strike_elex_emotet_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-28_d606f10ac9e48d6a31003d18f7b7d5f0_akira_amadey_cobalt-strike_elex_emotet_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4672

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        BackupConnect.htm

        • Path C:\Program Files\BackupConnect.htm
        • Size 6.2MB
        • SHA256 2917e44eb10bbd22ca775b8376ce527dd037469c52fd9db163f5a72839d33bc9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppVShNotify.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 11.9MB
        • SHA256 9c6388a38b946f6b5fd368d49c0909a1e717e7a5c044f8779c19853a396e834f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InspectorOfficeGadget.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 11.7MB
        • SHA256 1a353c24937edd4cbba32d38de4eba262d3ff0cbbb3c86fa303ea951994d9b67
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IntegratedOffice.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 15.8MB
        • SHA256 959c1f8c3c93425b45c493009805186ff898818c3d2fccd9c118bedbc5dfd91f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MavInject32.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 12.0MB
        • SHA256 608a027b96fe1d04f1600b815f7d84f58161244fed59bf330bedbad795ec7a5f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OfficeC2RClient.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 29.3MB
        • SHA256 f8fc98d59c35fc2e2bc4391861a72cc8e0225c3e7e3e16850c66404286042fff
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appvcleaner.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 13.8MB
        • SHA256 69b92d4e9d900f0286d2786cfca850eb53bffc3bfa8ca8c677c7da2d1b96f8e1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrmstp.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 17.7MB
        • SHA256 ef815c16efb8b8c928dceef09fb06ec23f22adf4f520116085a1d8050d521446
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_pwa_launcher.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 13.4MB
        • SHA256 dddc8b9b1ac768841236f8ccd3606d7caca1f3f6cd26367c6e13a7ac7cf6992d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevated_tracing_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 15.1MB
        • SHA256 933d3445f48954d51fb06898955c2491c850133939b273744cf5c68fb9cd414e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevation_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 13.9MB
        • SHA256 48abcc3189041dc3403147877471c70ff6e8d9b3b1c1f75f034bafe57e9642c7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notification_helper.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 13.3MB
        • SHA256 56c0610824ed2462f73ade87ee98a6da66d917eb96f6a640cf43e4dc5a0ee15f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        os_update_handler.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 13.5MB
        • SHA256 9a2d77b12b5ce20ba9827c298a8a2aa695129443bd0745ada32b96e3057d0c5d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 14.7MB
        • SHA256 23b55cdbd1a0efb3f90284960d92ada25fde1f471d2a82c71b88fcdb52615c8d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_proxy.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 13.1MB
        • SHA256 117ff4727dc38909b22b94f2e0ea952e6206cca5a337cb6a660cdff32d314a09
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appletviewer.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 11.7MB
        • SHA256 7f7957b5efb704cd6523ead7c906c444e0fd875abc53628020008e5c33171687
        • MD5 SHA1 SHA512 SSDEEP TLSH

        extcheck.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 11.7MB
        • SHA256 106c61bb9d2c24a4f797e1163a22dc478ad9ecb9e41310dc809a49ed9acf459d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        idlj.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 11.7MB
        • SHA256 77cf24e1a7b176e572d541caa626f389e694730e2f231040730ee4e0c7603669
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jabswitch.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 11.7MB
        • SHA256 d5babbfa881465b66a23749728c99e74d69860ec4ac6fcc854a5a04ff4109326
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jar.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 11.7MB
        • SHA256 0e00b1e11be0c08079f766b360786f5f19552bde476e72768f071e63c87e1e79
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jarsigner.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 11.7MB
        • SHA256 af9104b26ce6d649f873998a9d51cca6453e341ff14fcc1df938ffc6db73306c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java-rmi.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 11.7MB
        • SHA256 669bbf03c815991cfaeca2c5d682a57f3b6874ab0e7d9b635d92336829077266
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 11.9MB
        • SHA256 e05156c25bb3b7efcbd534cc3cb28d7801e4bf57803df3181df5d58becfe7984
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javac.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 11.7MB
        • SHA256 28a04f10f5cba12b3b43755a3414e7cb072b6e589641f9eeaaab4347c34ef304
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javadoc.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 11.7MB
        • SHA256 0b8794f8372ec2f19c18265b754fa8ac2a063f5d988a4cb70cab5aff4cdf61cb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javafxpackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 11.8MB
        • SHA256 030f2fd7130b477134f5e8cc8c51560acfad594cf6738a72c71532142a3dde84
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javah.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 11.7MB
        • SHA256 60f948518af66f64d9c0de96a6f1680ed7c8862f4f1e7f527f6f59001714c8ac
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 11.7MB
        • SHA256 140e0b4ee1e765ded6596fd20ff57887382660d65ad5fda29bbf5f57b3a051b0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javapackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 11.8MB
        • SHA256 b9857ef73507448b63cd0addf54432f41ca85ca031da8e31a070c414e0523a04
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaw.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 11.9MB
        • SHA256 9b27bb60f436a923e23bf86b536dffed8242a8753ca3106c4c06991f0762f26e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaws.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 12.1MB
        • SHA256 19737f1c0ca195dfe79109ec505c99bff843fd46ed2da7e56def88ca9c407a27
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jcmd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 11.7MB
        • SHA256 49de0223aeb94649662f4bf5a1eac8792d2be580fd9fc81b84236b85a94b1c4c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jconsole.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 11.7MB
        • SHA256 5e6bfd1b0ed77a750159a9ebf9e456615b5e8881502bd392dd22dd190a2a0e49
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdb.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 11.7MB
        • SHA256 23a39e8c7abde2cd3c2740b46e97b362195f89b8d034d8ab75d7649fe58dee78
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdeps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 11.7MB
        • SHA256 752112c4f9fa4993cfc396ed36b3b57f699cacb795f2be7edfdd4a915432da6c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jhat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 11.7MB
        • SHA256 44d93d4e89330198e385fe04df3785aabc9b615e1c3a38186ebc43c27cc3ff50
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jinfo.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 11.7MB
        • SHA256 c61a848019b48c4d9215a3232f36ded07bd2f5c4e6c32b6dcbada08400697dbc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jjs.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 11.7MB
        • SHA256 a6ae8f78c8372c0c39b0b965f47cf72d7421d34197e197827fbd93779c1a28e4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jmap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 11.7MB
        • SHA256 07033c507c5d913faca6b05f43505b9441b1cc961ef114b44f2e277f487c347a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 11.7MB
        • SHA256 c490b2c08c73077f72881fbea369f6b7eb498e8a7a70f13ce7f301f55ea921ea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jrunscript.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 11.7MB
        • SHA256 81da62644c7ca3e70a2b36d1c7ec9563900e8404560402bf87b463b14e00a355
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jsadebugd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 11.7MB
        • SHA256 49b741ff5e93f5b3687eb2559ad29235c1482edb4b74c2bd77afa751c3abdf51
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstack.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 11.7MB
        • SHA256 fe13b2bb60b3ff7e605d36cb7afb239fd5b069bf3c859fbc1673b308c5028d61
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 11.7MB
        • SHA256 29d54b5da4aa2a20b7417e32b7e9f2c0c6bbc4da57fe871e9dde775cee433c43
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstatd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 11.7MB
        • SHA256 7809976d8f4c124e7ddb32d78485916a81f0e1441f9dc0a5ceabb5cf7565f636
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 11.7MB
        • SHA256 636b05c56a2f1cc36c46667fa867294278f2e8ed9b5ada17cafeb20b7403fca5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kinit.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 11.7MB
        • SHA256 28c9467977439f5d185f0b66884f5e677b5b41d4f10d8ac287dc417fa994378c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        klist.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 11.7MB
        • SHA256 b8ce4c5a710f6d5ca6d839ab6dda58d253bccd7fa7b4fdbada1b31f48af0d412
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ktab.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 11.7MB
        • SHA256 fa5eb565eaf037ed18a69b5ce8b1def94fa00a3fe3fab281eeab8e6a47c9f577
        • MD5 SHA1 SHA512 SSDEEP TLSH

        native2ascii.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 11.7MB
        • SHA256 50c3f2fea9e96870dcae0121eb816b085c912bcd1c81d6b5758dfaf73a0bd39a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        orbd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 11.7MB
        • SHA256 68a7f883e661dfeb81635f8efa88ff5e32d16aa90d5f28dd8ed847bc15327aa5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pack200.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 11.7MB
        • SHA256 d70d9a08be2662fa2cd1fcc1b34ade7c15b6b495ec00eec4fab944954975faac
        • MD5 SHA1 SHA512 SSDEEP TLSH

        policytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 11.7MB
        • SHA256 fa74fa57757eac24771d32e0e4159c2f765bfbe883e085aeb3861cb4327d9f29
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmic.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 11.7MB
        • SHA256 40e999f7d0268bbb3378c4fe534630aa828777d0016de8a66743949bf2d76ff8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmid.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 11.7MB
        • SHA256 d1b574223a032852c11769104ed40c9ef1301d5f577bafa592d4b1b555aaea22
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmiregistry.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 11.7MB
        • SHA256 8daeb8381ebe7bb4d92e380d93035c9abab071a9edd9e4ba10f3b5c33d878b82
        • MD5 SHA1 SHA512 SSDEEP TLSH

        schemagen.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 11.7MB
        • SHA256 37ae718427744259eadf85e3ac8e3ff457faca4c6cced69500caf38133e81447
        • MD5 SHA1 SHA512 SSDEEP TLSH

        serialver.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 11.7MB
        • SHA256 cc104da66b4b5b7cee8932d7e3d0fb765338baf1cb468e086da3335a2d9b7c8b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        servertool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 11.7MB
        • SHA256 7e957cac9a7e7451b1863ade8df0ec3d1e6744acf43ac6209100926e372b6079
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dotnet.exe

        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 11.8MB
        • SHA256 5557a2afe4e2fd9147cdba511345997152b176816db6e5588c81784b0181cf0e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 11.7MB
        • SHA256 b0727fafcd4a869b28b6ac7728740c95b8f710b9811c09b7328f5dbbe40c4303
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 11.7MB
        • SHA256 561572751495932d59e86e79cdca4524c5c8ab41fcdba9b7513c35e4973db472
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 11.7MB
        • SHA256 f07578b851729f4d20856e6022f9775adf4cb04dde7fff6c76441bb0b05b0b60
        • MD5 SHA1 SHA512 SSDEEP TLSH