Overview

overview

8

Static

static

3

2026-07-30...ar.exe

windows10-2004-x64

8

2026-07-30...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/07/2026, 01:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-30_ebda36446cf895244db4df31f96036df_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 15.0MB
  • Sample260730-bfhpaaap9s
  • SHA256 c48e52bf1bdb6cf4fa65ab31146162308ffe06a0d7e1f8ced584fc43474378c7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_ebda36446cf895244db4df31f96036df_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-30_ebda36446cf895244db4df31f96036df_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1932
  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_ebda36446cf895244db4df31f96036df_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-30_ebda36446cf895244db4df31f96036df_akira_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4516

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 15.7MB
        • SHA256 8ec4dd68b0b23a2e8635c89cbfa5f50f325c740e935aefee35df955b9990453a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 15.0MB
        • SHA256 48570a507a0bca6f8a55532e9f64e51205e4bc5c68f031ecdc804ac8e0dcb6c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 15.0MB
        • SHA256 f307f080889327d54a320005e991507d851b5f1666ae6342673d0ccca8c7ef69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 15.0MB
        • SHA256 f3e0840a59b3bff5d2256e36ce57528b0271ec9ceb5556a2516a0f2f5f8d2598
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 15.0MB
        • SHA256 2356ee76f787a83ba0ca9f6eeb042a45ecbf161cce7fb2c4ea11dff2cc0410a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 30.0MB
        • SHA256 08b96d436292362943b48ca5e1d55e93e94e68efdeaf9ce0b89e8d50535c447b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 30.0MB
        • SHA256 3166a4dfa19ce33682f24734fb98a1e98a9e59348d83119f641c03aea1f2cf7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 30.0MB
        • SHA256 d64215cd8fe39177aa4c6c81090472f6464bcb8c88be58d102abf0dd50768007
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 29.5MB
        • SHA256 ce976ca5bfdaf72844ae8bb99207efa8142aa15452ad15594a1e37d9c1b40801
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 27.6MB
        • SHA256 65c9b8c6b1df477de815a040bdf7b4e3f587ac5e81360e1c3983de764a5585a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 28.6MB
        • SHA256 098a028aeb97c8269e7dfea956ccee6f4191964f5b13ec55cec0116ab1a6b68f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 29.5MB
        • SHA256 71d964d891d6bcb212f907417a5fa87aa6c38a6051fbfea2b818d3881787ebc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 29.8MB
        • SHA256 719ccd8edb8978319d4b1d22fd78d9da936eda6b56110fa33bb071c2f44046e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 29.2MB
        • SHA256 0a46f0cc1ead6e188557f5ac5cf83f01f87746423abe4cd973c4701b6cbdb10b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 27.2MB
        • SHA256 5b40a376559beecb2bcd95493b718e24e49b63be4a2b8693953ebcc5df8772a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 27.4MB
        • SHA256 5e297069a90f9ed3f06c181d7267ea6a005f90c83775c6d5650806036f695b73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 27.4MB
        • SHA256 d272078453dade03c64eb135cb744a94d80dbe707606e039d8f04cd5c9f8882f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 27.2MB
        • SHA256 54610eb4a4acac677d1df92360201d6e632fdc4366799021b3eed979260437c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 25.2MB
        • SHA256 10689ff2507c1e2182d1abed9d812bb309ae7133b7c8267262e498e8c6ce5f02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 28.4MB
        • SHA256 3810bd1f78a202ee9c579cb094af1ccd25dfe95adf12239c5699da296be70b6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 28.0MB
        • SHA256 3304905ea8c92f38516d7cc5928dfeead4919c0967207fb71e95b7df2282bbbe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 27.3MB
        • SHA256 329f56e3a56f9ef730791991cadce8475ec4cab916d01afb8ee49f5a92a0da6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 25.8MB
        • SHA256 4afc5a173f1f762c7056e267b3ad7d6feb6486a8d8f706b53593b3bf6fc2202d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 26.3MB
        • SHA256 6dd6e03f8be2d547717ac3a6c3812f1a33da59ab991632130b167c28876ffcde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 24.9MB
        • SHA256 187ab8536e7243860f2e4ac4910f5b9f840d03b3189c51d2fb1c31b868dbb9b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 26.2MB
        • SHA256 3ff7b0907392a0182914cd48b88911b6208e564bd5ab9c2aa305947ba0aed13e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 25.9MB
        • SHA256 bf1e158402921c41f734068dac634c13ecee57ef511b0e656d37f9548b32b863
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 25.0MB
        • SHA256 a956d5c58a0853513a272b493e5de91558283fa548ba79c190190ebf1dfd45b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
        • Size 25.7MB
        • SHA256 315d3031ce0470c0d65dd31b9466bc8d99596ad8d832c75705cbca81908460e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
        • Size 27.0MB
        • SHA256 89e04a935bf97fa22aa59bd6eb838a45399ef1bd95ad1259e1bc532b2a566c9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
        • Size 25.5MB
        • SHA256 f6641699633700aa5167a70ff3fd44d9ffc6ca0bf7952c460e566ac0625a7124
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
        • Size 24.2MB
        • SHA256 a3d2e398bd018295fd7e6b0c79b9b5e72ff7c0f0718cafc6515ac88f49d9f119
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
        • Size 27.0MB
        • SHA256 cca73a6e8ce0591d8c87c639a3ae36a68ff395a4b4128d52629ab8b71e7c9c73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
        • Size 25.7MB
        • SHA256 64dad96fc8ce0bbf7ce92b8f9684ab9ff57a5e90c9eff597e8b892a1cd8eb8fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe
        • Size 25.9MB
        • SHA256 ad672804152acc0252fa466f9753833d755ce4068a28e4d125c145dceeb05190
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe
        • Size 26.4MB
        • SHA256 77b9f5e4ba3b298a78332cc9295f041bdb3690d513ad8fa118ab703613272e9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
        • Size 25.8MB
        • SHA256 4d84a3d7ff29ca3f82d5a1f0296c7b0d4a7ef1b77487ea695d9e1db304218ebe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe
        • Size 26.9MB
        • SHA256 1456901413a1699a338a42cd61afca7d7b4cfbce19174e14000bf4cd2c2a96bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssvagent.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
        • Size 26.3MB
        • SHA256 f260b726855d90e6dd23abdef64dff5fee6a9fec40d75b61199e901e82c6df6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe
        • Size 25.4MB
        • SHA256 74b199bd85506dea8d3ce29cde51c35de79b365aa62d0c91c716f1932d96575f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jre-1.8\bin\java-rmi.exe
        • Size 25.3MB
        • SHA256 87a633f8c32184cfbd86f96398b034b76b16f632cacf65633cfb76d3df4705c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jre-1.8\bin\java.exe
        • Size 23.6MB
        • SHA256 015e32fc329d277d0d1cdb6c51ef786625c6e0735bd92b42c62d35e6c7771ed9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javacpl.exe
        • Size 24.0MB
        • SHA256 a8368e4a6a3df9b1919629d3edecc531be0bf39961fb4db734337314b991f8c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javaws.exe
        • Size 25.3MB
        • SHA256 4baee5aa8a6531dd9db2fd9c6f399e359f5876cab171fdafcb6e1b08bdcce6fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jjs.exe
        • Size 23.8MB
        • SHA256 afba9b623528500ab74db499bb0a4395b062f6003302192fe08989132b1774ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
        • Size 24.8MB
        • SHA256 0c5c8a06a0e957b6e2e97200b2a1e16f252daeafdd3bee6bf78016ed1565f933
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jre-1.8\bin\keytool.exe
        • Size 24.7MB
        • SHA256 6caafdda2d2923e2b3947b216ca952ae4360f66e067f94aac15a92db6c437f3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jre-1.8\bin\kinit.exe
        • Size 25.8MB
        • SHA256 8605a3d0a71948282f2682d2601894b1509e5d884bef23d989b71ca1d0cc27e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jre-1.8\bin\klist.exe
        • Size 24.4MB
        • SHA256 a91a505cc2f6efab2dec2b408f3daeb6c2a94c5e8cd87ae3dffd758866e6095a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jre-1.8\bin\ktab.exe
        • Size 24.1MB
        • SHA256 276d472292496393fed0d9aaa88640e22183bf91bfa8b02f87369c4bac9c649c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jre-1.8\bin\orbd.exe
        • Size 25.6MB
        • SHA256 4e03c3db201a67478b587b69dfcd449075f6102db13fc1d65471443d96d84e09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jre-1.8\bin\policytool.exe
        • Size 23.7MB
        • SHA256 2bf0c0450d3bed6cfd68fd2282750d1878c1758f1623c0c0ea55525d3f1b6b02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 15.0MB
        • SHA256 c48e52bf1bdb6cf4fa65ab31146162308ffe06a0d7e1f8ced584fc43474378c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1932-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/1932-4-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4516-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download