Overview

overview

8

Static

static

3

2026-07-30...ar.exe

windows10-2004-x64

8

2026-07-30...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/07/2026, 05:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-30_229f80b8b8bd768ecd63d5931caae548_akira_amadey_cobalt-strike_elex_emotet_icedid_njrat_remcos_vidar.exe
  • Size 8.6MB
  • Sample260730-glqvqsvsbx
  • SHA256 45c028a6478499f5c10bdbfd0ffc25e57f80c65eec7fae6546fea09e84851a3f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_229f80b8b8bd768ecd63d5931caae548_akira_amadey_cobalt-strike_elex_emotet_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-30_229f80b8b8bd768ecd63d5931caae548_akira_amadey_cobalt-strike_elex_emotet_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2128
  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_229f80b8b8bd768ecd63d5931caae548_akira_amadey_cobalt-strike_elex_emotet_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-30_229f80b8b8bd768ecd63d5931caae548_akira_amadey_cobalt-strike_elex_emotet_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:612

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 9.3MB
        • SHA256 cccbdc0b9d1e864ebb2ba07f823b213a1de9c03979b6aa89997342e4880bbd68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 8.7MB
        • SHA256 741d1c17f40e78bf1cf68e9539d6e8f57851108551d795437dafeb22713e65ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 12.7MB
        • SHA256 7fa1f543d520ad226216c5fb0cf4e959ba8b7b4a0415286bde931c6c1163bbf4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 8.7MB
        • SHA256 13c80856e9130b45c73621d714640a2410b13c055f3712de346fa4109005f75d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 8.7MB
        • SHA256 65b7c7efd68a304b1111f23b1abaa1576ce5fd7db34445d34ae7dde8985bcfea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 17.3MB
        • SHA256 d56b11932fb0452bec699d39c60b2b36db8d9ae1498a46c245aa12f05ba9bcc9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 17.3MB
        • SHA256 abd570ea5381cbae086486a4e83735466a513fbd8addb720f3b9a80be1b6ce7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 17.3MB
        • SHA256 ff8689a7731f2da1a7982d4ba2355ae2e15326ca953190f4fa0e4c43b7272707
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 17.3MB
        • SHA256 79c1fc5ba864a8db85f53fdf03da6ad03003ac4cb4a475b1c660866caee9c9e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 17.3MB
        • SHA256 a69dba6eec6d8f6b6a1b0abcc11286d86c1998c7937dfe6ed65a1a9c1ec377af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 17.3MB
        • SHA256 476fa2e3054f5e10a5e7a973739ba350ade8953ac1ee92acdf283ada7f41731d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 17.3MB
        • SHA256 9da6bce55836f59c0d5110a1923e34e4ad5cf1361b356701c928706128259162
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 17.5MB
        • SHA256 a6dae43d2819926d78b7f858af4d373e4df78c9961e812a8bb9635af7c5e73fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 17.3MB
        • SHA256 5a00f41f23ce393079edd90e607c3f5fa27599fbd43bfcf4951c13a72d1d26d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 17.3MB
        • SHA256 a0a9dda2484487580f59645c31a2fd82a2965779cf2229754035ecef139c7368
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 17.3MB
        • SHA256 cfb427eefdafa00ae389a286284401df363bfba33f26c665d721757897beda78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 17.3MB
        • SHA256 db5ef9c8b058b644e8a50c6a2517665097ab221f36389450c3268c861141d49e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 17.3MB
        • SHA256 978fa839b62c635c0f3cc93677d94a3da1cc257307408be3599601c8adcf0c2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 17.6MB
        • SHA256 05a57efc84af6b503dcee7dce65bbceb18088c7ed48b6eda15092a6cd635e2b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 17.4MB
        • SHA256 a293bd4f1066e1d280ec9b79aeb3010302c31799f1b02e7b050ec8b662bb5a6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 17.6MB
        • SHA256 fe14a3c1a275cc2f5173fabb14dd1caebdc3a0953435afa343afa22114e13c0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 17.8MB
        • SHA256 ad9785bb5b245a2223d406f5ef08be5700a80089965269e608cc4aa7d74c3247
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
        • Size 17.3MB
        • SHA256 aea1c9fd288790e489d89fed29389d6318848aa599593d3abb44f3f1065a9106
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
        • Size 17.4MB
        • SHA256 528ac3bc04b585194d2ecf264ef4c8e255cc6e897eff401b819299e4d934278a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
        • Size 17.3MB
        • SHA256 09fa93202837d083910a15457ec9adf16aa54585c686a0ccb76e534298a4ffd0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
        • Size 17.3MB
        • SHA256 2e1576b1a1fe1fe58e048ed62ebdf80d6f2524ce8708fcffcc3aff2549aab9a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
        • Size 17.3MB
        • SHA256 fcc765771673752e8b98faf2e72c4b8cec32c9ed6fb6034f02d7108eaf97eacd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
        • Size 17.3MB
        • SHA256 ba53be12a95909fdadf2379d92ec25d10f2fb6f84846b6a545d1676a34b414f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
        • Size 17.3MB
        • SHA256 f111b0f354003d2ef7dde2e26b1375d80f10bad622ca023bde3e42bf3af57645
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe
        • Size 17.3MB
        • SHA256 9f77faa09d902d064aa03d5a131066ea38e10cbcb8b924654e0b8b39dbe94d4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe
        • Size 17.3MB
        • SHA256 41d096fad657c656fc93936b5737dcb877fb89df560e90d61563c804510bc4bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe
        • Size 17.3MB
        • SHA256 5c42141abea90d04af3d06c911cee899bf01be899a1d8ce4f094d10fdd780324
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
        • Size 17.3MB
        • SHA256 37497ff268b65611b6ac6fa2673db7740135e7853379677091bf305d89a315a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe
        • Size 17.3MB
        • SHA256 d73a848d2ea42d5a3dcc93cc8e9758ebfa21e74848714c3cb6ded7d59463c71c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssvagent.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
        • Size 17.4MB
        • SHA256 e05c6fb8ee42312fa3c848b0f4087fea9a58e6c11fd28a016919d8f5eaf64d16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe
        • Size 8.7MB
        • SHA256 f5dc62f2e3cff4bcda57603d2432279d779feeaa4d7a395d90555b41b25da6c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe
        • Size 17.5MB
        • SHA256 d14654f80a54b189cf3d6d2a5c1a6fc2b0c0e751756f79f9420fc4fc9bbe1e4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fontconfig.properties.src
        • Path C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src
        • Size 17.3MB
        • SHA256 db3f634e0a92b0aab14bdae6bd53a4a8e1717b4f01364e2d6cae1fcb2e3a987f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jabswitch.exe
        • Size 17.3MB
        • SHA256 17e2cd9d180267285d5a908884c04c21b65494c1371b90c7ffdef656bdbf4b3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jre-1.8\bin\java-rmi.exe
        • Size 17.3MB
        • SHA256 242cac2ededccf208d23aa2716dddc2fe76abe67594118deea548186736b0b23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jre-1.8\bin\java.exe
        • Size 17.6MB
        • SHA256 52f590dded372ebb87d362068b853ea0d4fbb4eedbc6bf3ad1503d1666f58125
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javacpl.exe
        • Size 17.4MB
        • SHA256 a754035e888f6e37801d159dfe0263bd40f74861b572905665efd4fb70ea074d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javaw.exe
        • Size 17.6MB
        • SHA256 79ab6729a1537ef7c2f1a0bf3b20666f3ef28555f94defea167ae266f059ca11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javaws.exe
        • Size 17.8MB
        • SHA256 f5ff6ce67532da1b2f9b8899a1f9ebdf4967ba82a1bfd0cf1a9f28012e6dc6e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jjs.exe
        • Size 17.3MB
        • SHA256 a0a7da69c96f31563a850739fecbf888ccf494e2104dd0ca62600289a3bbeb71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
        • Size 17.4MB
        • SHA256 1018ff243930e6de086a34b9169901a3ec4bf96fa193783a7c88a2128461305e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jre-1.8\bin\keytool.exe
        • Size 17.3MB
        • SHA256 9d0a9f65448cb323717f097c7a3d50ac1bc88f1b733b27c0ff51382b36964411
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jre-1.8\bin\kinit.exe
        • Size 17.3MB
        • SHA256 d9a4e738c62eb7437e451055ae896621cab1850a4dce63ed0c4970f1f98c67f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jre-1.8\bin\klist.exe
        • Size 17.3MB
        • SHA256 d1261448fdf1394235fd0518dc2b3585d81272ea3aeab653ee7e72a5ef9510be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jre-1.8\bin\ktab.exe
        • Size 17.3MB
        • SHA256 7a69bd4834e9dbf6259f99d27b00bd41af28aeac35180f5b9f8afd8d72ce9f5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jre-1.8\bin\orbd.exe
        • Size 17.3MB
        • SHA256 179400a5f0297478569e5019c8f0f55ea46605d3b6cf3cf759249301a267ad89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jre-1.8\bin\pack200.exe
        • Size 17.3MB
        • SHA256 f8caa6bd07d9dcc6741e9d4b1f22e0a4b5e694e329d382cb25e1125b80c18e1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jre-1.8\bin\policytool.exe
        • Size 17.3MB
        • SHA256 b609e8ceda326761fd8bb5125b36cedeaec9529a84517bcdc5c430c5390fd088
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jre-1.8\bin\rmid.exe
        • Size 17.3MB
        • SHA256 81f43f9ed983b6fe3f47c405018ac76c5d46333b368c5d0b598046e5bef94919
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe
        • Size 17.3MB
        • SHA256 c16e224b7af07bb9099edb88b1e28f095112b03bc3865f5c11890d537c246380
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jre-1.8\bin\servertool.exe
        • Size 17.3MB
        • SHA256 0ce5784ed7b79385dd424495e59f678b9c37522b54b947933a185f5cb621c5be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssvagent.exe
        • Path C:\Program Files\Java\jre-1.8\bin\ssvagent.exe
        • Size 17.4MB
        • SHA256 cf2a569cb8f1be58fb309b11267dab78c392f1bebc06b00327f3e8223f18f8ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jre-1.8\bin\tnameserv.exe
        • Size 17.3MB
        • SHA256 ef8b8fff52a04921504f85e796a66b20fc01ccf3363cac4b67e19e24b7cf3971
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 8.8MB
        • SHA256 ccd55d19e49acbff938571d9b16f86328dc22fa079113ff063edf29c419a7eb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 8.7MB
        • SHA256 3a6e110656c51aa5ad87a53c03c1eb829582c74e879a04232896f344827c40af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 8.7MB
        • SHA256 d7489581d990a2da49dda8da4e9e4e8b8ebf580bc8ec545904ea3d9e9e474312
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 8.6MB
        • SHA256 45c028a6478499f5c10bdbfd0ffc25e57f80c65eec7fae6546fea09e84851a3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/612-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2128-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2128-4-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download