Overview

overview

8

Static

static

3

2026-07-31...ar.exe

windows10-2004-x64

8

2026-07-31...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    140s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    31/07/2026, 13:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-31_fb32c0f4abd445324b227069ff86b3a0_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 9.1MB
  • Sample260731-ql79fstekg
  • SHA256 0c5beffbc5c960ec398d7b519305b99e4c95f9ccb88605124732d68c3d11805d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-31_fb32c0f4abd445324b227069ff86b3a0_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-31_fb32c0f4abd445324b227069ff86b3a0_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2988
  • C:\Users\Admin\AppData\Local\Temp\2026-07-31_fb32c0f4abd445324b227069ff86b3a0_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-31_fb32c0f4abd445324b227069ff86b3a0_akira_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3052

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 9.1MB
        • SHA256 0c5beffbc5c960ec398d7b519305b99e4c95f9ccb88605124732d68c3d11805d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 18.3MB
        • SHA256 ad769d75ff441f1d46c2b7e76518161f12172ce12bd8c29c1eb060b1c9438a5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 9.5MB
        • SHA256 da596f182109c05507984c9ce2a92afb65f0ceb61837f3183d5ea79d67605877
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 32.6MB
        • SHA256 acb5c11fb0e09a32ee12d402d9dcc96c5c2949a7f6c5d0d44009f09510ae69f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 11.2MB
        • SHA256 0fe43d07b1ba7336b4de0a025701ffcec177b5f511a89c5c1b5a193714492b83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 18.3MB
        • SHA256 b1e820cc82b0b82d0034007ad15d82f4e0a9340d47d680748b0cfed07c9c4509
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 24.3MB
        • SHA256 b39c4cd8689ab0f58893277d23de475cf96d142be8de2e8f61aaa04d256a40ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 21.7MB
        • SHA256 20cae7d6f68c7fd9eac49a0491ded583018b3798fb885b9c7df30e519b575940
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 20.5MB
        • SHA256 cb217ff30ce48402e4aa7c24578f030fe524a34bf41904221014209eee011284
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 19.9MB
        • SHA256 40064c99a50d110b893dc7848fda5a1ea256a22e1a2c6c316ca935ee4bfabb51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 20.1MB
        • SHA256 ee7512ef8ed5dc506746abd69a41f36f3f019554a6fd0045d449c12464386ffb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 21.3MB
        • SHA256 b40d021c202b8d580242c9c0c15732d531c75b157fedc51ce0c541754096b56d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 19.6MB
        • SHA256 2c8013cdb7663534eaf365605100965d61fcdca479c11a437d0d9daf0ab08ba8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 18.3MB
        • SHA256 2a3a1f3e03fad0c198796fe90ea4bf9060c556e776e16f988e1312dc684b8235
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 18.3MB
        • SHA256 e70251f62f1416230696bd04d2c501b9cb9f15cc09b4b0f204961bf7c2193ec5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 18.3MB
        • SHA256 03ba39ec297d38e25c7f202a9f546a9546abe21dd145e34fa2862c72d3812068
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 18.3MB
        • SHA256 f9a8bb09ec092f700018eb38481eb8a17fa86b7dbc8884d5ac36604b640a9158
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 18.3MB
        • SHA256 72c4760f3ff107ef2f051c39b4f89cabf439ae6794cbb6341f3782be66cf74a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 18.3MB
        • SHA256 35269ce2ab0ceaaccdb44dae13782c214ed6be7c9f7baf922955342ee739de59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 18.3MB
        • SHA256 ae107ff8a02e30ff31768b5141b8a3b187da9bcd68406591506c39ea743777be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 18.5MB
        • SHA256 0c2975a90fb11dfd9675bc1dec7b70a366ec86393b4e7b96a223411c55b11aef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 18.3MB
        • SHA256 73127fa902a46e1fe7a26c70ccb3add2bfd78d04a801ea002af41dec67f0d0fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 18.3MB
        • SHA256 1732b4f7195fd1e89f01c046c57e37ab9149985954c426b0675150a160113c32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 18.4MB
        • SHA256 3c84d5f515d83b1cfdcb356de77c56613ab5f4728d8b9e1777802be283a4ab43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 18.3MB
        • SHA256 d483e4f5678e7210e814e7ab981dee55ab9f41e0686e9de19778614a73e208b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 18.3MB
        • SHA256 04f5b17b981bdecb48c0ce918b96ec996f1f000ebdfec97e5d9a4ba3436c1db3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 18.4MB
        • SHA256 a37d0241e46d2bc3b0d3133df3b7d26294c7178c18f572477e63dd09ec94a50f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 18.5MB
        • SHA256 37c51a859896473a0a9ea06f8de3302a4b81111b5c3d7fd98a2222271eeb0560
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 18.7MB
        • SHA256 29724b69a4baf4e9265920b165bb9e85e77595f0b9c8d0f966556e41b3143938
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 18.3MB
        • SHA256 4e79d77e619cf6d040c4a17d824d19cf8e8b76c459a0d856cf111ecd3c08dcc1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 18.3MB
        • SHA256 3341489f6c3e2d2f460e46c3e698816165f1b98a64eb34074f46ea633c937d15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 18.3MB
        • SHA256 a76994c839102cd1ac8ba7465034807d25342145afc939c8a58b5ef89e9f5f69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 18.3MB
        • SHA256 1b83312ba0d4401265662e2ccdaea2e50c62a91f99bae9103118cc730701b0ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 18.3MB
        • SHA256 dc2882a858575c3f48aaad3602e63730f6ceb41191a72ef419d4e3bfa8b5e1b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 18.3MB
        • SHA256 40e924c3fb192d0654e2269c2fbcc72b90c5189819bf0b63df771e22d714373c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 18.3MB
        • SHA256 3555d494e0f31f3724c942d3d89532472ac9990b9823c1806c50fb3eb0d21bf2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 18.3MB
        • SHA256 92a838b119b30c78e9318d8c182be4264285e9b819054ae76dcf1199f2110538
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 18.3MB
        • SHA256 70386830644b0449581bf636bbeca5fab9132c1e29cd998b3495ef6cc6b99be3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 18.3MB
        • SHA256 2d628461ce944863a515aaa01d13407014eb29da7d87847adec1a1944fbc2d0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 18.3MB
        • SHA256 32ab59049f2727ee1dc4b22c56e52235a35dfb17c27164014f79d83c0e5c3c44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 18.3MB
        • SHA256 62757e5824c339dce0bbce41b0ff4ee7994618608487ce7c784a3a84cc3bc569
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 18.3MB
        • SHA256 fb087109980a3873ac2dcd22578b5d523993a8e1247577f349d0bc4ea06625da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 18.3MB
        • SHA256 b2da301cde0d91f21887de7ef7f7e0cb35a8287cdf1404aa32d1ad4a1e0f276c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 18.3MB
        • SHA256 064f499c7438fc6fe067ee2d85a2b2334b83ab9641345edd56e64dff8667bb0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 18.3MB
        • SHA256 a0cdebd498adc5cdaf99c0a0f863d1998db5bcaefcad30eaed1ab61100f72bde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 18.3MB
        • SHA256 b7586630cacb3080a80412ff2e94c0c62a93e8b1cd1c4315d350fe62fd9aa0aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 18.3MB
        • SHA256 fd7831caa8f12d8f651bcf8e2ba8528010197552293bbc1a270e2b0e7255dccb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 18.3MB
        • SHA256 226b39c5763146c7d213364d77101be9c2506116cc08915a2758b3169e3a6e0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 18.3MB
        • SHA256 154aa8590558e3362685d25947050fb30f3fe98cad4af68f8ff5c0b17d111bc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 18.3MB
        • SHA256 5ed39cfc28ef1b5713c00a006a569c55a1a4ec4047b1364289c080d913bcdc07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 18.3MB
        • SHA256 dbce5ca70490dfb28700a5deaf5d534260236912e62dd4353fec2020e9354b81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 18.3MB
        • SHA256 2bf50f039c710c5df8fdd518d7dfa3e8ef6ba12b38e2b06665b73211a914400e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 18.3MB
        • SHA256 1d4a05da98ad46cc3dbd08e581bd421dfc89b96af8a61006759a790af39e3abe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 18.3MB
        • SHA256 15f9b4cc17fadd00d96fb8606a2b06be53d49c97a992e2ebfaaa45dbab88768b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 18.3MB
        • SHA256 9724219b7bdf8fed5b17c0289354c6340619d4eb2d59eaf20b8dc7062156c706
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 18.3MB
        • SHA256 d22ef4840a9af824c528087f9bd1f120b6d47d068f8327a59a0fecce977c2c4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 18.3MB
        • SHA256 c449fa869009e1b96dba250d7ab6b7ff75934aa516eae39484e0c8cdfae2ae75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 18.3MB
        • SHA256 775070feeb0737f0c9ce1e52fca1f2a5abb1eb22bc6a49c028b2fb81e75dd08c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 18.4MB
        • SHA256 0a63724b5a487d91e33607287e53e0a11ded63e4274639f8702ab62571ddea29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 18.4MB
        • SHA256 5ea1e06c36db94a9a0307a1f02429ad85ad5cd31f7dcb08cba8405d7d65372ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 9.2MB
        • SHA256 0ef65c40b402bb7e97e21a5932d8ec69e375bc3188e92169220a80a8b5aeb490
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 18.3MB
        • SHA256 6ed03df62492f2d25d20319c328abeb97b9f3c4a20c42fb806dd16bf9065f64d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download