Overview

overview

8

Static

static

3

2026-07-31...ar.exe

windows10-2004-x64

8

2026-07-31...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    01/08/2026, 00:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-31_171a28ef4a87f5968f761cdbf1b070b8_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 23.0MB
  • Sample260801-ahsftsbm5t
  • SHA256 46e8eec98a765be0bcd199c7869ba892e75a9c6524a7620577d4c75b2b8db3aa
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-31_171a28ef4a87f5968f761cdbf1b070b8_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-31_171a28ef4a87f5968f761cdbf1b070b8_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1352
  • C:\Users\Admin\AppData\Local\Temp\2026-07-31_171a28ef4a87f5968f761cdbf1b070b8_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-31_171a28ef4a87f5968f761cdbf1b070b8_akira_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5004

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 23.9MB
        • SHA256 f72c5d4ae560b1b66f8a5381419a2862844472e9fdb0042812b16cdd506d4d5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 23.0MB
        • SHA256 46e8eec98a765be0bcd199c7869ba892e75a9c6524a7620577d4c75b2b8db3aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 23.3MB
        • SHA256 c2d1e29b0a2cf03ad936888ab9bc68e069b4dc11092fad325fef2e82b05237d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 23.0MB
        • SHA256 1d9b493c2b0110004588f24a8c6d38dce9e1ceff482925dd56aaba2970b929c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 27.1MB
        • SHA256 1191e7396e18eaff529391ca4ca25eff8fd30a20deaf9e00d4a0418edfb87cc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 46.3MB
        • SHA256 ff7b032b8b08097cad9eecbbaf01321b5781362e75c23808c78c224d8785fb00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 69.5MB
        • SHA256 01a3b3f594ecf1d1fc34054050fba3ee0675e5ffe2d63665954f12a5bcef8abc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 46.1MB
        • SHA256 11ff943d32211b6e427dc478a4a1a9c3454555187e0e355445067e2a1021ea57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 52.0MB
        • SHA256 e040b49d4f1d455c084bd936280b76655806ebe79f39c42175fc4cd5fd6f36b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 47.7MB
        • SHA256 f8ae6c63c169f580c4f859a3c3adbe23eeca68ce9108c85a5fb01a69b5f6a527
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 49.5MB
        • SHA256 37e78b43308a0d6c2dc1fbcd4b8f0f0867d0af995af9ada32515a9769f05f621
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 48.3MB
        • SHA256 a66d536236a794247ffe8f3a31473ca150802fbbe1aa5f02033ed171d515460a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 47.8MB
        • SHA256 8a0f1671308e8153d5a0c5a973182f3512404356b89d7ba33579dac94b295d7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 49.1MB
        • SHA256 87de08de47961bcec47b02ed5d6ece5aace448afd0c958bbb57cb873f279d34c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 47.4MB
        • SHA256 1f2a3da3a9336dfffa898b3556e378badb9609cc465b41d014ff7d6fc1211826
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 46.0MB
        • SHA256 da95463d684071dc5dfb0e9cb8743197f823f394c848fcfb32781d5fd40f9646
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 46.0MB
        • SHA256 1e7988ad06dc1c0802fa2f9f5a6d94aeb4c4fc7889ed988238210fd506a60947
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 46.0MB
        • SHA256 6657b8fda3f3007b29e1c20c9dd617212faefd50ee2903ad64e0c7b126469677
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 46.0MB
        • SHA256 84ea36098044a4c74c0bd23b974e06a7cb284d19a9951fcfb855bd4f47bf4139
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 46.0MB
        • SHA256 0ad7f32887f4053753c2f780bfad91aef07bead5788f889b585cd26dfda917cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 46.0MB
        • SHA256 51cd536f5183118b4b4fd23b0d3e29d8ea515cd767698d468d9f2db442208ea8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 46.0MB
        • SHA256 02ffb199aaaa1bc5d7338d6f12c4353aad33a803fea4e6e1a8cc6da0b8455f6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 23.0MB
        • SHA256 15a5a2b6a930453a13441fc8cb05f94d108cba0e81b8b4dc69c9a335892512a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 46.1MB
        • SHA256 b9cebc3a48062acc00bddd48fb3e770fac1e3e29961312a5dd988a4178f3eb39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 46.4MB
        • SHA256 a566d32c75b83cae5112172294be677b165bb88447ee92ec17c150870c9d9311
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 46.0MB
        • SHA256 d8005a5946e49ec8b7b6b419381e13517f0af52ce1958570980ff6b007728548
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 46.0MB
        • SHA256 cc6861df1f371b93f3dae3e44d74a50c1a2493b4067413ca4f0c160a09e4e107
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 46.0MB
        • SHA256 02038b28921f15ee49d8b4be9202b5e503440bfa82c1066f7255b3f60752f012
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 46.0MB
        • SHA256 e1c16481550c7be2d5dcdba93f26e44a87fe7b43517df9d2521367be90ba37a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 44.9MB
        • SHA256 f085741ef64890243d5121c0348150f1edaebb55645a1b0bf298f66d361123b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 39.7MB
        • SHA256 61d7f7202662dea56d44c8bf920876d1f530d1328354b595f126db2c1e6ce85a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 15.6MB
        • SHA256 abb879145bbaf5c5389650d636a011bd86fedd470f92b2b08e39dd36a3195b29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 8.6MB
        • SHA256 67306d4acf61c269b52144edaeb8161e7eddf2527eece008eec74a523f9ef37b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 9.7MB
        • SHA256 12831b04c80f81537f9bae5e62066cb10b2cdc2d759a8cf3a8a1de90531f97d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 8.4MB
        • SHA256 51c5742d0771c6bf1d9223309d4401ecfe4ac2fcb16b10898b726b2616301c63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 384KB
        • SHA256 144c4713f378ec54938375c9433afb979bcdaf05350d70c3d422e883e7e60d15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 46.1MB
        • SHA256 ea775dcd78a6e1cdd004d8d2a885b2cabbb08ad6e5f77afa74b9567cd4da262f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 46.0MB
        • SHA256 08005084e19aaa5c2a6f00c907c83cc66073d1ec3c6eccbe6ee488ccce0b3291
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 46.1MB
        • SHA256 86af54e24f3bcf0320b33ebc52af60ff6cacbb0f4985cc69bfc0783ca8f1166f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 46.0MB
        • SHA256 3c0bfceefbd0a8297dd1993b6b293e7e7de38e856523f065ac9eea25cf8214e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1352-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/1352-4-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5004-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download